Skip to content

Update Dependabot config and require security review on lockfiles - #108

Open
mgm-sec wants to merge 1 commit into
mainfrom
chore/dependabot-1072
Open

mgm-sec wants to merge 1 commit into
mainfrom
chore/dependabot-1072

Conversation

@mgm-sec

@mgm-sec mgm-sec commented Oct 20, 2026

Copy link
Copy Markdown

Changes

  • GitHub Actions: group all action updates (* instead of actions/*) into one weekly PR. Previously only actions/* was grouped; aquasecurity/trivy-action, docker/*, github/codeql-action, minvws/*, SonarSource/sonarqube-scan-action, tj-actions/changed-files etc. each opened a separate PR. The 5-day cooldown still applies.
  • CODEOWNERS: poetry.lock now requires review by minvws/irealisatie-security-liaisons.

Notes

  • Lockfile-only changes need security approval; changes to pyproject.toml still need minvws/nl-rdo-zmodules-codeowners.

- Group all GitHub Actions updates into one weekly PR
- Require review by irealisatie-security-liaisons on lockfiles
@mgm-sec
mgm-sec requested a review from a team as a code owner October 20, 2026 09:03
Comment thread .github/CODEOWNERS
Comment on lines 1 to +6
* @minvws/nl-rdo-zmodules-codeowners
# Last match takes precedence
.github/CODEOWNERS @minvws/nl-rdo-zmodules-codeowners

# Lockfiles: review by security
poetry.lock @minvws/irealisatie-security-liaisons

@ricklambrechts ricklambrechts Oct 20, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whoops the codeowners is/ was already incorrect. The .github/CODEOWNERS rule was set to minvws/nl-rdo-zmodules-codeowners.

Suggested change
* @minvws/nl-rdo-zmodules-codeowners
# Last match takes precedence
.github/CODEOWNERS @minvws/nl-rdo-zmodules-codeowners
# Lockfiles: review by security
poetry.lock @minvws/irealisatie-security-liaisons
* @minvws/nl-rdo-zmodules-codeowners
# Last match takes precedence
.github/CODEOWNERS @minvws/irealisatie-operations
# Lockfiles: review by security
poetry.lock @minvws/irealisatie-security-liaisons

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants