🔒 feat: promote examples to real presets and cover every ecosystem - #8
Conversation
The examples directory was copy-paste material. Promoted to root as presets that can be referenced directly: local>ownctrl/supply-chain:lockdown local>ownctrl/supply-chain:no-automerge local>ownctrl/supply-chain:aggressive Each extends the base explicitly. A sub-preset does NOT inherit default.json on its own -- `owner/repo:lockdown` resolves lockdown.json alone -- so leaving the extends out would have silently detached them from the whole policy. Dropped renovate-security-hardened: it duplicated the base, which has been security-hardened since the audit. Keeping it implied the base was not. Grouping is now universal. The non-major group carried a manager allowlist, so any ecosystem not named in it got a separate PR per dependency. With the allowlist gone every ecosystem groups by default, and per-language rules split the widely used ones back out: Go, Python, JVM, .NET, PHP, Ruby, Dart, Swift and Kubernetes join Rust, Nix, Terraform, Ansible and Deno. These are grouping only. No automerge is granted anywhere in them; production dependencies stay review-gated whatever language they are written in. Verified: validator --strict exits 0 over 5 files; cargo, gomod, poetry and bundler dependencies group correctly and none of them automerge.
Draft, marked draft: true in frontmatter. Built around the four faults the audit found rather than around the config itself -- a config walkthrough is forgettable, and each of these four is a general trap that costs someone else the same afternoon. Repository links point at ownctrl/supply-chain, which is live only after the transfer.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 42 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Last step before the transfer to
ownctrl/supply-chain.Presets instead of examples
examples/was copy-paste material. Promoted to root, referenceable directly:local>ownctrl/supply-chainlocal>ownctrl/supply-chain:lockdownlocal>ownctrl/supply-chain:no-automergelocal>ownctrl/supply-chain:aggressiveA sub-preset does not inherit
default.jsonon its own.owner/repo:lockdownresolveslockdown.jsonalone, so each one extends the base explicitly. I removed thoseextendsat first thinking they were redundant, which silently detached all three from the entire policy — caught before commit, but worth writing down.Dropped
security-hardened: it duplicated the base, and keeping it implied the base was not hardened.Grouping is now universal
The non-major group carried a manager allowlist, so any ecosystem not named in it got a separate PR per dependency. The allowlist is gone — everything groups by default, and per-language rules split the widely used ones back out.
Added: Go, Python, JVM, .NET, PHP, Ruby, Dart, Swift, Kubernetes — alongside Rust, Nix, Terraform, Ansible, Deno.
Grouping only. No automerge is granted in any of them; production dependencies stay review-gated in every language.
Also
Czech article draft in
docs/, markeddraft: true. Not finished — it lands properly once the transfer is done and the links are real.Verification
renovate-config-validator --strictexits 0 over 5 files. Spot-checked that cargo, gomod, poetry and bundler dependencies group correctly and none automerge.