From 972df67e403fffee45fced70b0b9656323ab989a Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:41:18 +0300 Subject: [PATCH 1/5] ci: add verify caller --- .github/workflows/verify.yml | 47 ++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/workflows/verify.yml diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml new file mode 100644 index 0000000..a4066dc --- /dev/null +++ b/.github/workflows/verify.yml @@ -0,0 +1,47 @@ +# ============================================================================= +# Verify -- Caller template +# ============================================================================= +# USAGE: +# Copy this file to your repo at .github/workflows/verify.yml and replace +# `stack: REPLACE` with one of: dotnet-service, dotnet-library, web, +# react-native, flutter, strapi, infra. +# +# Then mark `verify / result` as the REQUIRED status check in the org ruleset. +# `result` always reports: a human PR into develop/development/staging passes +# immediately; PRs into the default branch, bot PRs and manual runs get the +# full verification ladder. +# +# Add your repo's default branch and Renovate target branch to `branches` +# below if they are not already listed. +# +# SECRETS: DEPENDABOT_ALERTS_TOKEN (optional), NUGET_PACKAGE_PAT (optional). +# ============================================================================= +name: Verify +run-name: verify-${{ github.event.pull_request.number || github.ref_name }} + +on: + pull_request: + branches: [main, develop, development, staging, gigstaging] + types: [opened, synchronize, reopened, edited] + workflow_dispatch: + +permissions: + contents: read + packages: read + pull-requests: read + +# One billed run per PR. Safe to cancel: verification is read-only and deploys nothing. +concurrency: + group: verify-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + verify: + uses: simplify9/.github/.github/workflows/verify.yml@main + with: + stack: dotnet-library + known-failing: '' + contract-deadline: '2026-12-21' + secrets: + dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }} + nuget-restore-token: ${{ secrets.NUGET_PACKAGE_PAT }} From ad17d041b722c932030bcb065bcfaa449f1cb2ed Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:41:20 +0300 Subject: [PATCH 2/5] ci: remove dependabot.yml --- .github/dependabot.yml | 50 ------------------------------------------ 1 file changed, 50 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index af068da..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,50 +0,0 @@ -# Dependabot config for .NET / NuGet API repos. -# main is replaced by the rollout script with `develop` (if the -# repo has that branch) or the repo's actual default branch otherwise. -version: 2 -updates: - - package-ecosystem: "nuget" - directory: "/" - target-branch: "main" - schedule: - interval: "weekly" - day: "monday" - time: "06:00" - timezone: "Asia/Amman" - cooldown: - default-days: 3 - semver-patch-days: 5 - semver-minor-days: 3 - semver-major-days: 7 - open-pull-requests-limit: 10 - groups: - nuget-patch: - update-types: ["patch"] - nuget-minor: - update-types: ["minor"] - labels: - - "dependencies" - - "nuget" - - - package-ecosystem: "github-actions" - directory: "/" - target-branch: "main" - schedule: - interval: "weekly" - day: "monday" - time: "06:00" - timezone: "Asia/Amman" - cooldown: - default-days: 3 - semver-patch-days: 5 - semver-minor-days: 3 - semver-major-days: 7 - open-pull-requests-limit: 5 - groups: - actions-patch: - update-types: ["patch"] - actions-minor: - update-types: ["minor"] - labels: - - "dependencies" - - "github-actions" From edfea6e46e39f9e36fb325dd7314aa9f29a073ec Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:41:22 +0300 Subject: [PATCH 3/5] ci: remove dependabot-auto-merge.yml --- .github/workflows/dependabot-auto-merge.yml | 68 --------------------- 1 file changed, 68 deletions(-) delete mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml deleted file mode 100644 index b6f154f..0000000 --- a/.github/workflows/dependabot-auto-merge.yml +++ /dev/null @@ -1,68 +0,0 @@ -# ============================================================================= -# Dependabot Auto-Merge — Caller template -# ============================================================================= -# USAGE: -# Copy this file to your repo at .github/workflows/dependabot-auto-merge.yml. -# No REPLACE values needed. -# -# WHAT IT DOES: -# Auto-merges a Dependabot PR ONLY when ALL of the following hold: -# - The PR author is dependabot[bot] -# - The update is a semver PATCH bump (never minor/major) -# - The ecosystem is npm, nuget, pub, bundler, or github-actions -# (NEVER docker — base image bumps always need manual review) -# - This repo currently has no open critical Dependabot alert (re-checked -# here explicitly — see workflow-templates/critical-vuln-check.yml's -# header for why this can't just `needs:` that file's job) -# "Auto-merge" here means GitHub's native auto-merge feature: it still -# waits for the repo's actual required status checks (build/test) to pass -# before merging — this workflow does not bypass those. -# ============================================================================= -name: Dependabot Auto-Merge - -on: - pull_request_target: - branches: [main, develop] - -permissions: - pull-requests: write - contents: write - security-events: read - -jobs: - vuln-gate: - if: ${{ github.actor == 'dependabot[bot]' && github.event.pull_request.base.ref == 'main' }} - uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main - secrets: - dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }} - - auto-merge: - needs: vuln-gate - # needs: vuln-gate normally skips this job if vuln-gate itself was skipped - # (base.ref != 'main') -- always() overrides that, then the boolean logic - # below re-applies the real gate: a develop-bound PR never needed - # vuln-gate to run at all, a main-bound PR still requires it to succeed. - if: | - always() && - github.actor == 'dependabot[bot]' && - (github.event.pull_request.base.ref != 'main' || needs.vuln-gate.result == 'success') - runs-on: ubuntu-latest - timeout-minutes: 5 - steps: - - name: Fetch Dependabot metadata - id: metadata - uses: dependabot/fetch-metadata@v3 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - - - name: Enable auto-merge for eligible patch bumps - if: | - steps.metadata.outputs.update-type == 'version-update:semver-patch' && - contains(fromJSON('["npm_and_yarn", "nuget", "pub", "bundler", "github_actions"]'), steps.metadata.outputs.package-ecosystem) - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_URL: ${{ github.event.pull_request.html_url }} - run: | - set -euo pipefail - echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed" - gh pr merge --auto --squash "$PR_URL" From 83059a446a6dd399b8e68020f21300d6e7bd4600 Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:41:24 +0300 Subject: [PATCH 4/5] ci: remove critical-vuln-check.yml --- .github/workflows/critical-vuln-check.yml | 38 ----------------------- 1 file changed, 38 deletions(-) delete mode 100644 .github/workflows/critical-vuln-check.yml diff --git a/.github/workflows/critical-vuln-check.yml b/.github/workflows/critical-vuln-check.yml deleted file mode 100644 index bb11ee1..0000000 --- a/.github/workflows/critical-vuln-check.yml +++ /dev/null @@ -1,38 +0,0 @@ -# ============================================================================= -# Critical Dependabot Vulnerability Check — Caller template -# ============================================================================= -# USAGE: -# Copy this file to your repo at .github/workflows/critical-vuln-check.yml. -# No REPLACE values needed — this template requires no customization. -# -# WHAT IT DOES: -# Runs on every PR targeting main or develop. Fails if the repository has -# any open CRITICAL-severity Dependabot alert. -# -# Enforcement differs by target branch via each repo's OWN branch -# protection settings (not by anything in this file): -# - On `main`: mark this check REQUIRED in branch protection — merge -# is physically blocked while a critical alert is open. -# - On `develop`: leave this check NOT required — it still shows as a -# failing/red check (a visible warning) without blocking -# the merge. -# ============================================================================= -name: Critical Vulnerability Check -run-name: vuln-check-${{ github.event.pull_request.number }} - -on: - pull_request_target: - branches: [main, develop] - -# critical-vuln-gate.yml's own job requests these two scopes -- a caller can -# only narrow permissions for a nested reusable-workflow job, never widen -# them, so these must be granted here or the whole file fails to parse. -permissions: - contents: write - security-events: read - -jobs: - vuln-gate: - uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main - secrets: - dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }} From 4d8a2ca0de51c243f7914cca28296f75c70a42eb Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 26 Oct 2026 13:30:39 +0300 Subject: [PATCH 5/5] ci: record the verify baseline