Commit graph

30 commits

Author SHA1 Message Date
Erik Michelson
1f1231a730 ci: remove netlify deployment workflow
This workflow was used in an early stage of development of HedgeDoc 2.
It allowed the core developers to quickly check fixes, improvements or
new features to the HedgeDoc UI without the requirement to check-out
the branch locally. As not every pull request required a deployment,
this workflow was only triggered when the "ci: force deployment"
label was added. Since some time already, the frontend and backend
are so tightly coupled that the netfliy deployment doesn't make any
sense anymore and therefore hasn't been used anymore. This commit
therefore removes this leftover workflow.

@RedYetiDev contacted us privately and reported that this deployment
workflow could have been abused to invoke arbitrary commands, including
extraction of environment variables which include our tokens for the
turborepo build cache or the netlify deployment token. For this it
would have been required that somebody created a "safe" pull request,
which would have been labelled with the deployment label and then
changed afterwards since the workflow checks out the pull request
source repository, not the target. We assured that the label was only
added to pull requests from trusted members of the HedgeDoc core team.
There was never any malicious use of the workflow. Furthermore, no
released versions of HedgeDoc (1.x) could have been affected by this,
even in the worst-case scenario.

We're thankful for putting this risk at our attention!
If you too encounter something unusual regarding security in HedgeDoc
itself or our toolchain around it, don't hesitate to contact us.
Details on this are wriiten in our SECURITY.md in the root of the
repository.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2024-07-30 08:48:38 +02:00
Tilman Vatteroth
65f86a283a fix: add dicebear/converter patch fix to renovate.json
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2024-02-11 23:54:55 +01:00
Tilman Vatteroth
a9d88dbd12 fix: configure renovate to pin yjs patch
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-06-17 07:51:07 +02:00
Tilman Vatteroth
3651ca085e ci(renovate): add regex for comment based updates
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-06-11 15:33:34 +02:00
David Mehren
963a70dc3b Configure Renovate to pin versions
The `config:base` preset does not pin versions in package.json.
This switches to the `config:js-app` preset, which enables this feature.

See https://docs.renovatebot.com/presets-config

Signed-off-by: David Mehren <git@herrmehren.de>
2023-06-04 17:16:13 +02:00
Tilman Vatteroth
4ed6f5fed1 chore(deps): add renovate group for zxcvbn packages
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-05-07 19:37:41 +02:00
Tilman Vatteroth
391559bec4 fix: install netlify nextjs plugin manually
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-04-13 18:23:43 +02:00
Tilman Vatteroth
c18102f307 fix: workflow file names in renovate.json
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-04-13 18:23:43 +02:00
Tilman Vatteroth
391c67f26b fix(renovate): fix ignored filename in renovate config
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-03-28 10:05:59 +02:00
Tilman Vatteroth
65737ccc88 fix(renovate): ignore example docker_compose.yml
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-03-28 09:13:29 +02:00
Philip Molares
efc5819107 ci: let renovate run every day of the week
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2023-03-12 20:50:04 +01:00
David Mehren
1d1c367309 ci: disable renovate auto-rebase
Save CI resources by not rebasing unnecessarily

Signed-off-by: David Mehren <git@herrmehren.de>
2023-02-12 20:20:15 +01:00
Erik Michelson
305b6f5910 misc: add turbo monorepo util
Co-authored-by: Tilman Vatteroth <git@tilmanvatteroth.de>
Co-authored-by: David Mehren <git@herrmehren.de>
Co-authored-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2023-02-07 21:38:40 +01:00
Tilman Vatteroth
50dacdf199
fix(repository): merge renovate config
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2022-11-20 21:49:56 +01:00
David Mehren
c72bf5d851
ci: enable renovate digest pinning
Signed-off-by: David Mehren <git@herrmehren.de>
2022-03-07 14:18:46 +01:00
David Mehren
3fc8c0ccc7 ci: configure renovate for docker
See https://docs.renovatebot.com/docker/

Signed-off-by: David Mehren <git@herrmehren.de>
2022-03-07 13:55:07 +01:00
David Mehren
bc2bef913f
ci(renovate): separate major updates
Signed-off-by: David Mehren <git@herrmehren.de>
2021-11-16 18:01:48 +01:00
David Mehren
803685fd3f
ci(renovate): run only on weekends
Signed-off-by: David Mehren <git@herrmehren.de>
2021-11-16 17:59:02 +01:00
David Mehren
8b4e4b86f2
ci(renovate): remove explicit dependencyDashboard
The `config:base` preset now includes this option

Signed-off-by: David Mehren <git@herrmehren.de>
2021-11-16 17:55:15 +01:00
David Mehren
f3af0bd1f8
Renovate: Use PRs for automerging
Due to our approval-policy, renovate can't merge without a PR.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-01 15:43:15 +02:00
David Mehren
930ec62877
Renovate: Automerge patch updates
This commit instructs renovate to automerge patch updates,
 without creating a PR.

 See also https://docs.renovatebot.com/configuration-options/#automergetype

Signed-off-by: David Mehren <git@herrmehren.de>
2021-07-18 17:46:27 +02:00
Sheogorath
93710eeb18
renovatebot: Configure renovatebot to update 1.x and 2.x branches
Currently renovatebot only cares about the default branch, which is
currently develop. In order to keep everything up-to-date we should
configure it, to also make sure that the master branch for 1.x will be
updated.

Therefore this patch adds the `baseBranches` config option, which allows
to define an array of branches to update.

Reference:

https://docs.renovatebot.com/configuration-options/#basebranches

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2021-02-02 22:16:33 +01:00
David Mehren
254f9a487a
Renovate: Maintain lock files once per week
This option makes Renovate refresh yarn.lock once per week
See https://docs.renovatebot.com/configuration-options/#lockfilemaintenance

Signed-off-by: David Mehren <git@herrmehren.de>
2021-01-07 17:35:17 +01:00
David Mehren
1aa683b6ed
Renovate: group all packages under @nestjs
Signed-off-by: David Mehren <git@herrmehren.de>
2021-01-06 20:34:19 +01:00
David Mehren
26f8c43a0f
Update Renovate config
This commit
- removes `group:nextjsMonorepo` as that is already included in `config:base` via `group:monorepos`
- disables the hourly PR creation limit
- enables the dependency dashboard
- enables automatic rebasing when the base branch updates

Signed-off-by: David Mehren <git@herrmehren.de>
2021-01-06 19:35:04 +01:00
Tilman Vatteroth
ce0e85d089
Change label used by renovate to "type: maintenance"
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
(cherry picked from commit 8600c2dae6)
2020-11-30 18:07:54 +01:00
David Mehren
7bb52921e2
Renovate: Enable sign-off
Signed-off-by: David Mehren <git@herrmehren.de>
(cherry picked from commit 087f0a7c98)
2020-11-17 14:52:40 +01:00
David Mehren
e65cc02442
Renovate: Disable major updates
We won't do any major updates for 1.7 release anyway.

Signed-off-by: David Mehren <git@herrmehren.de>
(cherry picked from commit c479ab0d59)
2020-11-17 14:36:07 +01:00
David Mehren
5d32b15521
Renovate: Group various packages
Signed-off-by: David Mehren <git@herrmehren.de>
(cherry picked from commit 63654aa910)
2020-11-17 14:27:01 +01:00
Renovate Bot
d498e8f0ca
Add renovate.json
Signed-off-by: Renovate Bot <bot@renovateapp.com>

(cherry picked from commit ed44a40c10)
2020-11-17 13:02:04 +00:00