mirror of
https://github.com/freemkv/libfreemkv.git
synced 2026-10-07 18:13:10 +00:00
Matthew Jackson
4031513574
Lands the code-audit branches for aacs, css, keys, labels, udf, ifo and dvd, bdnav/mpls/clpi, disc/bluray, extract, io, scsi, the mkv, mp4, network and mpg muxers, the audio and video codecs, and CI. Fixes include MKB and FMTS validation, UDF bounds, IFO fallback to the BUP, DTS Express framing, MPEG-2 field pairing and mpg re-basing; the rest pins existing behaviour with tests.
67 lines
2.7 KiB
YAML
67 lines
2.7 KiB
YAML
version: 2
|
|
|
|
# NOTE: the cargo updater cannot resolve the out-of-repo `freemkv-unlock` path
|
|
# dep on dev, so it opens no PRs; advisory coverage there is cargo-deny (ci.yml).
|
|
#
|
|
# Dependency updates land on `dev`, never on `main`.
|
|
#
|
|
# `main` here is a RELEASE POINTER that moves to each tag. A bot
|
|
# commit on it would put work there that no tag contains, which is exactly the
|
|
# state that aborted the 1.6.2 cascade at the last step -- so pointing
|
|
# Dependabot at main would recreate that failure on a schedule.
|
|
updates:
|
|
- package-ecosystem: cargo
|
|
directory: /
|
|
target-branch: dev
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|
|
# One PR per week for the routine bumps instead of one per crate. Eight
|
|
# repos times a handful of crates is a volume nobody reads, and an
|
|
# unread PR queue is indistinguishable from no updates at all.
|
|
groups:
|
|
minor-and-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
ignore:
|
|
# The freemkv crates depend on each other by GIT TAG, re-pinned by
|
|
# release-orchestrate.yml as part of the release commit. Dependabot cannot see that
|
|
# cascade, so a PR bumping one of these would fight the release process
|
|
# and could pin a version whose tag does not exist yet.
|
|
- dependency-name: freemkv-unlock
|
|
- dependency-name: libfreemkv
|
|
- dependency-name: freemkv-keysources
|
|
- dependency-name: freemkv-i18n
|
|
- dependency-name: freemkv-engine
|
|
|
|
# The workflows are now real infrastructure -- the release cascade, the
|
|
# cross-platform hash matrix, the disc gate -- so their actions need the same
|
|
# attention as the crates.
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
target-branch: dev
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
actions:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
ignore:
|
|
# NOT a dependency: `dtolnay/rust-toolchain` is versioned by the RUST
|
|
# release it installs, and CI selects the toolchain through the `toolchain:`
|
|
# input on the @master/@stable branch refs, so a lint that passes on a
|
|
# newer default cannot pass CI by accident.
|
|
#
|
|
# Dependabot reads its tags as semver and proposed 1.97.0 -> 1.100.0,
|
|
# a Rust version that does not exist. Every such PR 404s on toolchain
|
|
# download across all eight repos, and they regenerate weekly -- eight
|
|
# permanently-red PRs that promote.yml then has to special-case when it
|
|
# decides whether dev is green.
|
|
#
|
|
# Bumping the toolchain is a deliberate, all-eight-repos change, made by
|
|
# hand. There is nothing here for a bot.
|
|
- dependency-name: dtolnay/rust-toolchain
|