From 0ee77eea5e697ff7f5999d1cf82b8da5fac817b7 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Tue, 13 Oct 2026 11:49:58 -0400 Subject: [PATCH 1/2] Group Dependabot minor and patch updates weekly Each ecosystem entry now groups minor and patch updates into one pull request, on the org schedule (weekly, Monday 06:00 America/New_York), so a week of bumps costs one CI run instead of one per dependency. --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5b9b139..446473e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,10 @@ updates: time: "06:00" timezone: America/New_York open-pull-requests-limit: 5 + groups: + pip-minor-and-patch: + patterns: ["*"] + update-types: [minor, patch] - package-ecosystem: github-actions directory: / @@ -17,6 +21,10 @@ updates: time: "06:00" timezone: America/New_York open-pull-requests-limit: 5 + groups: + github-actions-minor-and-patch: + patterns: ["*"] + update-types: [minor, patch] - package-ecosystem: docker directory: / @@ -26,3 +34,7 @@ updates: time: "06:00" timezone: America/New_York open-pull-requests-limit: 5 + groups: + docker-minor-and-patch: + patterns: ["*"] + update-types: [minor, patch] From 43faa7b2234da534253cc3745014797aa74bf2bf Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Tue, 13 Oct 2026 11:50:48 -0400 Subject: [PATCH 2/2] Write example credentials as placeholders Example values shaped like real keys (a vendor prefix, or a password in a URL's userinfo) are flagged by secret scanners even when truncated. The examples now use obvious placeholders, which read the same to a person and match nothing. --- docs/SPEC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/SPEC.md b/docs/SPEC.md index 69b7861..9d3210f 100644 --- a/docs/SPEC.md +++ b/docs/SPEC.md @@ -550,7 +550,7 @@ For the server-side stack (Phase K) and any future deployable bits: script that checks the deploying user's `.env` against it (refuses to start if required vars are missing). - [ ] Documented variables: minimum viable set: - - `GET_INSTALLER_DB_URL`: Postgres DSN (`postgres://user:pass@host:5432/get`) + - `GET_INSTALLER_DB_URL`: Postgres DSN (`postgres://:@host:5432/get`) - `GET_INSTALLER_BASE_URL`: public origin (e.g. `https://get.simtabi.com`) - `GET_INSTALLER_ALLOWED_ORIGINS`: comma-separated allowlist - `GET_INSTALLER_TOKEN_SECRET`: HMAC secret for org tokens