devops-commonconfigs

Common configuration files used in repos

⚙️ Project Config Templates

Opinionated, ready-to-use configuration files for a .NET Core repository — static analysis, secret scanning, changelog generation, merge automation, and AI code review.

---

📦 What's in here

Tool	Purpose	Config file
Semgrep	Static analysis / SAST	.semgrepignore
GitGuardian (ggshield)	Secret scanning	.gitguardian.yaml
git-cliff	Changelog generation	cliff.toml
Mergify	Merge queue & PR automation	.mergify.yml
CodeRabbit	AI code review	.coderabbit.yaml
pre-commit	Local git hooks	.pre-commit-config.yaml
Renovate	Dependency updates	renovate.json

---

🛡️ Semgrep

Tells Semgrep which paths to skip so scans stay fast and signal-rich. Excludes build output, NuGet packages, generated C#, and bundled web assets.

.semgrepignore

# Build outputbin/
obj/
out/
publish/
artifacts/
# NuGetpackages/
*.nupkgpackages.lock.json# Generated C#*.Designer.cs*.g.csGlobalUsings.g.cs*.AssemblyInfo.cs# Tests & client assetsTestResults/
wwwroot/lib/
node_modules/
*.min.js*.min.css*.map# Tooling / docs.vs/
docs/
*.md

semgrep scan --config auto

---

🔐 GitGuardian (ggshield)

Secret scanning. The exclusion philosophy is inverted from Semgrep: only vendored/noise paths are ignored — files that commonly hold secrets stay in scope.

.gitguardian.yaml

version: 2# required — without it ggshield uses the deprecated v1 formatexit_zero: falseverbose: falsemax_commits_for_hook: 50secret:
ignored_paths:
- '**/bin/**'
- '**/obj/**'
- '**/packages/**'
- '**/*.dll'
- '**/*.nupkg'
- '**/wwwroot/lib/**'
- '**/node_modules/**'
- '**/*.min.js'
- 'docs/**'
- '**/*.md'
- 'LICENSE'ignored_matches: [] # populate with: ggshield secret ignore --last-foundignored_detectors: []show_secrets: falseignore_known_secrets: false

⚠️ Do not add appsettings*.json or *.config here — those are prime leak locations and should always be scanned.

ggshield secret scan repo .

---

📝 git-cliff

Generates a changelog from your Git history using Conventional Commits.

cliff.toml

[changelog]
header = "# Changelog\n\nAll notable changes to this project are documented here.\n"body = """{% if version %}\## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}{% else %}\## [Unreleased]{% endif %}\{% for group, commits in commits | group_by(attribute="group") %}### {{ group | upper_first }}{% for commit in commits %}- {{ commit.message | upper_first }} ([{{ commit.id | truncate(length=7, end="") }}]({{ commit.id }}))\{% endfor %}{% endfor %}\n"""footer = "<!-- generated by git-cliff -->"trim = true
[git]
conventional_commits = truefilter_unconventional = truerequire_conventional = falsesplit_commits = falsecommit_parsers = [
{ message = "^feat", group = "🚀 Features" },
{ message = "^fix", group = "🐛 Bug Fixes" },
{ message = "^doc", group = "📚 Documentation" },
{ message = "^perf", group = "⚡ Performance" },
{ message = "^refactor", group = "🚜 Refactor" },
{ message = "^style", group = "🎨 Styling" },
{ message = "^test", group = "🧪 Testing" },
{ message = "^chore\\(release\\):", skip = true },
{ message = "^chore|^ci", group = "⚙️ Miscellaneous Tasks" },
{ body = ".*security", group = "🛡️ Security" },
]
filter_commits = falsetag_pattern = "v[0-9].*"sort_commits = "oldest"

git cliff -o CHANGELOG.md

---

🔀 Mergify

Merge queue and pull-request automation. Modern format uses queue_rules to define queues and pull_request_rules to route PRs into them.

.mergify.yml

queue_rules:
- name: defaultmerge_conditions:
- check-success=buildmerge_method: squashpull_request_rules:
- name: Automatic queue on approvalconditions:
- base=main
- "#approved-reviews-by>=1"
- check-success=build
- label!=work-in-progressactions:
queue:
name: default
- name: Auto-label dependency PRsconditions:
- author=renovate[bot]actions:
label:
add: [dependencies]
- name: Comment on conflictsconditions:
- conflictactions:
comment:
message: "@{{author}} this PR has conflicts with the base branch. 🛠️"

---

🐰 CodeRabbit

AI-powered PR reviews. The # yaml-language-server line enables schema validation/autocomplete in editors.

.coderabbit.yaml

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.jsonlanguage: "en-US"early_access: falsereviews:
profile: "chill"# "chill" | "assertive"request_changes_workflow: falsehigh_level_summary: truepoem: falsereview_status: trueauto_review:
enabled: truedrafts: falsepath_filters:
- "!**/bin/**"
- "!**/obj/**"
- "!**/*.Designer.cs"
- "!**/packages.lock.json"
- "!**/wwwroot/lib/**"path_instructions:
- path: "**/Controllers/**"instructions: "Check API endpoints for authentication, authorization, and input validation."
- path: "**/*.cs"instructions: "Flag unparameterized SQL, swallowed exceptions, and hardcoded secrets."chat:
auto_reply: true

---

🪝 pre-commit

Runs fast checks locally before each commit, including ggshield secret scanning.

.pre-commit-config.yaml

repos:
- repo: https://github.com/pre-commit/pre-commit-hooksrev: v5.0.0hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- id: check-yaml
- id: check-added-large-files
- repo: https://github.com/gitguardian/ggshieldrev: v1.44.0hooks:
- id: ggshieldlanguage_version: python3stages: [pre-commit]

pip install pre-commit && pre-commit install

---

🤖 Renovate

Keeps NuGet and GitHub Actions dependencies up to date. Uses the modern config:recommended preset (the old config:base is deprecated). The $schema line gives you validation and autocomplete in editors.

renovate.json (also valid at .github/renovate.json)

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:recommended",
":dependencyDashboard",
":semanticCommits"
],
"timezone": "Etc/UTC",
"schedule": ["before 6am on monday"],
"labels": ["dependencies"],
"minimumReleaseAge": "3 days",
"packageRules": [
{
"description": "Group all non-major NuGet updates into one PR",
"matchManagers": ["nuget"],
"matchUpdateTypes": ["minor", "patch"],
"groupName": "nuget non-major"
},
{
"description": "Auto-merge GitHub Actions minor/patch bumps",
"matchManagers": ["github-actions"],
"matchUpdateTypes": ["minor", "patch"],
"automerge": true
},
{
"description": "Hold major updates for dashboard approval",
"matchUpdateTypes": ["major"],
"dependencyDashboardApproval": true
}
]
}

💡 minimumReleaseAge makes Renovate wait 3 days before proposing an update, which dodges packages that get yanked shortly after release.

---

🚀 Getting started

1. Copy the config files above into your repository root (renovate.json can also live in .github/).
2. Replace every your-org/your-repo placeholder in the badges.
3. Set the required secrets/keys:
   • GITGUARDIAN_API_KEY for ggshield
   • ANTHROPIC_API_KEY (or your provider key) if you run AI workflows in CI
4. Install the GitHub Apps for CodeRabbit, Mergify, and Renovate from their marketplaces.
5. Commit on the default branch — most tools only pick up config from there.

💡 All of these tools work best with a squash-merge workflow and Conventional Commit messages, which keeps both the merge queue and the generated changelog clean.

📄 License

Released under the MIT License.