Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

Handle multiple config changes in a PR or Push event and process them as a batch - #888

Merged
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs
Oct 14, 2025
Merged

Handle multiple config changes in a PR or Push event and process them as a batch#888
decyjphr merged 7 commits into
main-enterprisefrom
887-multiple-configs

Conversation

@decyjphr

Copy link
Copy Markdown
Collaborator

This pull request refactors the way repository and sub-organization settings are synchronized, improving clarity and maintainability by consolidating logic and introducing a new method for handling multiple changes at once. The changes also update how file changes are detected in pull requests, aligning with GitHub's API best practices.

CopilotAI review requested due to automatic review settings October 3, 2025 21:05
@decyjphrdecyjphr linked an issue Oct 3, 2025 that may be closed by this pull request

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request refactors the synchronization logic for repository and sub-organization settings by consolidating duplicate code into batch processing functions. The main goal is to handle multiple configuration changes from PR or push events more efficiently by processing them as a batch rather than individually.

Key changes:

  • Introduced syncSelectedRepos method to handle batching of repository and sub-organization synchronization
  • Consolidated duplicate sync logic by creating a unified syncSelectedSettings function
  • Updated pull request file change detection to use GitHub's pull request files API instead of commit comparison

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

FileDescription
lib/settings.jsAdded new syncSelectedRepos batch processing method and extracted checkAndProcessRepo helper
index.jsRefactored sync functions to use batch processing and updated PR file detection logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js Outdated
decyjphrand others added 2 commits October 3, 2025 17:07
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 3, 2025 21:16

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js
Comment on lines +569 to +571
params = Object.assign(context.repo(), { pull_number: pull_request.number })

const changes = await context.octokit.pulls.listFiles(params)

CopilotAIOct 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The variable params is being reused for different purposes. Consider using a more descriptive variable name like pullRequestParams to improve code clarity and avoid confusion with the previous check run parameters.

Copilot uses AI. Check for mistakes.
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 00:48

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Comment threadindex.js
decyjphrand others added 2 commits October 4, 2025 20:49
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@decyjphr
decyjphr requested a review from CopilotOctober 5, 2025 13:12

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment threadindex.js Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment threadindex.js
@decyjphr
decyjphr merged commit 594f3c7 into main-enterpriseOct 14, 2025
6 checks passed
@decyjphr
decyjphr deleted the 887-multiple-configs branch October 14, 2025 14:00
decyjphr added a commit that referenced this pull request Aug 11, 2026
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dfabae4c-7df4-49eb-bffa-82f104ac8316
decyjphr added a commit that referenced this pull request Aug 19, 2026
…sion (#1066)
* Handle multiple config changes in a PR or Push event and process them as a batch (#888)
* handle multiple changes as a batch
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* depup files in a push
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* moved the dedup logic
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump undici from 7.7.0 to 7.16.0 (#881)
Bumps [undici](https://github.com/nodejs/undici) from 7.7.0 to 7.16.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.7.0...v7.16.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump node-cron from 3.0.3 to 4.2.1 (#865)
Bumps [node-cron](https://github.com/merencia/node-cron) from 3.0.3 to 4.2.1.
- [Release notes](https://github.com/merencia/node-cron/releases)
- [Commits](node-cron/node-cron@v3.0.3...v4.2.1)
---
updated-dependencies:
- dependency-name: node-cron
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump @apidevtools/json-schema-ref-parser (#882)
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 12.0.2 to 14.2.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](APIDevTools/json-schema-ref-parser@v12.0.2...v14.2.1)
---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
dependency-version: 14.2.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump minimatch from 10.0.1 to 10.0.3 (#883)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.0.1 to 10.0.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.1...v10.0.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 10.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#884)
Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0.
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)
---
updated-dependencies:
- dependency-name: eslint-plugin-import
dependency-version: 2.32.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.5.0 to 3.6.0 (#885)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@184bdaa...5e57cd1)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/setup-node from 4 to 6 (#890)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#894)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/metadata-action from 5.8.0 to 5.10.0 (#897)
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.8.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c1e5197...c299e40)
---
updated-dependencies:
- dependency-name: docker/metadata-action
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump actions/checkout from 4 to 6 (#898)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (#899)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@2910929...c7c5346)
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#904)
Bumps the npm_and_yarn group with 2 updates in the / directory: [jws](https://github.com/brianloveswords/node-jws) and [validator](https://github.com/validatorjs/validator.js).
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Updates `validator` from 13.11.0 to 13.15.26
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.11.0...13.15.26)
---
updated-dependencies:
- dependency-name: jws
dependency-version: 3.2.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: validator
dependency-version: 13.15.26
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#912)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump qs in the npm_and_yarn group across 1 directory (#913)
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).
Updates `qs` from 6.13.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.14.1)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.14.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump octokit from 5.0.3 to 5.0.5 (#905)
Bumps [octokit](https://github.com/octokit/octokit.js) from 5.0.3 to 5.0.5.
- [Release notes](https://github.com/octokit/octokit.js/releases)
- [Commits](octokit/octokit.js@v5.0.3...v5.0.5)
---
updated-dependencies:
- dependency-name: octokit
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump smee-client from 4.3.1 to 5.0.0 (#906)
Bumps [smee-client](https://github.com/probot/smee-client) from 4.3.1 to 5.0.0.
- [Release notes](https://github.com/probot/smee-client/releases)
- [Commits](probot/smee-client@v4.3.1...v5.0.0)
---
updated-dependencies:
- dependency-name: smee-client
dependency-version: 5.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump @eslint/eslintrc from 3.3.1 to 3.3.3 (#908)
Bumps [@eslint/eslintrc](https://github.com/eslint/eslintrc) from 3.3.1 to 3.3.3.
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@v3.3.1...eslintrc-v3.3.3)
---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
dependency-version: 3.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#909)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.1 to 3.12.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#921)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.18.2)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.18.2
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* ci(deps): bump docker/login-action from 3.6.0 to 3.7.0 (#924)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#927)
Bumps the npm_and_yarn group with 2 updates in the / directory: [lodash](https://github.com/lodash/lodash) and @isaacs/brace-expansion.
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* [WIP] Upgrade project to support Node.js 22 and 24 (#939)
* Initial plan
* Upgrade Node.js to 22 and 24 (last 2 LTS versions)
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot CI: correct actor check from `dependabot` to `dependabot[bot]` (#940)
* Initial plan
* Initial plan for fixing CI workflow test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix Dependabot actor check in node-ci.yml workflow
The `if` condition used `'dependabot'` but Dependabot's actual GitHub
actor username is `'dependabot[bot]'`. This caused the test job to run
for Dependabot PRs when it should be skipped, resulting in npm install
failures due to ESLint 10 peer dependency conflicts.
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Refactor advanced CodeQL workflow steps (#941)
* Added support for proxy servers in all execution environments (#917)
* Added support for proxy servers in all execution environments
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* build(deps): bump probot from 13.4.4 to 14.2.4 (#907)
* build(deps): bump probot from 13.4.4 to 14.2.4
Bumps [probot](https://github.com/probot/probot) from 13.4.4 to 14.2.4.
- [Release notes](https://github.com/probot/probot/releases)
- [Commits](probot/probot@v13.4.4...v14.2.4)
---
updated-dependencies:
- dependency-name: probot
dependency-version: 14.2.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Fix test suite failures caused by ESM-only `@octokit/core` and `probot` dependencies (#938)
* Initial plan
* Initial plan for fixing failing test suites
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix failing test suites caused by ESM-only dependencies
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Update minimatch dependency version to 10.2.1
* Fix devcontainer configuration and update dependencies (#942)
* fix devcontainer
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/Dockerfile
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update .devcontainer/devcontainer.json
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: prevent race conditions by creating new objects for repository configurations (#943)
* fix: prevent race conditions by creating new objects for repository configurations
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Change helm defaults to be more newcomer friendly (#919)
* Updated container port to match the port exposed by the application inside the container
* Added examples for common environment variables
* Changed validators to be examples in comments to avoid needing to override
* Changed min replica count to 1 for more cost effective defaults
* Updated min replica default in docs
* Updated service port default in docs
* Updated validator defaults in docs
* Updated restricted repos include default in docs
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update helm/safe-settings/values.yaml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Updated README to match the new default value
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: add HOST=0.0.0.0 env to Dockerfile for probot v14 compatibility (#948)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/6a4f5799-ea1f-4900-a659-b492dbdf5cfc
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility (#949)
* fix: override NODE_ENV=development in functional test and add retry logic
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: add --fail to curl and || true to docker logs in functional test
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/97b10121-f26e-44c0-86e6-3ede047fe176
* fix: migrate all octokit API calls to .rest namespace for probot v14 compatibility and revert Dockerfile ENV HOST
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/179c9d77-8ca0-4098-9017-8a255df170f9
* Update lib/plugins/repository.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: address review feedback - NopCommand repo arg, milestones mock, teams test error propagation
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/d9420b15-2cca-40a3-a30b-869df73487f1
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add HOST environment variable to Dockerfile (#950)
* docs: add troubleshooting section for Docker build and runtime issues (#951)
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#947)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.22.0 to 7.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.1)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.13
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump proxy-from-env from 1.1.0 to 2.0.0 (#934)
Bumps [proxy-from-env](https://github.com/Rob--W/proxy-from-env) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.0.0)
---
updated-dependencies:
- dependency-name: proxy-from-env
dependency-version: 2.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#935)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.19.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump path-to-regexp (#953)
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#954)
Bumps the npm_and_yarn group with 2 updates in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [yaml](https://github.com/eemeli/yaml).
Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.0)
Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-version: 8.4.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: yaml
dependency-version: 2.8.3
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Remove non-deterministic `npm install -g npm` from devcontainer Dockerfile (#956)
* Initial plan
* Fix alert #129: Remove non-deterministic npm install from devcontainer Dockerfile
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Fix typo in devcontainer Dockerfile comment (Intall -> Install)
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/0af97764-5b14-4195-ad8a-6b8adf723453
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Pin Dockerfile base image to SHA256 digest (#957)
* Initial plan
* Pin Docker base image to SHA256 digest to fix alert #128
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/afcb39cb-64ea-43c7-8b49-200dd166ad5f
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Use `npm ci` instead of `npm install` in CI workflow (#958)
* Initial plan
* Replace npm install with npm ci in node-ci.yml workflow
Agent-Logs-Url: https://github.com/github/safe-settings/sessions/4460185b-428a-48f4-a8b9-471226ccbf58
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: decyjphr <57544838+decyjphr@users.noreply.github.com>
* Replace npm install with npm ci in workflow (#960)
* Replace npm install with npm ci in workflow
* Replace npm install with npm ci in workflow
* Bug/issue 465 (#970)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* Update api endpoint version
* Add JSON schemas for safe-settings configuration at repo, org, and suborg levels
- Introduced `repos.json` schema for repository-level safe-settings overrides.
- Updated `settings.json` schema to include additional properties for org-level configurations.
- Created `suborgs.json` schema for suborg-level safe-settings configuration.
- Enhanced the build script to dereference all schemas and handle errors during the process.
* chores: fix branches tests
* fix(build-schema): enhance schema dereferencing with GitHub API spec
* Update docs/github-settings/5. branch-protection.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update index.js
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix(schema): simplify description for force_create property
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Bug/issue 842 (#928)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* test: update branch protection tests to handle null restrictions and enforce_admins
* fix: normalize branch protection restrictions and preserve existing settings
* fix: update GitHub API calls to use the correct namespace for branch protection methods
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* Fix custom_properties diffing when config uses `property_name` (#978)
* Initial plan
* Handle alternate custom property name shapes in normalize
* Add explicit object guard in custom property normalization
* Support property_name in custom_properties config entries
* Polish custom properties test descriptions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(variables): add noop mode support (#926)
* feat(variables): add noop mode support
- Add noop mode support to Variables plugin add/remove/update methods
- Return NopCommand instead of making API calls when nop=true
- Add comprehensive tests for noop mode behavior
Signed-off-by: Kyle Harding <kyle@balena.io>
* refactor(variables): align with Diffable contract pattern
Refactor Variables plugin to match the single-item Diffable contract
used by labels, milestones, and other plugins. The previous update()
reimplemented sync() logic internally; now each method handles one item
and lets Diffable.sync() orchestrate iteration.
- Simplify update() from 90-line array-diffing to single-item PATCH
- Simplify changed() from JSON.stringify comparison to value check
- Remove getChanged(), lodash dependency, .then(res=>res) no-ops
- Match labels.js nop return pattern: Promise.resolve([NopCommand])
- Fix inconsistent toUpperCase() between add/remove/update
- Let errors propagate to Diffable.sync() instead of swallowing
- Normalize find() to strip API metadata fields (created_at, etc.)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
---------
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update lodash to ^4.18.1 to fix code injection vulnerability (#992)
Resolve Dependabot alert #116 - lodash vulnerable to Code Injection
via `_.template` imports key names. Updated from ^4.17.21 to ^4.18.1.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* build(deps): bump uuid in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [uuid](https://github.com/uuidjs/uuid).
Updates `uuid` from 8.3.2 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.0)
---
updated-dependencies:
- dependency-name: uuid
dependency-version: 14.0.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bug/archived repo (#991)
* fix: apply org-level settings before loading repository configurations
* fix: enhance descriptions and add new properties for security features in settings.json
* fix: update description for deprecated squash-merge commit title property in settings.json
* fix issue with archived repos
---------
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump the npm_and_yarn group across 1 directory with 3 updates
Bumps the npm_and_yarn group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [shell-quote](https://github.com/ljharb/shell-quote).
Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)
Updates `qs` from 6.15.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.2)
Updates `shell-quote` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: shell-quote
dependency-version: 1.8.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
* Initial plan
* feat: add priorityClassName support to Helm chart
* Add include/exclude repo filters to team settings
Team entries are filtered by the same Diffable include/exclude logic that
collaborators use, but unlike collaborators those keys were never part of the
TeamSettings schema or documented, so editors and linters can't validate them.
Mirror the CollaboratorSettings allOf pattern to declare include and exclude on
TeamSettings, document both in the teams guide with examples, add a sample, and
cover the filter path with unit tests. No runtime changes.
* build(deps-dev): bump flatted from 3.3.4 to 3.4.4 (#1055)
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.4 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.4...v3.4.4)
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump undici in the npm_and_yarn group across 1 directory (#1058)
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.24.5 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.5...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#1057)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)
---
updated-dependencies:
- dependency-name: shell-quote
dependency-version: 1.10.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump js-yaml in the npm_and_yarn group across 1 directory (#1059)
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Updates `js-yaml` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.3.1
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps-dev): bump brace-expansion (#1060)
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 1.1.18
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yadhav Jayaraman <57544838+decyjphr@users.noreply.github.com>
* build(deps): bump body-parser (#1061)
Bumps the npm_and_yarn group with 1 update in the / directory: [body-parser](https://github.com/expressjs/body-parser).
Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)
---
updated-dependencies:
- dependency-name: body-parser
dependency-version: 2.3.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix GHSA-52cp-r559-cp3m: resolve transitive js-yaml via jest and lockfile-lint upgrades (#1064)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Signed-off-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Tyler Ohlsen <tylerohlsen@hotmail.com>
Co-authored-by: Jan Bronicki <janbronicki@microsoft.com>
Co-authored-by: Brett Logan <lindluni@github.com>
Co-authored-by: Madis Kõosaar <madis.koosaar@solidify.dev>
Co-authored-by: Kyle Harding <kyle@balena.io>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: neatcoder <28711376+neatcoder@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Handle Push and Pull Request events having multiple config file changes.

3 participants

@decyjphr@er0k