mirror of https://github.com/magnus919/agent-skills.git synced 2026-09-12 20:16:29 +03:00

Files

T

Magnus HedemarkandGitHub 865a1e90c6 feat: fix remaining agent readiness signals for level 5

Squash merge. All CI passes.

4 signals fixed: min_release_age, issue_labeling_system, error_to_insight_pipeline, deployment_observability.

2026-07-29 18:33:55 -04:00

2.1 KiB

Raw Blame History

Dependency Update Policy

This document defines the policy for adopting new dependency releases in the agent-skills repository.

Minimum Release Age

New dependency releases must be at least 7 days old before adoption. This waiting period mitigates supply chain attacks where a compromised release is published and adopted before it can be detected and removed.

Rationale

Supply chain attacks increasingly target the window between a malicious release publication and its discovery. By requiring a 7-day minimum age, we ensure:

Community scrutiny: The release has been available for review by the broader community for at least a week.
Detection window: Automated scanning tools and security researchers have had time to flag issues.
Revocation opportunity: If a release is compromised and later yanked from PyPI, our delay prevents us from adopting it before removal.

Enforcement

This policy is enforced automatically in CI via scripts/check-dependency-age.py, which:

Parses requirements-dev.txt for ==-pinned dependencies.
Queries the PyPI JSON API for each package's release date.
Fails CI if any pinned dependency was released less than 7 days ago.

Exceptions

Non-pinned dependencies (using >= without ==): Not checked, as the resolver chooses the version. These should eventually be pinned.
Pre-release versions: Should not be adopted. If pre-releases are needed for testing, they should be in a separate requirements file.
Emergency security fixes: If a critical CVE requires a same-day update, the policy can be bypassed with an explicit justification in the PR description. The CI check can be temporarily skipped.

Dependabot Updates

Dependabot runs weekly for pip dependencies and monthly for GitHub Actions. PRs from Dependabot are subject to the same minimum release age check as manual updates.

scripts/check-dependency-age.py — CI enforcement script
.github/dependabot.yml — Automated update configuration
docs/runbooks.md — Incident response procedures

2.1 KiB Raw Blame History