mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-15 21:46:29 +03:00
Magnus HedemarkandGitHub
865a1e90c6
Squash merge. All CI passes. 4 signals fixed: min_release_age, issue_labeling_system, error_to_insight_pipeline, deployment_observability.
40 lines
2.1 KiB
Markdown
40 lines
2.1 KiB
Markdown
# Dependency Update Policy
|
|
|
|
This document defines the policy for adopting new dependency releases in the agent-skills repository.
|
|
|
|
## Minimum Release Age
|
|
|
|
New dependency releases must be at least **7 days old** before adoption. This waiting period mitigates supply chain attacks where a compromised release is published and adopted before it can be detected and removed.
|
|
|
|
### Rationale
|
|
|
|
Supply chain attacks increasingly target the window between a malicious release publication and its discovery. By requiring a 7-day minimum age, we ensure:
|
|
|
|
1. **Community scrutiny**: The release has been available for review by the broader community for at least a week.
|
|
2. **Detection window**: Automated scanning tools and security researchers have had time to flag issues.
|
|
3. **Revocation opportunity**: If a release is compromised and later yanked from PyPI, our delay prevents us from adopting it before removal.
|
|
|
|
## Enforcement
|
|
|
|
This policy is enforced automatically in CI via `scripts/check-dependency-age.py`, which:
|
|
|
|
1. Parses `requirements-dev.txt` for `==`-pinned dependencies.
|
|
2. Queries the PyPI JSON API for each package's release date.
|
|
3. Fails CI if any pinned dependency was released less than 7 days ago.
|
|
|
|
### Exceptions
|
|
|
|
- **Non-pinned dependencies** (using `>=` without `==`): Not checked, as the resolver chooses the version. These should eventually be pinned.
|
|
- **Pre-release versions**: Should not be adopted. If pre-releases are needed for testing, they should be in a separate requirements file.
|
|
- **Emergency security fixes**: If a critical CVE requires a same-day update, the policy can be bypassed with an explicit justification in the PR description. The CI check can be temporarily skipped.
|
|
|
|
## Dependabot Updates
|
|
|
|
Dependabot runs weekly for pip dependencies and monthly for GitHub Actions. PRs from Dependabot are subject to the same minimum release age check as manual updates.
|
|
|
|
## Related
|
|
|
|
- [scripts/check-dependency-age.py](../scripts/check-dependency-age.py) — CI enforcement script
|
|
- [.github/dependabot.yml](../.github/dependabot.yml) — Automated update configuration
|
|
- [docs/runbooks.md](./runbooks.md) — Incident response procedures
|