Merge branch 'pwnage101/ENT-11563' of github.com:openedx/openedx-platform into pwnage101/ENT-11563

Author: kiram15

.github/renovate.json5

@@ -1,45 +1,50 @@
 {
   extends: [
-    'config:recommended',
-    'schedule:weekly',
-    ':automergeLinters',
-    ':automergeMinor',
-    ':automergeTesters',
-    ':enableVulnerabilityAlerts',
-    ':semanticCommits',
-    ':updateNotScheduled',
+    'config:recommended',  // Renovate base defaults: dependency dashboard, monorepo grouping, sane PR limits
+    'schedule:weekly',     // Only open new PRs once a week
+    ':automergeLinters',   // Automerge linter updates (eslint, prettier, etc.)
+    ':automergeTesters',   // Automerge test runner updates (jest, mocha, etc.)
+    ':enableVulnerabilityAlerts',  // Open security PRs immediately, ignoring the weekly schedule
+    ':semanticCommits',    // Use conventional commit format (fix(deps):, chore(deps):)
+    ':updateNotScheduled', // Allow vulnerability fixes to bypass the weekly schedule
   ],
+
+  // Never auto-rebase PRs; let humans decide when to rebase
+  rebaseWhen: 'never',
+
+  // Wait 3 days after a release before opening a PR, giving time for early bugs and
+  // potentially malicious releases (e.g. supply chain attacks) to be detected
+  minimumReleaseAge: '3 days',
+
+  // Only manage npm dependencies
+  enabledManagers: [
+    'npm',
+  ],
+
+  // Only create PRs during Eastern time (aligns with the weekly schedule)
+  timezone: 'America/New_York',
+
+  // Cap the number of open Renovate PRs at any one time
+  prConcurrentLimit: 3,
+
+  // Packages with known breaking changes or no active maintainer
+  ignoreDeps: [
+    'karma-spec-reporter',
+  ],
+
   packageRules: [
     {
-      matchDepTypes: [
-        'devDependencies',
-      ],
-      matchUpdateTypes: [
-        'lockFileMaintenance',
-        'minor',
-        'patch',
-        'pin',
+      // Automerge minor and patch updates for @edx and @openedx scoped packages;
+      // these are maintained by the same org so breakage is caught upstream
+      matchPackageNames: [
+        '/@edx/',
+        '/@openedx/',
       ],
-      automerge: true,
-    },
-    {
       matchUpdateTypes: [
         'minor',
         'patch',
       ],
       automerge: true,
-      matchPackageNames: [
-        '/@edx/',
-        '/@openedx/',
-      ],
     },
   ],
-  ignoreDeps: [
-    'karma-spec-reporter',
-  ],
-  timezone: 'America/New_York',
-  prConcurrentLimit: 3,
-  enabledManagers: [
-    'npm',
-  ],
 }

.github/workflows/add-quarterly-ticket-to-check-constraints.yml

@@ -0,0 +1,26 @@
+name: Create quarterly issues for GitHub audit
+on:
+  schedule:
+    - cron: 0 0 1 1,4,7,10 *
+  workflow_dispatch: {}
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  create_issue:
+    name: Create quarterly constraint check issue
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - run: |
+          # Platform constraints audit
+          new_issue_url=$(gh issue create --repo "openedx/openedx-platform" \
+            --title "Quarterly audit of openedx-platform constraints" \
+            --label "code health" \
+            --body "It is time to perform the quartely audit of constrained dependencies in \`openedx-platform\`. The goal is to remove any constraints that are no longer necessary to proactively prevent version conflicts and keep us up to date with security patches. The playbook for performing the audit can be found [here](https://openedx.atlassian.net/wiki/spaces/AC/pages/6340968449/Quarterly+Platform+Constraints+Audit).")
+            echo "NEW_ISSUE_URL=$new_issue_url" >> $GITHUB_ENV
+
+      - name: Comment on issue
+        run: gh issue comment $NEW_ISSUE_URL --body "@openedx/wg-maintenance-openedx-platform-oncall heads up on this request"