docs: Dependabot security-only update standards

standards/dependabot-policy.md

@@ -0,0 +1,152 @@
+# Dependabot Policy: Security-Only Updates
+
+## Rationale
+
+New package versions pose risk to stability and security. Keeping known-good versions
+and upgrading only when vulnerabilities are found and fixed provides a better
+security posture than chasing every minor/patch release.
+
+## Policy
+
+1. **Security updates only** for application dependencies (npm, Go modules, pip, Cargo).
+   Dependabot opens PRs only when a vulnerability advisory exists for a dependency.
+2. **Version updates weekly** for GitHub Actions, since pinned action versions do not
+   affect application stability and staying current reduces CI attack surface.
+3. **Labels** `security` and `dependencies` on every Dependabot PR for filtering and audit.
+4. **Auto-merge** security patches and minor updates after CI passes, using a GitHub App
+   token to satisfy branch protection (CODEOWNERS review bypass for bot PRs).
+5. **Vulnerability audit CI check** runs on every PR and push to `main`, failing the
+   build if any dependency has a known advisory. This is a required status check.
+
+## Configuration Files
+
+Each repository must have:
+
+| File | Purpose |
+|------|---------|
+| `.github/dependabot.yml` | Dependabot config scoped to the repo's ecosystems |
+| `.github/workflows/dependabot-automerge.yml` | Auto-approve + squash-merge security PRs |
+| `.github/workflows/dependency-audit.yml` | CI check — fail on known vulnerabilities |
+
+## Dependabot Templates
+
+Use the template matching your repository type. All templates share these settings:
+
+```yaml
+# Common settings applied to every package ecosystem entry
+schedule:
+  interval: "weekly"
+open-pull-requests-limit: 10
+labels:
+  - "security"
+  - "dependencies"
+```
+
+### Frontend (npm)
+
+For repos with `package.json` at root or in subdirectories.
+
+- Ecosystem: `npm`
+- Directory: `/` (or path to each `package.json`)
+- Security updates only (no `versioning-strategy` override needed — Dependabot
+  security updates use the lockfile by default)
+
+See [`dependabot/frontend.yml`](dependabot/frontend.yml)
+
+### Backend — Go
+
+For repos with `go.mod`.
+
+- Ecosystem: `gomod`
+- Directory: path to `go.mod`
+
+See [`dependabot/backend-go.yml`](dependabot/backend-go.yml)
+
+### Backend — Rust
+
+For repos with `Cargo.toml`.
+
+- Ecosystem: `cargo`
+- Directory: `/`
+
+See [`dependabot/backend-rust.yml`](dependabot/backend-rust.yml)
+
+### Backend — Python
+
+For repos with `pyproject.toml` or `requirements.txt`.
+
+- Ecosystem: `pip`
+- Directory: `/`
+
+See [`dependabot/backend-python.yml`](dependabot/backend-python.yml)
+
+### Infrastructure — Terraform
+
+For repos with Terraform modules.
+
+- Ecosystem: `terraform`
+- Directory: path to Terraform root module
+
+See [`dependabot/infra-terraform.yml`](dependabot/infra-terraform.yml)
+
+### GitHub Actions (all repos)
+
+Every repository must include the `github-actions` ecosystem entry.
+GitHub Actions use **version updates** (not security-only) on a weekly schedule
+since pinned action SHAs do not affect application runtime stability.
+
+```yaml
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 10
+  labels:
+    - "security"
+    - "dependencies"
+```
+
+### Full-Stack Example
+
+A full-stack repo (e.g., npm + Go + Terraform + GitHub Actions) combines the
+relevant ecosystem entries into a single `dependabot.yml`. See
+[`dependabot/fullstack.yml`](dependabot/fullstack.yml) for a complete example.
+
+## Auto-Merge Workflow
+
+See [`workflows/dependabot-automerge.yml`](workflows/dependabot-automerge.yml).
+
+Behavior:
+- Triggers on `pull_request_target` from `dependabot[bot]`
+- Fetches Dependabot metadata to determine update type
+- For **patch** and **minor** security updates (and indirect dependency updates):
+  approves the PR and squash-merges using a GitHub App token
+- **Major** updates are left for human review
+
+## Vulnerability Audit CI Check
+
+See [`workflows/dependency-audit.yml`](workflows/dependency-audit.yml).
+
+This reusable workflow detects the ecosystems present in the repo and runs the
+appropriate audit tool:
+
+| Ecosystem | Tool | Command |
+|-----------|------|---------|
+| npm | `npm audit` | `npm audit --audit-level=moderate` |
+| Go | `govulncheck` | `govulncheck ./...` |
+| Rust | `cargo-audit` | `cargo audit` |
+| Python | `pip-audit` | `pip-audit` |
+
+The workflow fails if any known vulnerability is found, blocking the PR from merging.
+
+## Applying to a Repository
+
+1. Copy the appropriate `dependabot.yml` template to `.github/dependabot.yml`,
+   adjusting `directory` paths as needed.
+2. Copy `workflows/dependabot-automerge.yml` to `.github/workflows/`.
+3. Copy `workflows/dependency-audit.yml` to `.github/workflows/`.
+4. Ensure the repository has the GitHub App secrets (`APP_ID`, `APP_PRIVATE_KEY`)
+   configured for auto-merge.
+5. Create the `security` and `dependencies` labels in the repository if they
+   don't already exist.
+6. Add `dependency-audit` as a required status check in branch protection rules.

standards/dependabot/backend-go.yml

@@ -0,0 +1,23 @@
+# Dependabot configuration for Go backend repositories
+# Copy to .github/dependabot.yml and adjust directory paths as needed
+version: 2
+updates:
+  # Go modules — security updates only
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # GitHub Actions — version updates (keep actions current)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"

standards/dependabot/backend-python.yml

@@ -0,0 +1,23 @@
+# Dependabot configuration for Python backend repositories
+# Copy to .github/dependabot.yml and adjust directory paths as needed
+version: 2
+updates:
+  # pip — security updates only
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # GitHub Actions — version updates (keep actions current)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"

standards/dependabot/backend-rust.yml

@@ -0,0 +1,23 @@
+# Dependabot configuration for Rust backend repositories
+# Copy to .github/dependabot.yml and adjust directory paths as needed
+version: 2
+updates:
+  # Cargo — security updates only
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # GitHub Actions — version updates (keep actions current)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"

standards/dependabot/frontend.yml

@@ -0,0 +1,23 @@
+# Dependabot configuration for frontend (npm) repositories
+# Copy to .github/dependabot.yml and adjust directory paths as needed
+version: 2
+updates:
+  # npm — security updates only
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # GitHub Actions — version updates (keep actions current)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"

standards/dependabot/fullstack.yml

@@ -0,0 +1,48 @@
+# Dependabot configuration for full-stack repositories (npm + Go + Terraform)
+# Copy to .github/dependabot.yml and adjust directory paths as needed
+#
+# Example layout:
+#   apps/mobile/package.json  (or markets-app/package.json)
+#   apps/api/go.mod           (or markets-api/go.mod)
+#   infra/terraform/main.tf
+version: 2
+updates:
+  # npm — security updates only
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # Go modules — security updates only
+  - package-ecosystem: "gomod"
+    directory: "/apps/api"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # Terraform — security updates only
+  - package-ecosystem: "terraform"
+    directory: "/infra/terraform"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # GitHub Actions — version updates (keep actions current)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"

standards/dependabot/infra-terraform.yml

@@ -0,0 +1,23 @@
+# Dependabot configuration for Terraform infrastructure repositories
+# Copy to .github/dependabot.yml and adjust directory paths as needed
+version: 2
+updates:
+  # Terraform — security updates only
+  - package-ecosystem: "terraform"
+    directory: "/infra/terraform"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  # GitHub Actions — version updates (keep actions current)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"

standards/workflows/dependabot-automerge.yml

@@ -0,0 +1,57 @@
+# Dependabot auto-merge workflow
+# Copy to .github/workflows/dependabot-automerge.yml
+#
+# Requires repository secrets:
+#   APP_ID         — GitHub App ID with contents:write and pull-requests:write
+#   APP_PRIVATE_KEY — GitHub App private key
+#
+# Auto-approves and squash-merges Dependabot PRs for:
+#   - Patch version updates
+#   - Minor version updates
+#   - Indirect (transitive) dependency updates
+# Major version updates are left for human review.
+name: Dependabot auto-merge
+
+on:
+  pull_request_target:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Generate app token
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+          steps.metadata.outputs.dependency-type == 'indirect'
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Approve and auto-merge
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+          steps.metadata.outputs.dependency-type == 'indirect'
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --squash --admin "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}