From 3504dc84649c48433492c01c202fc4e6aa771dc1 Mon Sep 17 00:00:00 2001 From: Pete Kloehn <35460307+pkloehn1@users.noreply.github.com> Date: Thu, 19 Mar 2026 17:40:16 -0700 Subject: [PATCH 1/4] Add CodeQL analysis workflow configuration --- .github/workflows/codeql.yml | 46 ++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000000..b941b68857b --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,46 @@ +--- +name: "CodeQL" + +on: + push: + branches: ["main"] + pull_request: + branches: ["main"] + schedule: + - cron: "25 14 * * 3" + workflow_dispatch: + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + security-events: write + packages: read + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + - language: python + build-mode: none + - language: javascript-typescript + build-mode: none + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{ matrix.language }}" +... From e043baae0a021c745e2b1c75977d66563871918f Mon Sep 17 00:00:00 2001 From: Pete Kloehn <35460307+pkloehn1@users.noreply.github.com> Date: Thu, 19 Mar 2026 17:40:55 -0700 Subject: [PATCH 2/4] Add Dependabot configuration for package updates Configure Dependabot to check for updates in various ecosystems weekly. --- .github/dependabot.yml | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000000..fcca706dab6 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,38 @@ +--- +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + actions: + patterns: ["*"] + + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + + - package-ecosystem: "pip" + directory: "/studio/backend/plugins/data-designer-unstructured-seed" + schedule: + interval: "weekly" + + - package-ecosystem: "pip" + directory: "/unsloth/kernels/moe" + schedule: + interval: "weekly" + + - package-ecosystem: "npm" + directory: "/studio/frontend" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + + - package-ecosystem: "npm" + directory: "/studio/backend/core/data_recipe/oxc-validator" + schedule: + interval: "weekly" +... From 083076837974c7cf4f3efe0550bde1f9536b92ad Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Fri, 20 Mar 2026 08:29:53 +0000 Subject: [PATCH 3/4] Fix dependabot.yml: bun ecosystem, missing dir, grouping for PR #4479 1. studio/frontend uses bun.lock not package-lock.json, so change npm to bun 2. Add missing studio/backend/requirements/ pip entry (consumed by studio/setup.sh) 3. Add groups with patterns ["*"] to all pip/bun/npm entries to batch updates and avoid 30+ individual Dependabot PRs on the first run --- .github/dependabot.yml | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fcca706dab6..42f36c2d103 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,25 +14,48 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 10 + groups: + pip-root: + patterns: ["*"] - package-ecosystem: "pip" directory: "/studio/backend/plugins/data-designer-unstructured-seed" schedule: interval: "weekly" + groups: + pip-data-designer: + patterns: ["*"] + + - package-ecosystem: "pip" + directory: "/studio/backend/requirements" + schedule: + interval: "weekly" + groups: + pip-backend-requirements: + patterns: ["*"] - package-ecosystem: "pip" directory: "/unsloth/kernels/moe" schedule: interval: "weekly" + groups: + pip-moe: + patterns: ["*"] - - package-ecosystem: "npm" + - package-ecosystem: "bun" directory: "/studio/frontend" schedule: interval: "weekly" open-pull-requests-limit: 10 + groups: + bun-frontend: + patterns: ["*"] - package-ecosystem: "npm" directory: "/studio/backend/core/data_recipe/oxc-validator" schedule: interval: "weekly" + groups: + npm-oxc-validator: + patterns: ["*"] ... From 22087e1d4fa16af1968e1d5ef0e7527d368c866f Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Fri, 20 Mar 2026 17:06:33 +0000 Subject: [PATCH 4/4] Consolidate pip blocks to fix overlapping directory violation GitHub Dependabot forbids multiple same-ecosystem entries with overlapping directories on the same branch. The root "/" directory overlapped the 3 nested pip dirs. Merge all 4 pip blocks into one using the `directories:` (plural) key. Also remove redundant open-pull-requests-limit from the bun block since grouping with patterns: ["*"] already limits PR count. --- .github/dependabot.yml | 33 ++++++--------------------------- 1 file changed, 6 insertions(+), 27 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 42f36c2d103..a06cb1d114b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,43 +10,22 @@ updates: patterns: ["*"] - package-ecosystem: "pip" - directory: "/" + directories: + - "/" + - "/studio/backend/plugins/data-designer-unstructured-seed" + - "/studio/backend/requirements" + - "/unsloth/kernels/moe" schedule: interval: "weekly" open-pull-requests-limit: 10 groups: - pip-root: - patterns: ["*"] - - - package-ecosystem: "pip" - directory: "/studio/backend/plugins/data-designer-unstructured-seed" - schedule: - interval: "weekly" - groups: - pip-data-designer: - patterns: ["*"] - - - package-ecosystem: "pip" - directory: "/studio/backend/requirements" - schedule: - interval: "weekly" - groups: - pip-backend-requirements: - patterns: ["*"] - - - package-ecosystem: "pip" - directory: "/unsloth/kernels/moe" - schedule: - interval: "weekly" - groups: - pip-moe: + pip: patterns: ["*"] - package-ecosystem: "bun" directory: "/studio/frontend" schedule: interval: "weekly" - open-pull-requests-limit: 10 groups: bun-frontend: patterns: ["*"]