dependency-scout/.github/dependency-scout.yml.example at main · temporal-community/dependency-scout · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# .github/dependency-scout.yml
#
# Copy this file to .github/dependency-scout.yml in any repo where you want
# the Scout to do more than post comments.
#
# ALL FIELDS ARE OPTIONAL. The Scout is safe to install with no config:
# it will post a verdict comment on every Dependabot/Renovate PR but
# never merge, close, or request review.
#
# See the full reference: https://github.com/temporal-community/dependency-scout/blob/main/docs/configuration.md


# ---------------------------------------------------------------------------
# Auto-merge
# ---------------------------------------------------------------------------

# Set to true to allow the Scout to merge PRs automatically.
# Only kicks in when the verdict matches auto_merge_classifications AND
# the classifier's confidence is >= auto_merge_min_confidence.
auto_merge_enabled: false

# Which verdict classifications are eligible for auto-merge.
# Default is ["green"] — change to ["green", "yellow"] at your own risk.
auto_merge_classifications: [green]

# Minimum classifier confidence (0.0–1.0) required before auto-merge fires.
# 0.90 means "the classifier must be at least 90% sure this is green".
# See docs/security.md before lowering this below 0.90.
auto_merge_min_confidence: 0.90

# Never auto-merge a release published less than this many hours ago,
# even if the verdict is GREEN. Gives time for community review of fresh releases.
# Default: 168 hours (7 days). Set to 0 to disable the age gate.
min_release_age_hours: 168


# ---------------------------------------------------------------------------
# Human review
# ---------------------------------------------------------------------------

# GitHub usernames to request review from when a PR is classified YELLOW, and to
# @-mention when a PR is blocked (RED). GitHub already auto-requests CODEOWNERS on
# PR open, so this is for pinging additional/specific people; the RED path also reads
# .github/CODEOWNERS and falls back to it when this list is empty. Leave empty (or
# omit) to rely on CODEOWNERS alone.
# reviewers: [alice, bob]
reviewers: []


# ---------------------------------------------------------------------------
# Blocking
# ---------------------------------------------------------------------------

# Verdicts that should trigger PR closure + label.
# Default is ["red"]. Set to [] for fully observe-only mode (no closures).
block_classifications: [red]


# ---------------------------------------------------------------------------
# Thresholds
# ---------------------------------------------------------------------------

# Flag a bump as YELLOW when it adds more than this many new direct dependencies
# across all manifest files (package.json, requirements.txt, etc.).
# A routine patch bump adding 10 transitive packages is suspicious.
max_new_dependencies: 5


# ---------------------------------------------------------------------------
# Ecosystem plugins (advanced)
# ---------------------------------------------------------------------------

# Names of additional Temporal activities to call for custom signals.
# Each activity receives (ecosystem, package, old_version, new_version)
# and must return a JSON-serialisable dict. Results appear in the LLM
# context as supplementary data (sandboxed — cannot override core signals).
#
# Requires the corresponding plugin package to be installed in your worker deployment.
# See CONTRIBUTING.md for the plugin authoring guide.
# extra_signal_activities: []