Scheduled jobs¶
opentemplate
runs scheduled jobs weekly, typically on weekends.
Tip
All cron-like jobs are in /.github/workflows
and use the on: schedule
trigger.
Jobs¶
Most scheduled jobs focus on security (security-_
workflows) and are run periodically as vulnerabilities evolve, namely:
- Security posture analysis:
ossf/scorecard
⧉ - Vulnerability scanning:
google/osv-scanner
⧉ - Bug detection and code quality:
semgrep/semgrep
⧉
Dependency automation¶
Automating dependency updates ensures security and stability.
Renovate¶
Important
Only relevant workflows run when renovate
opens a PR (e.g., markdown
checks for dev-markdown
updates).
- Updates run on weekends.
- Dependencies are grouped by
dev-<type>
. - Updates are handled by
github-actions[bot]
.
Adjustments¶
Caution
If adding a dev
dependency in pyproject.toml
, update .github/renovate.json
accordingly.
New dev-<type>
groups require:
- A corresponding entry in
renovate.json
. - (Probably) a new
.github/workflows/renovate-<type>.yml
workflow.
Note
.github/workflows/<type>-renovate.yml
should run only when the branch name matches dependencies-dev-<type>
.
Tip
See the GitHub Actions section for more details.
pre-commit¶
Independent pre-commit
hooks update weekly. All hooks run against the latest main
branch state to ensure updates are correct.
Note
renovate
does not update pre-commit
hooks due to maintainers' policy (details ⧉).
Content generation¶
cog
⧉ automates content generation based on source code comments (DO NOT EDIT UNTIL end marker
in pyproject.toml
).
Additionally, opennudge/cogeol
⧉ integrates Python's end-of-life ⧉ data to simplify management.
Together with GitHub Actions, these ensure:
- Support for the latest three Python versions.
- CI/CD always runs appropriate versions.
- PRs are opened for new releases and scheduled deprecations.
Template updates¶
Note
Template updates are not currently automated; the workflow is a placeholder for future use.
Code sources¶
.github/renovate.json
.github/workflows/pre-commit-update*.yml
.github/workflows/security-osv-scanner-update*.yml
.github/workflows/security-semgrep*.yml
.github/workflows/*-renovate.yml
.github/workflows/generation*.yml