Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: oxspan/scouterctl
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: oxspan/scouterctl
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: develop
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 6 files changed
  • 1 contributor

Commits on Nov 14, 2026

  1. ci: 👷 Harden repository security automation (#89) 

    ## Why

Gradle dependencies were not covered by the existing Actions-only
Dependabot configuration, and no workflow submitted the resolved
dependency graph for vulnerability alerts. Dependabot security PRs
targeting the default branch were also rejected by the CI route check.

## Changes

- Add weekly grouped Gradle version updates targeting `develop`.
- Submit resolved Gradle dependencies from trusted `master` pushes, a
weekly schedule, or manual dispatch on `master`, using pinned actions
and job-scoped write permissions.
- Allow Dependabot security PRs into `master` through the existing CI
route check.
- Document the configured repository protections, single-maintainer
review policy, and release-please CI approval procedure in the security
and release guides.

## Validation

- [Hosted Linux
CI](https://github.com/oxspan/scouterctl/actions/runs/43545276497)
passed on `b406006dee9de1dccd0cb4fa87ca82cacde26c20`: 289 tests passed,
zero failures/errors/skips. Line coverage 95.35%; branch coverage
81.08%; both thresholds passed.
- Windows package checks were intentionally skipped for the `develop`
target, matching existing CI policy. GitGuardian security checks and the
test-summary job passed.
- actionlint 1.7.12: all three workflows passed. Dependabot YAML parsed
successfully.
- Executed the actual PR route-check block: seven supported routes
accepted and three unsupported routes rejected. `git diff --check`
passed.
- Separately enabled and verified Secret scanning, push protection,
Dependabot alerts/security updates, PR/CI branch requirements, and
selected Actions with SHA pinning. [CodeQL default
setup](https://github.com/oxspan/scouterctl/actions/runs/43544437538)
completed successfully for Actions, C/C++, and Java/Kotlin on the base
commit.

## Compatibility and risks

No CLI, output, capture-format, or supported-Collector changes. Gradle
submission becomes operational after this workflow reaches `master`; a
successful submission has not yet been observed. The vendored Scouter
JAR still needs separate review. Initial CodeQL analysis reported 39
findings under test/verification sources; those findings remain open and
require separate triage. Optional real-Collector smoke tests were not
run.
    @oxspan
    oxspan authored Nov 14, 2026
    Configuration menu
    Copy the full SHA
    5dc2457 View commit details
    Browse the repository at this point in the history
Loading