Repository navigation

Compliance: missing-dependencies-label #55

Closed

Labels

compliance-audit

opened

Compliance Finding

Category: dependabot
Severity: warning
Check: missing-dependencies-label

Detail

Dependabot config missing dependencies label on updates

Standard Reference

standards/dependabot-policy.md#policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

don-petry
added
claude

compliance-auditAutomated compliance audit finding
on May 8, 2026
don-petry commented on May 8, 2026
don-petry
on May 8, 2026
CollaboratorAuthor
Claude finished @don-petry's task in 1m 47s —— View job • claude/issue-55-20260508-1409 • Create PR ➔

Fixing Compliance Issue: missing-dependencies-label

Check for existing open PRs for this issue

Read CLAUDE.md for repo-specific instructions

Read current dependabot config and standards

Create root .github/dependabot.yml with dependencies + security labels

Fix frameworks/spec-kit/.github/dependabot.yml to add missing labels

Commit and push changes

Create PR

Summary

Two changes to bring the repo into compliance with the dependabot policy:

Created .github/dependabot.yml — the root repo was missing a dependabot config entirely. Added the github-actions ecosystem entry (the only relevant ecosystem for this repo) with security and dependencies labels.

Fixed frameworks/spec-kit/.github/dependabot.yml — added security + dependencies labels to both pip and github-actions entries, and set open-pull-requests-limit: 0 on pip (security-only per policy) and 10 on github-actions (version updates allowed).
don-petry commented on May 11, 2026
don-petry
on May 11, 2026
CollaboratorAuthor
Weekly Compliance Audit (2026-05-11)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy
don-petry commented on May 12, 2026
don-petry
on May 12, 2026
CollaboratorAuthor
Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy
don-petry commented on May 12, 2026
don-petry
on May 12, 2026
CollaboratorAuthor
Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy
don-petry commented on May 12, 2026
don-petry
on May 12, 2026
CollaboratorAuthor
Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy
don-petry commented on May 12, 2026
don-petry
on May 12, 2026
CollaboratorAuthor
Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy
don-petry commented on May 12, 2026
don-petry
on May 12, 2026
CollaboratorAuthor
Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy
don-petry commented on May 13, 2026
don-petry
on May 13, 2026
CollaboratorAuthor
Weekly Compliance Audit (2026-05-13)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy
don-petry commented on May 15, 2026
don-petry
on May 15, 2026
CollaboratorAuthor
Resolved! This check is now passing as of 2026-05-15. Closing automatically.
don-petry
closed this as completed on May 15, 2026

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

Labels

compliance-audit

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests