PR #110 - allamiro/syslog2cef

Security updates were already enabled at the repository level, but every Dependabot pull request waited for a human, and there was no dependabot.yml — so ordinary version updates were never raised and a security fix tended to arrive as a large jump from a long-stale version.

What now merges without a human

Update	Behaviour
Security fix, patch or minor	Approved, auto-merge enabled, lands when CI passes
Ordinary patch or minor	Same
Any major, including a security advisory	Never auto-merged. Labelled `needs-triage`, commented, left open

A major is where a fix is most likely to change behaviour, so it gets a human even when it carries a CVE.

Why branch protection is part of this

GitHub's auto-merge lands a pull request as soon as it is mergeable. With no required status checks, "auto-merge" means "merge immediately, without waiting for CI" — the opposite of what is wanted. main is therefore now protected with the deterministic CI contexts as required checks:

test (3.9) … test (3.14), lint, docker

Deliberately not required: fuzz-pr, triage, and the third-party AI reviewers. Those are either event-specific or outside our control, and a flaky external service should not be able to wedge the merge queue.

Also deliberate:

Administrators are not included (enforce_admins: false), so you can still push directly to main and merge by hand. This adds a gate for the bot, not for you.
No required human review, which would otherwise block every auto-merge.
Force pushes and branch deletion on main are disabled.

Repository settings changed alongside this: allow_auto_merge enabled (it was off, so the workflow could not have worked), and delete_branch_on_merge enabled so merged Dependabot branches clean themselves up.

Dependabot scope

github-actions and pip, weekly, grouped so routine bumps arrive as one pull request instead of one per dependency. Worth being explicit: the project declares no runtime dependencies, so these updates touch CI and the optional kafka/fuzz extras only — they never change the shipped package.

CodeQL

ci.yml and fuzz.yml now declare least-privilege permissions: contents: read, clearing alerts #1–#4 ("workflow does not contain permissions"). Every workflow in the repository now states its permissions explicitly.

Alerts #5 and #6 (binding a socket to all interfaces, net.py:76 and :97) are not addressed here — see the PR discussion; I believe those are correct behaviour for a syslog receiver rather than defects, and that is a call worth making deliberately rather than in passing.

Summary by cubic

Adds automatic merging for safe Dependabot updates and declares least-privilege workflow permissions. Previously every Dependabot PR waited for a human; now security fixes and patch/minor updates merge after CI passes, while major versions and the runtime-shipped kafka-python are left for review.

Dependabot auto-merge

Adds dependabot.yml for weekly grouped updates to GitHub Actions and pip; kafka-python is excluded from the group because it ships to users through the kafka extra.
New workflow approves and auto-merges security fixes and patch/minor updates; major versions and any PR touching kafka-python get needs-triage label and a comment, never auto-merged.
Protects main with required CI checks so auto-merge waits for CI; admins are excluded.
Requires repo settings allow_auto_merge and delete_branch_on_merge enabled.

Workflow permissions

Declares permissions: contents: read in ci.yml and fuzz.yml, clearing CodeQL "workflow does not contain permissions" alerts.