Question: how to mitigate supply chain attacks and actual due diligence on automation pattern 4?

[tarilabs]

hi 👋

noticed the following:

reference/PRESENTATION-ambient-code-reference.md

Lines 523 to 530 in 5b60ba1

	#### Dependabot Auto-Merge
	When Dependabot creates a PR:
	- Workflow checks if it's a patch version update
	- If all CI passes, auto-merges with squash
	- Human reviews only minor/major version bumps
	- Keeps dependencies current without manual effort

I'm very interested in that from 2 angles:

1. supply chain attacks rely a lot on this kind of "blind" automations (dependency get corrupted, publish a patch update, which gets picked up, and the chain continues); truly one can setup a buffer period or grace period before raising the Dependabot PR, but I find this case is even better mitigated by ...
2. ...spending the 1min necessary to seize the Dependabot PR as an opportunity to due diligence why the dependency is there in the first place (or so remove it!), if there is any malware spreading news so to be a bit more extra cautious, etc.

I'm curious what others are implementing in their process, and so to best understand what can be best automated, what delegated, and where to keep the human-in-the-loop?
Thanks!

[jeremyeder]

Because of that I restricted it to automatically installing only the .z versions of dependencies. Even this fails your test. Let's see if anyone else chimes in.

[tarilabs]

Even this fails your test

yes, indeed that's why we do updates once/week unless prompted by a CVE report, and due diligence is not a guarantee but a mitigation. I'm indeed interested if anyone has implemented analogous mitigation with an agent, and where they still put the human in the loop 👍