Two-pass audit regenerator
The daily audit job rebuilds the managed pnpm overrides from a base template every run, so stale overrides are pruned instead of accumulating forever.
you are looking at airlock@v1
Airlock
A CI-green reference that wires pnpm 11 supply-chain defaults together with a regenerating audit-fix pipeline, Dependabot cooldown and SHA-matched unattended auto-merge, for solo Next.js on Vercel. This very site runs the pipeline, so the reference stays alive rather than rotting.
What it embodies
Strict minimumReleaseAge + trustLockfile
A one-day supply-chain quarantine on resolution, paired with trustLockfile so the committed lockfile still installs cleanly on cold CI runners.
Deny-by-default build scripts
pnpm 11 blocks dependency build scripts unless each is explicitly allowed, keeping the install-time attack surface minimal.
Dependabot cooldown
Version updates wait out a cooldown window before adoption; security fixes bypass it, so CVE patches still land immediately.
Vercel preview e2e gate
Playwright runs once against the real Vercel preview deployment, so auto-merge is gated on the deployed runtime, not just a local build.
SHA-matched unattended auto-merge
Audit and Dependabot PRs merge only after every gate passes, pinned to the exact commit that was tested, with a blast-radius guard on the audit lane.
The gap it fills
The individual settings are documented everywhere. The integration, where the pieces interact badly, is not. These are the failure modes you only find by running the whole thing unattended.
Strict mode breaks audit regeneration
An explicit minimumReleaseAge turns on strict resolution, which fails any mutating re-resolve of a package under 24 hours old. The audit regen exempts strict per-command; nothing else does.
trustLockfile is required, not optional
Without it, every cold-store CI runner re-checks the age of each committed pin and goes red for roughly a day after any dependency change, blocking unrelated PRs and auto-merge.
audit --fix=override leaves the lockfile stale
It writes overrides but not the lockfile, so the PR fails with a lockfile config mismatch. The workflow has to regenerate the lockfile in a second pass.
The two-pass ordering is load-bearing
Applying the fix before the natural re-resolve finds nothing, then silently re-resolves back to vulnerable versions. Reset to base, re-resolve, then re-fix, in that order.
Dependabot does not bump the pnpm pin
The packageManager field is left untouched by Dependabot, so the one dependency the whole pipeline runs on is the one nothing auto-maintains. The audit job emits a loud warning when pnpm falls behind; the bump stays by hand, because a pnpm major needs a migration checklist.
But why not Renovate?
Renovate covers the Dependabot half of this well: auto-merge, minimum release age and lockfile maintenance. Airlock's novel half is pnpm-11-specific: the audit --fix=override regeneration pipeline, the strict / trustLockfile / regen interaction, and override provenance via a committed base template. If that half is not your problem, Renovate may be the better fit. If it is, this is the wiring nobody else publishes.
How to adopt
Starting fresh
Use the GitHub "Use this template" button. You get a copy of this whole demo; keep the automation and swap in your own app.
Into an existing repo
Copy this file set, provision an automation token, set the author variable, record the template version, and adapt the values marked for first use (allowBuilds, overrides, CSP, app specifics).
- .github/workflows/audit.yml
- .github/workflows/ci.yml
- .github/dependabot.yml
- .github/TEMPLATE_VERSION
- pnpm-workspace.base.yaml
- package.json (the packageManager, engines and script pins)
- playwright.config.ts (the PLAYWRIGHT_BASE_URL pattern)