Merge pull request #116 from smlx/update-readme

update readme

Author: smlx

.github/workflows/dependabot-automerge.yaml

@@ -18,16 +18,8 @@ jobs:
       uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
       with:
         github-token: "${{ secrets.GITHUB_TOKEN }}"
-    - name: Auto-merge Dependabot PRs
-      # don't auto-merge action updates to appease OpenSSF scorecard
-      if: ${{ ! contains(steps.metadata.outputs.package-ecosystem, 'github-actions') }}
+    - name: Enable auto-merge for Dependabot PRs # these still need approval before merge
       run: gh pr merge --auto --merge "$PR_URL"
       env:
         PR_URL: ${{github.event.pull_request.html_url}}
         GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-    - name: Auto-approve Github maintained actions
-      if: contains(steps.metadata.outputs.dependency-names, 'github/codeql-action')
-      run: gh pr review --approve "$PR_URL"
-      env:
-        PR_URL: ${{github.event.pull_request.html_url}}
-        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

README.md

@@ -98,7 +98,11 @@ Configure the repository:
 
 1. Go to repository Settings > Code security and analysis, and enable:
 
-    * Private vulnerability reporting
+    * Dependabot
+        * Private vulnerability reporting
+        * Grouped security updates
+    * Secret Scanning
+        * Push protection
 
 1. Go to repository Settings > Rules > Rulesets, and import the `protect-default-branch.json` ruleset.