|
1 | | -# WHY: Automatically updates GitHub Actions to latest versions |
2 | | -# OBS: Runs monthly to keep actions secure and up-to-date |
3 | | -# REQ: Keep this file to maintain security patches in workflows |
| 1 | +# ============================================================ |
| 2 | +# .github/dependabot.yml (Check for GitHub Actions updates) |
| 3 | +# ============================================================ |
| 4 | +# SOURCE: https://github.com/denisecase/templates |
| 5 | +# |
| 6 | +# REQ.PROJECT: This repository SHOULD track GitHub Actions updates automatically. |
| 7 | +# WHY-FILE: GitHub Actions are executable dependencies and may receive security or behavior updates. |
| 8 | +# OBS: Language-level dependencies (e.g., Python packages) are upgraded manually. |
| 9 | +# OBS: GitHub Actions are the only dependency class automated here. |
| 10 | +# ALT: Dependabot could be omitted if workflows are pinned and reviewed manually. |
| 11 | +# CUSTOM: Update interval if CI cadence or security posture changes. |
4 | 12 |
|
5 | | -version: 2 |
| 13 | +# NOTE: This file automatically updates the versions used in Actions workflows. |
| 14 | +# You don't need to modify this file. |
| 15 | +# To disable: Delete this file or set enabled: false below. |
| 16 | +# enabled: false # Uncomment to disable Dependabot |
| 17 | + |
| 18 | +version: 2 # Dependabot configuration version |
6 | 19 |
|
7 | 20 | updates: |
8 | | - - package-ecosystem: "github-actions" # WHY: Updates action versions in workflows |
9 | | - directory: "/" # WHY: Scan all .github/workflows/*.yml files |
| 21 | + - package-ecosystem: "github-actions" # Dependency type |
| 22 | + directory: "/" # Location of GitHub Actions workflows |
10 | 23 | schedule: |
11 | | - interval: "monthly" # WHY: Monthly updates balance freshness vs notification noise |
| 24 | + interval: "monthly" # ALT: Use "weekly" for higher security when needed |
12 | 25 | commit-message: |
13 | | - prefix: "ci(deps)" # WHY: Conventional commit format for changelog tools |
| 26 | + prefix: "(deps)" # WHY: enable filtering by commit type |
0 commit comments