Description
To address the outdated dependencies mentioned in #152 (since Renovate was rejected in favor of Dependabot in #154), we should configure Dependabot Version Updates for this repository.
Currently, Dependabot is not configured for version updates (there is no .github/dependabot.yml file). This means that while security alerts might be enabled, regular updates for stale dependencies are not automated.
Specifically, we need updates for:
- GitHub Actions used in workflows and composite actions (to keep SHAs/versions up to date).
- npm dependencies in the
multi-approvers action (.github/actions/multi-approvers/package.json).
Proposed Solution
Add a .github/dependabot.yml configuration file to the root of the repository to enable weekly version updates.
Example .github/dependabot.yml:
version: 2
updates:
# Enable version updates for GitHub Actions
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
# Enable version updates for npm dependencies in multi-approvers
- package-ecosystem: "npm"
directory: "/.github/actions/multi-approvers"
schedule:
interval: "weekly"
Description
To address the outdated dependencies mentioned in #152 (since Renovate was rejected in favor of Dependabot in #154), we should configure Dependabot Version Updates for this repository.
Currently, Dependabot is not configured for version updates (there is no
.github/dependabot.ymlfile). This means that while security alerts might be enabled, regular updates for stale dependencies are not automated.Specifically, we need updates for:
multi-approversaction (.github/actions/multi-approvers/package.json).Proposed Solution
Add a
.github/dependabot.ymlconfiguration file to the root of the repository to enable weekly version updates.Example
.github/dependabot.yml: