Skip to content

feat: configure Dependabot Version Updates for workflows and actions #157

Description

@Capstan

Description

To address the outdated dependencies mentioned in #152 (since Renovate was rejected in favor of Dependabot in #154), we should configure Dependabot Version Updates for this repository.

Currently, Dependabot is not configured for version updates (there is no .github/dependabot.yml file). This means that while security alerts might be enabled, regular updates for stale dependencies are not automated.

Specifically, we need updates for:

  1. GitHub Actions used in workflows and composite actions (to keep SHAs/versions up to date).
  2. npm dependencies in the multi-approvers action (.github/actions/multi-approvers/package.json).

Proposed Solution

Add a .github/dependabot.yml configuration file to the root of the repository to enable weekly version updates.

Example .github/dependabot.yml:

version: 2
updates:
  # Enable version updates for GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

  # Enable version updates for npm dependencies in multi-approvers
  - package-ecosystem: "npm"
    directory: "/.github/actions/multi-approvers"
    schedule:
      interval: "weekly"

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions