Skip to content

Commit 1047b8b

Browse files
authored
Configure Dependabot for GitHub Actions (#606)
*Issue #, if available:* N/A *Description of changes:* This change configures Dependabot for Mountpoint's CSI Driver repository. This will allow our dependencies to be updated on a schedule, to avoid them getting too outdated and ensure we stay relatively up-to-date. For GitHub Actions, we allow each one to be updated separately. I feel these are more challenging to review and will be best reviewed individually. Note, this has been neglected and will launch a lot of PRs. Initially, this change checks for updates daily and allows at most 1 PR to be open at a time. This is to manage the number of PRs appearing. We should relax this later once we're in a better position. This does not address Golang dependencies. Unfortunately, 0.x minor releases are not treated as breaking changes and would introduce noise to the repository. For now, we'll leave this out of scope. This does not address Helm charts. Helm chart updates are currently impacted by this bug in Dependabot: dependabot/dependabot-core#11921. Once resolved, I recommend we additionally configure Helm chart updates which covers both Helm dependencies and the container images referenced. By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice. --------- Signed-off-by: Daniel Carl Jones <djonesoa@amazon.com>
1 parent a4128b7 commit 1047b8b

1 file changed

Lines changed: 10 additions & 0 deletions

File tree

.github/dependabot.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
version: 2
3+
updates:
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
# Use limit of 1 PR, checked daily, to handle rush of updates.
7+
# TODO: Remove, update to weekly once the wave is over.
8+
open-pull-requests-limit: 1
9+
schedule:
10+
interval: "daily"

0 commit comments

Comments
 (0)