From b00eb4925ebcd6eb495dc2a2c48ac7eb9bfa1984 Mon Sep 17 00:00:00 2001 From: Jonathan Yu Date: Sat, 6 Mar 2021 22:55:36 +0000 Subject: [PATCH] chore: use dependabot to manage dependencies Use dependabot to manage the dependencies defined in go.mod and GitHub Actions workflows, so that we can proactively update versions. Outdated versions of third-party dependencies frequently have known security vulnerabilities with CVEs. --- .github/dependabot.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..ebbc08a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,23 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + time: "06:00" + timezone: "America/Chicago" + commit-message: + prefix: "chore" + ignore: + # GitHub always delivers the latest versions for each major + # release tag, so handle updates manually + - dependency-name: "actions/*" + + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "daily" + time: "06:00" + timezone: "America/Chicago" + commit-message: + prefix: "chore"