MetOffice / MetOffice/action-setup-artifactory
Add Artifactory key for dependabot?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Dependabot cannot access repository secrets, therefore tests are failing on PRs it riases as it cannot access the Artifacory to install dependencies.
However, we can set repo secrets specific to dependabot. We could set a separate Artifactory username and key here to allow the tests to run.
I'm not sure how useful this would be though as the the CI would still be running from main, so any "bumped action versions" would not be tested anyhow.
Should we:
- Add secrets to quieten the CI. Are there any security risks in doing so?
- Add an exclusion to the tests so they don't run for dependabot
- Keep things as-is and just ignore the failed tests.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the GitHub Actions workflows and the behavior of Dependabot PRs described in the issue. Compare the proposed repository secrets, test exclusion, and no-change options; done means selecting and implementing one documented approach with acceptable security implications and predictable CI results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100