OriginProtocol / OriginProtocol/origin-dollar
Add Dependabot and Remove Snyk Integration
Nobody has claimed this yet.
- Dominant language
- Solidity
- Stars
- 152
- Forks
- 115
- Avg merge
- 3d 20h
- Merged PRs (30d)
- 17
Description
We are no longer subscribed to Snyk's plans. We could remove it in favour of Dependabot.
Copying @franckc's comment from PR #1084 about this:
Is the Snyk integration still working? we stopped paying for the subscription a while ago because our team did not find it useful.
Perhaps we could get rid of it and enable GitHub dependabot as a replacement? Those two tools are slightly different but if we keep up with updating dependencies recommended by dependabot I think that will go a long way in terms of keeping the repo safe against package related security vulnerability. Thoughts?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the existing Snyk integration and the discussion copied from PR #1084, then locate the repository's dependency and security configuration. Remove the Snyk integration and add GitHub Dependabot coverage; the work is done when Dependabot replaces Snyk without leaving the old integration active.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100