abcxyz / abcxyz/actions

feat: configure Dependabot Version Updates for workflows and actions

未關閉
#157 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Dockerfile
星號
0
分支
8
平均合併
6 分鐘
30 天內合併 PR
1

描述

### Description

To address the outdated dependencies mentioned in #152 (since Renovate was rejected in favor of Dependabot in #154), we should configure Dependabot Version Updates for this repository.

Currently, Dependabot is not configured for version updates (there is no `.github/dependabot.yml` file). This means that while security alerts might be enabled, regular updates for stale dependencies are not automated.

Specifically, we need updates for:
1. **GitHub Actions** used in workflows and composite actions (to keep SHAs/versions up to date).
2. **npm dependencies** in the `multi-approvers` action (`.github/actions/multi-approvers/package.json`).

### Proposed Solution

Add a `.github/dependabot.yml` configuration file to the root of the repository to enable weekly version updates.

Example `.github/dependabot.yml`:

```yaml
version: 2
updates:
# Enable version updates for GitHub Actions
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"

# Enable version updates for npm dependencies in multi-approvers
- package-ecosystem: "npm"
directory: "/.github/actions/multi-approvers"
schedule:
interval: "weekly"
```

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。