feat: configure Dependabot Version Updates for workflows and actions
- 主要語言
- Dockerfile
- 星號
- 0
- 分支
- 8
- 平均合併
- 6 分鐘
- 30 天內合併 PR
- 1
描述
### Description
To address the outdated dependencies mentioned in #152 (since Renovate was rejected in favor of Dependabot in #154), we should configure Dependabot Version Updates for this repository.
Currently, Dependabot is not configured for version updates (there is no `.github/dependabot.yml` file). This means that while security alerts might be enabled, regular updates for stale dependencies are not automated.
Specifically, we need updates for:
1. **GitHub Actions** used in workflows and composite actions (to keep SHAs/versions up to date).
2. **npm dependencies** in the `multi-approvers` action (`.github/actions/multi-approvers/package.json`).
### Proposed Solution
Add a `.github/dependabot.yml` configuration file to the root of the repository to enable weekly version updates.
Example `.github/dependabot.yml`:
```yaml
version: 2
updates:
# Enable version updates for GitHub Actions
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
# Enable version updates for npm dependencies in multi-approvers
- package-ecosystem: "npm"
directory: "/.github/actions/multi-approvers"
schedule:
interval: "weekly"
```
貢獻指南
評估
這個 Issue 還沒有評估資料。