bcgov / bcgov/STRR

Implement GitHub Dependabot Configuration for Automated Vulnerability Scanning and resolution

Open Beginner friendly
#1,753 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2
Forks
22
Avg merge
2d 35m
Merged PRs (30d)
11

Description

### Objective

Automate vulnerability scanning and resolution for dependencies across the codebase by introducing a standard Dependabot configuration.

### Tasks & Requirements

Create and commit a `.github/dependabot.yml` configuration file to the root of the repository with the following specifications:

- **Security Updates:** Configure security updates to run **daily** for all relevant dependency ecosystems used in the project (e.g., `poetry` for Python/Flask, `pnpm` for Node/Firebase).
- **Version Updates:** Configure routine version updates on a **weekly** schedule to scan for non-vulnerable updates and keep dependencies current.
- **Default Reviewers:** Automatically assign the default reviewer group to the pull requests

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting the repository's dependency manifests to confirm the Poetry and pnpm ecosystems, then create .github/dependabot.yml at the repository root. Configure daily security updates, weekly version updates, and the specified default reviewer group. The issue is done when the configuration is committed and covers all relevant ecosystems.

Written by the indexing model from the issue text.

Assessment

Tech stack
firebase, flask, node.js, python
Domain
devops, security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.