Add dependabot configuration file #2384
Conversation
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| open-pull-requests-limit: 5 |
There was a problem hiding this comment.
| open-pull-requests-limit: 5 |
The default value is 5 already.
There was a problem hiding this comment.
True, except most people don't know that and the default may change without notice.
This makes it explicit and easy to check for people. Happy to remove it if you prefer, but at least you now know my reasoning for including it.
There was a problem hiding this comment.
We already rely on other defaults (like it being on a Monday), so this is no different. Having it also suggests that we're limiting it on purpose (I was going to query why we'd want to do that, really), rather than leaving it to the defaults (more effort to look up).
There was a problem hiding this comment.
I'm really fine either way. Extra information doesn't hurt I guess
This commit adds an initial Dependabot configuration to:
* Submit pull requests for security updates and version updates for GH Action runner dependencies.
At a later point in time, we could consider enabling it for Composer dependencies as well.
The configuration has been set up to:
* Run weekly (for now).
* Submit a maximum of 5 pull requests at a time.
If additional pull requests are needed, these will subsequently be submitted the next time Dependabot runs after one or more of the open pull requests have been merged.
* The commit messages for PRs submitted by Dependabot will be prefixed according the unofficial conventions used in this repo up to now.
* The PRs will automatically be labelled with an appropriate label as already in use in this repo.
Refs:
* https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
* https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#versioning-strategy
jrfnl
force-pushed
the
feature/add-dependabot-config-for-ghactions
branch
from
285018f to
dd9b567
Compare
Context: I know some updates are needed to the GHA workflows due to new major releases of action runners. May as well set up Dependabot now to get those updates in (which automatically tests the config).
This commit adds an initial Dependabot configuration to:
At a later point in time, we could consider enabling it for Composer dependencies as well.
The configuration has been set up to:
Refs: