Update dependabot.yaml for security updates #301
Conversation
k8s-ci-robot
added
release-note-none
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jsafrane The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
approved
Testing if dependabot can create security pull request for release-2.6, 2.7 and 2.8 branches. I am trying to cheat with a separate `updates` entry per branch. Most likely dependabot cannot bump only security-relevan dependencies in older branches, see dependabot/dependabot-core#2767 (comment)
jsafrane
force-pushed
the
jsafrane-patch-1
branch
from
4bca6f6 to
7d199b7
Compare
.github/dependabot.yaml
Outdated
| - "release-note-none" | ||
| - "ok-to-test" | ||
| open-pull-requests-limit: 0 | ||
| target-branch: "release-2.6" |
There was a problem hiding this comment.
Can you add a comment that these target-branches should be examined and updated after we cut a release following a K8s release to make sure only supported branches have this bot?
There was a problem hiding this comment.
I polished it a bit and added a comment.
|
Hopefully this works (dependabot/dependabot-core#2511 (comment)) , also its better if we got support for wildcard or an array in |
And polish the file.
| @@ -18,3 +19,40 @@ updates: | |||
| - "release-note-none" | |||
| - "ok-to-test" | |||
| open-pull-requests-limit: 10 | |||
|
|
|||
| # The list below needs to be maintained manually with every branch we support. | |||
There was a problem hiding this comment.
nit: group package-ecosystem changes in one block i.e. before the github-actions block or moving the first one here
nit: squash commits
cc @dzjiang91, if the PR gets created for a release branch I think that we could do the diff with the one created for master to see if there are changes i.e. to see if cherrypicking the change on master to the release branches is the same as what the bot creates.
|
I opened this PR using github editor and it opened a branch in kubernetes-csi/node-driver-registrar, not in my fork. And I can't squash commits there - Kubernetes repos have protection against force push. I am closing this PR, I'll reopen another one from my fork. |
|
|
|
Opened #302 |
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
Testing if dependabot can create security pull request for release-2.6, 2.7 and 2.8 branches.
I am trying to cheat with a separate
updatesentry per branch.Most likely this will not work, dependabot cannot bump only security-relevan dependencies in older branches, see dependabot/dependabot-core#2767 (comment)
Does this PR introduce a user-facing change?: