Enable dependency update scanning

[relud]

Per https://github.com/mozilla-services/foxsec/blob/master/README.mediawiki#Security_Checklist

• enable security scanning of 3rd-party libraries and dependencies
  • ...
  • For Python, enable pyup security updates:
    • Add a pyup config to your repo (example config: https://github.com/mozilla-services/antenna/blob/master/.pyup.yml)
    • Enable branch protection for master and other development branches. Make sure the approved-mozilla-pyup-configuration team CANNOT push to those branches.
    • From the "add a team" dropdown for your repo /settings page
      • Add the "Approved Mozilla PyUp Configuration" team for your github org (e.g. for mozilla and mozilla-services)
      • Grant it write permission so it can make pull requests
    • notify secops@mozilla.com to enable the integration in pyup

[relud]

@whd @jklukas do you have opinions on whether this should be security updates or all updates?

[jklukas]

If CI is expected to fully exercise the code, then we should be able to take all updates with confidence.

[pdehaan]

@jvehent: Re: https://github.com/mozilla-services/foxsec/blob/master/README.mediawiki#Security_Checklist, do we have documentation somewhere on Java specific best practices/tools?

[jvehent]

I'm not a java guy, but I think OWASP's dependency check might be useful. @psiinon maybe have tips too.

[psiinon]

For ZAP we use:

• https://lgtm.com
• https://snyk.io/
• https://scan.coverity.com/

Just give me a shout if you'd like any advice and guidance...

[jklukas]

@jezdez has good things to say about https://dependabot.com/

[jklukas]

Dependabot also supports Maven (in beta), so I'm going to investigate them a bit more.

[jezdez]

Yep, I found it nicer than pyup and renovate.

[jezdez]

Also it was recommended by foxsec people (@jvehent et al).

[jklukas]

Enabling dependabot requires an admin for the GitHub org, so filed https://bugzilla.mozilla.org/show_bug.cgi?id=1506836

[jklukas]

Access for dependabot is granted and I just did an initial setup. It's analyzing right now.

[jklukas]

This is now running and dependabot issued ~8 PRs across both the python and Java bits of the codebase here. It also looks like it detects when a rebase is needed due to master changing, and it automatically updates its PR. I am impressed.