Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: add dependabot configuration files #2093

Merged
merged 8 commits into from
Feb 1, 2024
Merged

Conversation

lennessyy
Copy link
Contributor

Describe the Change

This PR adds custom configurations for dependabot:

  • Dependabot scans repo weekly for vulnerabilities
  • Dependabot's PR will build on target branch

Review Changes

💻 Add Preview URL

🎫 Jira Ticket

Copy link

netlify bot commented Jan 24, 2024

Deploy Preview for docs-spectrocloud ready!

Name Link
🔨 Latest commit 486f17b
🔍 Latest deploy log https://app.netlify.com/sites/docs-spectrocloud/deploys/65badd655224190008e9a948
😎 Deploy Preview https://deploy-preview-2093--docs-spectrocloud.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Copy link
Contributor

@karl-cardenas-coding karl-cardenas-coding left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lennessyy Approved, no show stoppers but some suggestions 🚀

.github/workflows/dependabot.yaml Outdated Show resolved Hide resolved
dependabot.yml Outdated
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your call @lennessyy but this could get very noisy, especially in the JS ecosystem 😅
My recommendation is to leave it as monthly.

The other I wonder is if we should add target-branch and commit-message. That way we could ensure it starts with chore:

Source.

dependabot.yml Outdated
@@ -0,0 +1,6 @@
version: 2
updates:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add config block for GitHub Actions too 😄

on:
pull_request_target:
types: [opened, synchronize, reopened, ready_for_review]
branches-ignore: ["version-*"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think dependabot only targets the default branch by default, you can also control in the config file.

@lennessyy lennessyy marked this pull request as ready for review January 31, 2024 00:27
@lennessyy lennessyy requested a review from a team as a code owner January 31, 2024 00:27
@lennessyy lennessyy enabled auto-merge (squash) January 31, 2024 23:37
@lennessyy lennessyy merged commit eff0946 into master Feb 1, 2024
9 checks passed
@lennessyy lennessyy deleted the custom-dependabot branch February 1, 2024 00:08
@vault-token-factory-spectrocloud
Copy link
Contributor

🎉 This PR is included in version 4.2.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@vault-token-factory-spectrocloud
Copy link
Contributor

🎉 This PR is included in version 4.2.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants