Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change suggested to add Dependabot config for a subfolder even though that exists already #2250

Open
afranken opened this issue Jul 19, 2023 · 1 comment · May be fixed by #2263
Open

Change suggested to add Dependabot config for a subfolder even though that exists already #2250

afranken opened this issue Jul 19, 2023 · 1 comment · May be fixed by #2263

Comments

@afranken
Copy link

See https://github.com/adobe/S3Mock/pull/1235/files

The dependabot action already configures:

  - package-ecosystem: "docker"
    # Look for `Dockerfile` in the `/docker` directory, that's where all versions are managed
    directory: "/docker/"
    # Open up to 10 PRs per run
    open-pull-requests-limit: 10
    # Add assignees
    assignees:
      - "afranken"
    # Check for updates once per day, Github defaults to random time every day.
    schedule:
      interval: "daily"

step security recommends to add:

  - package-ecosystem: docker
    directory: /docker
    schedule:
      interval: daily

I'm guessing it may be the quotes that throw off the scan, but more likely it's the trailing slash in the directory name?
Step security does not recommend to add configuration for the other package-ecosystem configs, and they contain quotes too.

@afranken afranken changed the title Change suggested to add Dependabot for a subfolder even though that exists Change suggested to add Dependabot config for a subfolder even though that exists already Jul 19, 2023
@varunsh-coder
Copy link
Member

Thanks, @afranken, for creating the issue! I will investigate and get back soon.

@varunsh-coder varunsh-coder linked a pull request Aug 2, 2023 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants