Skip to content

Add dependabot configuration file #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 23, 2023

Conversation

jrfnl
Copy link
Collaborator

@jrfnl jrfnl commented Sep 12, 2023

Context: I know some updates are needed to the GHA workflows due to new major releases of action runners. May as well set up Dependabot now to get those updates in (which automatically tests the config).


This automatically enables Dependabot to:

  • Submit pull requests for security updates and version updates for Composer dependencies.
  • Submit pull requests for security updates and version updates for GH Action runner dependencies.

For Composer dependencies, a preference is given to widen the version restrictions instead of updating them to a new minimum. This is a deliberate choice as this package is a library, not an application.

The configuration has been set up to:

  • Run once a week.
  • Submit a maximum of 5 pull requests at a time. If additional pull requests are needed, these will subsequently be submitted the next time Dependabot runs after one or more of the open pull requests have been merged.
  • The commit messages for PRs submitted by Dependabot will be prefixed according the unofficial conventions used in this repo up to now.
  • The PRs will automatically be labelled with an appropriate label as already in use in this repo.

Refs:

**Context**: I know some updates are needed to the GHA workflows due to new major releases of action runners. May as well set up  Dependabot now to get those updates in (which automatically tests the config).

----

This automatically enables Dependabot to:
* Submit pull requests for security updates and version updates for Composer dependencies.
* Submit pull requests for security updates and version updates for GH Action runner dependencies.

For Composer dependencies, a preference is given to _widen_ the version restrictions instead of updating them to a new minimum.
This is a deliberate choice as this package is a library, not an application.

The configuration has been set up to:
* Run once a week.
* Submit a maximum of 5 pull requests at a time.
    If additional pull requests are needed, these will subsequently be submitted the next time Dependabot runs after one or more of the open pull requests have been merged.
* The commit messages for PRs submitted by Dependabot will be prefixed according the unofficial conventions used in this repo up to now.
* The PRs will automatically be labelled with an appropriate label as already in use in this repo.

Refs:
* https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
* https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#versioning-strategy
@jrfnl jrfnl added this to the 2.x Next milestone Sep 12, 2023
@jrfnl jrfnl requested a review from grogy September 12, 2023 20:59
Copy link
Member

@grogy grogy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, it is correct as in other packages :-)

grogy

This comment was marked as duplicate.

@grogy grogy merged commit 4ef1bb9 into master Sep 23, 2023
@grogy grogy deleted the feature/add-dependabot-config-for-ghactions branch September 23, 2023 16:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

2 participants