35d2bd50c41. Pins the Github Action workflow hashes under `.github/workflows` to full-length commit SHAs. 2. Adds a base level `.github/dependabot.yml` config to keep these (and other go/Docker) deps up to date. ## Motivation and Context - Github's [security guide](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions) recommends using the immutable SHA of an action when consuming third party actions. - Depdendabot makes ongoing dep house keeping manageable.
18 lines
345 B
YAML
18 lines
345 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: gomod
|
|
directory: /
|
|
schedule:
|
|
interval: daily
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
groups:
|
|
actions:
|
|
patterns:
|
|
- "*"
|
|
schedule:
|
|
interval: daily
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|