From c17b3f69bddb2cbe7f8351845052afb612a9e5eb Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Thu, 26 Aug 2021 17:57:12 +0200 Subject: [PATCH] ci: add dependabot config for updating vendored packages Vendored dependencies need updating on regular basis. This is currently done manually by developers, but it can be automated by Dependabot. By dropping the dependabot.yml config file in the .github/ directory the bot should get enabled. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates Signed-off-by: Niels de Vos --- .github/dependabot.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..d9a772676 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +--- +version: 2 +updates: + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "weekly" + labels: + - rebase + commit-message: + prefix: "rebase"