GitHub Supply Chain Security with Dependabot
Table of Contents
Pre-requisites #
- Create a new
dependencies
issue label on your GitHub repository.
Ecosystems #
Each package ecosystem can be added to the updates
list in your .github/dependabot.yml
file found at the root of your repository file tree with its own settings.
Go #
# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
- package-ecosystem: gomod
directory: /
schedule:
interval: daily
assignees:
- AppleGamer22
reviewers:
- AppleGamer22
commit-message:
prefix: chore
labels:
- dependencies
JavaScript & TypeScript #
# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
- package-ecosystem: npm
# ...
Python #
# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
- package-ecosystem: pip
# ...
Docker #
# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
- package-ecosystem: docker
# ...
GitHub Actions #
# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
- package-ecosystem: github-actions
# ...
Terraform #
# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
- package-ecosystem: terraform
# ...