Skip to main content
  1. Posts/
  2. Git/

GitHub Supply Chain Security with Dependabot

··130 words·1 min·

Pre-requisites #

  • Create a new dependencies issue label on your GitHub repository.

Ecosystems #

Each package ecosystem can be added to the updates list in your .github/dependabot.yml file found at the root of your repository file tree with its own settings.

Go #

# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
  - package-ecosystem: gomod
    directory: /
    schedule:
      interval: daily
    assignees:
      - AppleGamer22
    reviewers:
      - AppleGamer22
    commit-message:
      prefix: chore
    labels:
      - dependencies

JavaScript & TypeScript #

# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
  - package-ecosystem: npm
    # ...

Python #

# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
  - package-ecosystem: pip
    # ...

Docker #

# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
  - package-ecosystem: docker
    # ...

GitHub Actions #

# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
  - package-ecosystem: github-actions
   # ...

Terraform #

# yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
version: 2
updates:
  - package-ecosystem: terraform
    # ...