ci: add dependabot for the workflow actions - #5
Merged
Merged
Conversation
This repo had no .github/dependabot.yml, so nothing watched the two actions zizmor.yml pins. It shows: actions/checkout here is at v6.0.3 while every other repo in the org runs v7.x. That matters more here than the two actions would suggest. This repo ships CI-SECURITY.md and the reusable zizmor workflow the other repos call, so it is the org's CI-security template. A template whose own pins go stale argues against itself. Same shape as the sibling repos: github-actions, daily, seven-day cooldown so a yanked or compromised release is not applied automatically, which is also what zizmor's dependabot-cooldown audit wants. Expect a first pull request bumping actions/checkout toward v7.
There was a problem hiding this comment.
Pull request overview
Adds a Dependabot configuration to keep GitHub Actions pins in this repository (including the reusable zizmor.yml workflow) up to date, aligning this repo with the org’s CI-security template expectations.
Changes:
- Introduces
.github/dependabot.ymlto enable daily Dependabot updates for thegithub-actionsecosystem. - Configures a 7-day cooldown to avoid immediately adopting newly-published (and potentially yanked/compromised) action releases.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the missing
.github/dependabot.yml. Nothing has been watching the two actionszizmor.ymlpins, and it shows —actions/checkouthere is at v6.0.3 while everyother repo in the org runs v7.x.
Why here in particular
Two actions is a thin case on its own. What makes it worth doing is that this repo ships
CI-SECURITY.mdand the reusablezizmor.ymlthe other repos call, so it is the org'sCI-security template. A template whose own pins go stale argues against itself.
Shape
Same as the sibling repos that already have one (
registry-drupal-modules,schedule-downtime,drupal-local-devas of EUDCH/drupal-local-dev#8, andedch-service-testsin EUDCH/edch-service-tests#8):github-actions, daily, seven-daycooldown so a yanked or compromised release is not applied automatically — also what
zizmor's own
dependabot-cooldownaudit requires.Expect a first pull request bumping
actions/checkouttoward v7.Verification
zizmorclean on.github/including the new file.Context
Found while sweeping Dependabot coverage across the org after
EUDCH/drupal-local-dev#8, where a missing config had left MegaLinter pinned two majors
behind. Four repos were missing one; this is one of them.