Replace dependabot with GitHub Action #356
Conversation
|
Preview is available here: |
.github/workflows/update_deps.yml
Outdated
| issues: write | ||
| steps: | ||
| - name: Update dependencies | ||
| uses: imjohnbo/issue-bot@v3.3.4 |
There was a problem hiding this comment.
❗ GitHub had a list of things they recommend we do whenever using third party actions:
-
Pin actions to a full length commit SHA
-
Audit the source code of the action
-
Pin actions to a tag only if you trust the creator
Can you do the first two items?
.github/workflows/update_deps.yml
Outdated
| Update all project dependencies | ||
| ``` | ||
| yarn upgrade-interactive --latest | ||
| ``` |
There was a problem hiding this comment.
💡 Do you have a checklist of things you do for the upgrade that we could knowledge share here? Also, it might be helpful to include commands for how you look at diffs of dependencies being upgraded, so everyones process converges for how to do this.
There was a problem hiding this comment.
LGTM! I've just added one suggestion to pin the GH Action commit sha instead of its tag. GH Security recommends this:
Pin actions to a full length commit SHA
Co-authored-by: Marcelo Salloum dos Santos <marcelo@stellar.org>
|
Preview is available here: |
…-v2 into il-deps-gh-action
|
Preview is available here: |
This will replace multiple issues from
dependabotfor a few individual dependencies with a single issue to update all of them (which is our practice).