Add Dependabot configuration for pip and GitHub Actions - #769
Open
hakonhagland wants to merge 1 commit into
Open
Add Dependabot configuration for pip and GitHub Actions#769hakonhagland wants to merge 1 commit into
hakonhagland wants to merge 1 commit into
Conversation
Without a .github/dependabot.yml GitHub only raises security alerts; it never opens version-update pull requests. That is why both Poetry lock files were able to drift years behind upstream, leaving 29 open alerts to be cleared in PRs OPM#767 and OPM#768 - some of them, such as the requests and certifi advisories, dating back to 2024. Three entries are needed. Dependabot takes one manifest directory per entry, so the two Poetry projects cannot share one: - pip, rooted at /scripts/python, for the fodt package - pip, rooted at /docker, for the lodocker package - github-actions, rooted at /, for the workflow action pins. Every action used by the two workflows is referenced by a version tag, so all of them are covered: actions/checkout, actions/setup-python and abatilo/actions-poetry. All three use a monthly schedule with every package in a single group, so each ecosystem produces at most one pull request per month. Ungrouped updates would be unmanageable: GitPython alone went through eight patch releases in the three weeks from 2026-07-21 to 2026-08-07. Security updates are unaffected and are still opened immediately when an advisory is published. Note that docker2/ is not covered. It holds a third Poetry project with an even older lock file, but it is untracked, so it does not exist on GitHub and Dependabot cannot see it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #767 and #768. Those two PRs cleared 29 open Dependabot alerts; this one is about not getting into that situation again.
The repository has no
.github/dependabot.yml, which means GitHub only ever raises security alerts — it never opens routine version-update pull requests. Nothing has been nudging the dependencies forward between advisories, so both lock files drifted badly:scripts/pythonwas still onrequests2.31.0 with three stacked advisories, anddockerwas carrying acertifiCA bundle from 2023 and arequestsadvisory from 2024.What the config does
Three entries, because Dependabot takes one manifest directory per entry — the two Poetry projects cannot share one:
pip, rooted at/scripts/python— thefodtpackage.pip, rooted at/docker— thelodockerpackage.github-actions, rooted at/— the workflow action pins. Dependabot can only bump actions referenced by a version tag, and every action used here qualifies:actions/checkout,actions/setup-pythonandabatilo/actions-poetry.All three use a monthly schedule with a single catch-all group, so each ecosystem produces at most one pull request per month. Grouping is the important part: ungrouped, GitPython alone went through eight patch releases in the three weeks from 2026-07-21 to 2026-08-07, and each would have arrived as a separate pull request.
This affects scheduled version updates only. Security updates are unchanged — they are still opened immediately and individually whenever an advisory is published, regardless of the schedule here.
What to expect after merging
actions/checkout@v3andactions/setup-python@v4(v4 and v5 are current), andci.ymlusesabatilo/actions-poetry@v2whilecheck_keyword_linking.ymlis already on@v3— worth reviewing together rather than one at a time. Note thatcheck_keyword_linking.ymlpinspoetry-version: "1.8.4"with a comment that "latest" did not work, so that pin should be left alone unless it is retested deliberately.