Enable dependabot on our composite actions - Githubissues

ansys / actions

A collection of reusable workflows

https://actions.docs.ansys.com/

MIT License

10 stars 5 forks source link

Enable dependabot on our composite actions #418

Open RobPasMue opened 6 months ago

RobPasMue commented 6 months ago

Currently dependabot is only updating the main workflow file. However, it'd be great if dependabot updated the composite actions directly in this repo.

There is a solution which would consist on duplicating the package-ecosystem: "github-actions" N times, where N is the number of actions we have. However, after https://github.com/dependabot/dependabot-core/issues/2178 is solved (see https://github.com/dependabot/dependabot-core/issues/2178#issuecomment-1979488388 for recent activity) we should be able to use wildcards on our dependabot.yml file and thus making it super simple to implement.

Let's wait for https://github.com/dependabot/dependabot-core/issues/2178 to be closed and we can get started with this afterwards.

jorgepiloto commented 3 months ago

We may be part of the beta testing for this, see https://github.com/dependabot/dependabot-core/issues/2178#issuecomment-2146839216

RobPasMue commented 3 months ago

Good catch @jorgepiloto! I didn't realize we could be beta testers

jorgepiloto commented 3 months ago

Some issues found with the latest syntax, see https://github.com/github-early-access/dependabot-wildcard-glob-private-beta/issues/3

RobPasMue commented 3 months ago

We can't access that link but we trust you :)

jorgepiloto commented 3 months ago

True. Here is the link to the issue in this same repository:

Go to ansys/actions
Click on Insights tab -> Dependency graph section -> Dependabot tab

Direct link: https://github.com/ansys/actions/network/updates/20639306/jobs

jorgepiloto commented 3 months ago

The repository has been archived. Looks like Dependabot maintainers are working on it.