search

codemirror / codemirror5

In-browser code editor (version 5, legacy)
http://codemirror.net/5/
MIT License
26.78k stars 4.96k forks source link

Add dependabot to keep GitHub Actions up-to-date #7077

Closed pnacht closed 9 months ago

pnacht commented 9 months ago

CodeMirror 5 already hash-pins its GitHub Actions (done in #7065), which is great. However, hashes are hard to update manually, so we could use dependabot to do this work automatically.

We can set up dependabot to send a single monthly PR to update all the hashes. This will help keep your CI up-to-date. If you'd rather keep the Actions fixed at these trusted versions, that's understandable.

In any case, I'll also suggest enabling Dependabot security updates (if you haven't already – that information isn't visible from outside). These are PRs sent by Dependabot whenever a vulnerability is reported on a dependency. This will ensure that, should a vulnerability be discovered in the hash-pinned version of an Action, you will immediately receive a PR to migrate to a patched version. To enable security updates:

  1. Settings > Code security & analysis
  2. Enable "Dependabot security updates"

In the meantime, I'll send a PR adding dependabot so you can take a look.

Disclosure: My name is Pedro and I work with Google and the Open Source Security Foundation to improve the supply-chain security of projects critical to the open-source ecosystem.

marijnh commented 9 months ago

Not interested in this. This repository is legacy, I don't want to integrate it into additional services and systems.