search

datamade / how-to

📚 Doing all sorts of things, the DataMade way
MIT License
86 stars 12 forks source link

Document strategy for automatic security patches on GitHub #121

Closed hancush closed 10 months ago

hancush commented 3 years ago

Documentation request

Ported from https://github.com/datamade/devops/issues/128, strategy outlined in https://github.com/datamade/devops/issues/128#issuecomment-668202458.

derekeder commented 1 year ago

this is now handled pretty well with GitHub's dependabot and security features. is there anything to do here?

smcalilly commented 10 months ago

This would be a good opportunity to come up with a best practice for dependabot. Do we just let it automatically make changes, or do we want to review the changes? In either case, is there a severity level threshold where it's automatic (like a high severity we let it automatically make the changes?)

hancush commented 10 months ago

As a starting point, Jean and I contemplated a strategy here: https://github.com/datamade/devops/issues/128#issuecomment-668202458