Ensures that dependencies stay updated automatically, with maintainers only intervening by exception (i.e. when an automatic update fails).
Note that security concerns are mitigated as (i) the GitHub action does not have access to any secrets (except for DEPENDABOT_PUBLIC_REPO_ACCESS_TOKEN, which is passed to a specific step only), and (ii) approval of dependabot PRs is delayed for 20 days, to allow time for vulnerabilities to be discovered and the offending version removed from npm.
Works with https://github.com/openactive/github-actions-workflows
Ensures that dependencies stay updated automatically, with maintainers only intervening by exception (i.e. when an automatic update fails).
Note that security concerns are mitigated as (i) the GitHub action does not have access to any secrets (except for
DEPENDABOT_PUBLIC_REPO_ACCESS_TOKEN, which is passed to a specific step only), and (ii) approval of dependabot PRs is delayed for 20 days, to allow time for vulnerabilities to be discovered and the offending version removed from npm.