oxsecurity / megalinter

🦙 MegaLinter analyzes 50 languages, 22 formats, 21 tooling formats, excessive copy-pastes, spelling mistakes and security issues in your repository sources with a GitHub Action, other CI tools or locally.
https://megalinter.io
GNU Affero General Public License v3.0
1.8k stars 215 forks source link

Add label to renovate PRs #3643

Closed echoix closed 3 weeks ago

echoix commented 3 weeks ago

I observed that dependabot PRs had labels while renovate didn't have some assigned.

Proposed Changes

Readiness Checklist

Author/Contributor

Reviewing Maintainer

github-actions[bot] commented 3 weeks ago

🦙 MegaLinter status: ⚠️ WARNING

Descriptor Linter Files Fixed Errors Elapsed time
✅ API spectral 2 0 3.19s
✅ BASH bash-exec 5 0 0.02s
✅ BASH shellcheck 5 0 0.12s
✅ BASH shfmt 5 0 0 0.75s
✅ COPYPASTE jscpd yes no 3.91s
✅ DOCKERFILE hadolint 130 0 18.02s
✅ JSON jsonlint 18 0 0.23s
✅ JSON v8r 20 0 30.57s
⚠️ MARKDOWN markdownlint 265 0 272 33.05s
✅ MARKDOWN markdown-table-formatter 265 0 0 142.05s
✅ OPENAPI spectral 2 0 3.04s
⚠️ PYTHON bandit 211 64 6.17s
✅ PYTHON black 211 0 0 6.08s
✅ PYTHON flake8 211 0 2.46s
✅ PYTHON isort 211 0 0 1.39s
✅ PYTHON mypy 211 0 19.56s
✅ PYTHON pylint 211 0 16.81s
✅ PYTHON ruff 211 0 0 0.72s
✅ REPOSITORY checkov yes no 39.06s
✅ REPOSITORY git_diff yes no 0.6s
⚠️ REPOSITORY grype yes 1 25.88s
✅ REPOSITORY secretlint yes no 19.22s
✅ REPOSITORY trivy yes no 19.29s
✅ REPOSITORY trivy-sbom yes no 10.25s
⚠️ REPOSITORY trufflehog yes 1 13.99s
✅ SPELL cspell 693 0 28.68s
⚠️ SPELL lychee 346 5 5.19s
✅ XML xmllint 3 0 0 0.71s
✅ YAML prettier 161 0 0 6.1s
✅ YAML v8r 102 0 195.18s
✅ YAML yamllint 162 0 2.34s

See detailed report in MegaLinter reports

_MegaLinter is graciously provided by OX Security_

echoix commented 3 weeks ago

Dependabot also applied other labels sometimes, like "docker" and the "dependencies" label to PRs. To get the same here, it's possible to configure renovate with package rules that apply to multiple packages selected by a criteria, group, or name, and apply additional specific labels, but it seems like a pain.

We could also use the actions/labeler action for all of our PRs, but the exactitude of the categories (like Python for pip dependencies) might just be impossible without using renovate for that. But is there really a value for that?