systemd/.github/dependabot.yml

# SPDX-License-Identifier: LGPL-2.1-or-later

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
    open-pull-requests-limit: 2
  - package-ecosystem: "pip"
    directory: "/.github/workflows"
    schedule:
      interval: "monthly"
    open-pull-requests-limit: 2
  - package-ecosystem: "docker"
    directory: "/.clusterfuzzlite"
    schedule:
      interval: "monthly"
    open-pull-requests-limit: 2
  - package-ecosystem: "gitsubmodule"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 2
ci: LGPLv2+ify dependapot config and codeql action 2021-11-14 09:37:54 +00:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`

ci: pin labeler Turns out GHActions where `pull_request_target` is used are capable of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ labeler doesn't check out the source code or build anything so it's safe in its current form but to avoid surprises let's just pin it to the latest version. It's annoying to manage dependencies like this manually so additionally dependabot.yml is introduced to make it easier to keep GHActions up to date more or less automatically: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot 2021-11-11 01:56:02 +00:00			`version: 2`
			`updates:`
			`- package-ecosystem: "github-actions"`
			`directory: "/"`
			`schedule:`
ci: update GHActions once a month Apparently some actions like CodeQL are released a few times a week so let's just update them once a month in one fell swoop. 2022-01-29 18:16:16 +00:00			`interval: "monthly"`
ci: allow Dependabot to open up to 2 PRs Apparently version updates aren't always disabled on old forks, which leads to new PRs opened there. To somewhat mitigate the issue let's limit the number of PRs Dependabot can create. It was reported in https://github.com/yuwata/systemd/pull/2#issuecomment-967737195 2021-11-11 16:54:40 +00:00			`open-pull-requests-limit: 2`
ci: pin python dependencies and let Dependabot keep track of them 2021-11-19 16:23:03 +00:00			`- package-ecosystem: "pip"`
			`directory: "/.github/workflows"`
			`schedule:`
			`interval: "monthly"`
			`open-pull-requests-limit: 2`
ci: use CFLite to test forks (including systemd-stable) It's like CIFuzz but unlike CIFuzz it's compatible with forks and it should make it possible to run the fuzzers to make sure that patches backported to them are backported correctly without introducing new bugs and regressions. 2022-01-29 15:22:43 +00:00			`- package-ecosystem: "docker"`
			`directory: "/.clusterfuzzlite"`
			`schedule:`
			`interval: "monthly"`
			`open-pull-requests-limit: 2`
mkosi: Introduce packaging sources as submodules By always cloning the latest branch commit, we can't bisect properly using mkosi as when bisecting wildly different packaging sources will be used compared to when the commit was merged. By using submodules, we track individual commits which means when bisecting the same packaging sources will be used. We use git submodules as dependabot has support for automatically making PRs to update git submodules. This commit also includes the necessary dependabot configuration to enable this. We make ubuntu/debian use the same submodule instead of adding the debian packaging sources twice by introducing a new $PKG_SUBDIR environment variable and using it instead of $DISTRIBUTION. 2024-03-08 10:33:25 +00:00			`- package-ecosystem: "gitsubmodule"`
			`directory: "/"`
			`schedule:`
			`interval: "daily"`
			`open-pull-requests-limit: 2`