Add Dependabot configuration for pip and GitHub Actions #66
Conversation
| - package-ecosystem: "pip" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "daily" |
There was a problem hiding this comment.
If it's all the same to you, I'd rather this schedule was more gentile. Porch doesn't have a CD process, so there would be far more churn than releases and deployments. I'd suggest weekly or monthly would be quite enough to ward off evil.
There was a problem hiding this comment.
Then I'd suggest acting on them weekly or monthly, but leaving the daily schedule so that if a "critical" pops up it can dealt with. The actual frequency of PRs is much less than daily (typically 2-3 per month), so best case is you see the 3 PRs at the end of the month, worst case is you sit on a critical CVE for that same time.
There was a problem hiding this comment.
Very well. Thanks for enabling it in any event. Been collecting dust in my to-do for years.
Dependabot has been very useful in helping keep up with bug fixes and CVEs.