-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Enable dependabot. #7486
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enable dependabot. #7486
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
Adds a Dependabot configuration to enable weekly NuGet dependency updates.
- Introduces a new
.github/dependabot.ymlfile - Configures Dependabot to check the root directory for NuGet manifests on a weekly schedule
| - package-ecosystem: "nuget" | ||
| directory: "/" # Location of package manifests | ||
| schedule: | ||
| interval: "weekly" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
does it cost much if we enable running it daily instead?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's too often, we have to review the PRs and merge them. I don't want daily PRs if dependencies update that often. Weekly is fine.
tarekgh
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
|
/ba-g checks are skipped for workflow only PRs. |
Configure dependabot for public dependency updates. This will help this repo stay up to date with public dependencies.
We'll still need to review dependency PRs, and mirror packages to our feeds, but this will help ensure we stay up to date.