Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modernize dependabot.yml in correct directories #3093

Merged
merged 4 commits into from
Nov 13, 2023
Merged

Conversation

echoix
Copy link
Collaborator

@echoix echoix commented Nov 13, 2023

Allows to also specifically ignore some security flagging of a package.json designed for a vulnerability scanner (grype).

Proposed Changes

  1. Sets the npm directory from a non existent dependencies folder to /mega-linter-runner, where the npm deps are
  2. Adds the server folder as a directory where there are some python dependencies to check
  3. Adds the megalinter folder as directory where there are some python dependencies to check, that will function correctly when the project will convert to pyproject.toml instead of setup.py
  4. Adds the folder .config/python/dev as a folder for python.
  5. We don't have gemfiles, but we don't have a dependencies folder too.

Readiness Checklist

Author/Contributor

  • Add entry to the CHANGELOG listing the change and linking to the corresponding issue (if appropriate)
  • If documentation is needed for this change, has that been included in this pull request

Reviewing Maintainer

  • Label as breaking if this is a large fundamental change
  • Label as either automation, bug, documentation, enhancement, infrastructure, or performance

Copy link
Contributor

github-actions bot commented Nov 13, 2023

🦙 MegaLinter status: ⚠️ WARNING

Descriptor Linter Files Fixed Errors Elapsed time
✅ BASH bash-exec 5 0 0.08s
✅ BASH shellcheck 5 0 0.11s
✅ BASH shfmt 5 0 0 0.07s
✅ COPYPASTE jscpd yes no 4.05s
✅ DOCKERFILE hadolint 124 0 21.08s
✅ JSON eslint-plugin-jsonc 23 0 0 2.39s
✅ JSON jsonlint 21 0 0.27s
✅ JSON v8r 23 0 17.04s
✅ MAKEFILE checkmake 1 0 0.0s
⚠️ MARKDOWN markdownlint 255 0 11 6.51s
✅ MARKDOWN markdown-link-check 255 0 7.5s
✅ MARKDOWN markdown-table-formatter 255 0 0 46.47s
✅ OPENAPI spectral 1 0 1.74s
⚠️ PYTHON bandit 201 61 2.85s
✅ PYTHON black 201 0 0 5.87s
✅ PYTHON flake8 201 0 2.57s
✅ PYTHON isort 201 0 0 0.56s
✅ PYTHON mypy 201 0 12.83s
✅ PYTHON pylint 201 0 15.82s
⚠️ PYTHON pyright 201 352 25.51s
✅ PYTHON ruff 201 0 0 0.14s
✅ REPOSITORY checkov yes no 46.72s
✅ REPOSITORY git_diff yes no 0.06s
⚠️ REPOSITORY grype yes 1 11.61s
✅ REPOSITORY secretlint yes no 12.5s
✅ REPOSITORY trivy yes no 31.24s
✅ REPOSITORY trivy-sbom yes no 1.5s
⚠️ REPOSITORY trufflehog yes 1 24.53s
✅ SPELL cspell 667 0 30.78s
✅ SPELL lychee 335 0 4.2s
✅ XML xmllint 3 0 0 0.06s
✅ YAML prettier 160 0 0 5.79s
✅ YAML v8r 102 0 211.28s
✅ YAML yamllint 161 0 1.87s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by OX Security

Copy link
Member

@nvuillam nvuillam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great ❤️

@nvuillam nvuillam merged commit 914b686 into main Nov 13, 2023
129 checks passed
@nvuillam nvuillam deleted the edit-dependabot-config branch November 13, 2023 06:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file infrastructure
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants