From 2a9a929f815b1da2ebcd58e1edea7bf7ebdda4b7 Mon Sep 17 00:00:00 2001 From: Dave Thaler Date: Mon, 21 Mar 2022 16:04:50 -0700 Subject: [PATCH 1/2] Add dependabot support The security principle is that one should try to upgrade as soon as fixes are available in dependencies. With this config, the github dependabot will automatically open a pull request to update a dependency when one is available. apt dependencies are not yet supported by dependabot, just pip, git submodules, github actions, etc. as listed at https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem Signed-off-by: Dave Thaler --- .github/dependabot.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..dc618205c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,34 @@ +# Copyright (c) Prevail Verifier contributors. +# SPDX-License-Identifier: MIT +# +# For documentation on the format of this file, see +# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 +updates: + + - package-ecosystem: "github-actions" + # Workflow files stored in the + # default location of `.github/workflows` + directory: "/" + schedule: + interval: "weekly" + day: "saturday" + + - package-ecosystem: "gitsubmodule" + directory: "/" + schedule: + interval: "weekly" + day: "saturday" + + - package-ecosystem: "nuget" + directory: "/" + schedule: + interval: "weekly" + day: "saturday" + + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + day: "saturday" From 8cc5a8677bc40de65abe7e0ae143f160f02973aa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Mar 2022 23:07:53 +0000 Subject: [PATCH 2/2] Bump ebpf-samples from `ae8ecc4` to `61eca81` Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `ae8ecc4` to `61eca81`. - [Release notes](https://github.com/vbpf/ebpf-samples/releases) - [Commits](https://github.com/vbpf/ebpf-samples/compare/ae8ecc4bfad332c22f1cb91c4eaeb8ff4c496461...61eca81953afd5a80cea20e9fa5adc7a345df242) --- updated-dependencies: - dependency-name: ebpf-samples dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- ebpf-samples | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ebpf-samples b/ebpf-samples index ae8ecc4bf..61eca8195 160000 --- a/ebpf-samples +++ b/ebpf-samples @@ -1 +1 @@ -Subproject commit ae8ecc4bfad332c22f1cb91c4eaeb8ff4c496461 +Subproject commit 61eca81953afd5a80cea20e9fa5adc7a345df242