[PR #106] [CLOSED] add dependabot configuration #157

New issue

Closed

opened 2026-10-15 12:49:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:49:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/gow/pull/106
Author: @ReenigneArcher
Created: 1/4/2023
Status: ❌ Closed

Base: master ← Head: add/dependabot

📝 Commits (1)

d21b7a9 Create dependabot.yml

📊 Changes

1 file changed (+18 additions, -0 deletions)

View changed files

➕ .github/dependabot.yml (+18 -0)

📄 Description

Dependabot will help keep project dependencies up to date. In this configuration I've added two package systems to monitor.

docker: This will update tags in docker files when you tag a specific version instead of latest. I am unsure if the docker ecosystem will recurse into directories. In one of my own repos, I found that dependabot does not recurse into directories for npm, although it does for pip, submodules, etc.
github-actions: This will update github actions when a new version is released. If you use an exact tag like v2.1.0, a PR will be made whenever anything newer is releaesed. If you use a major version tag like v2 you won't get PR updates for every v2.x.x update, but you will for a v3+ release.

I have limited this to 10 open PRs per package ecosystem as to not completely overwhelm the repo with PRs.
I have set the branch to master but if in the future you use a staging/development branch you can change dependabot to monitor a different branch.

ℹ️ Note that dependabot PRs do not have access to org/repo secrets by default, but you can add secrets for dependabot at the org or repo level if you need them.

This is an example PR created by dependabot for a docker dependency. https://github.com/LizardByte/discord-bot/pull/138

And this is one for a GitHub action. https://github.com/LizardByte/Sunshine/pull/498

Using dependabot will eliminate the need to manually create PRs like this one: https://github.com/games-on-whales/gow/pull/78

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/gow/pull/106 **Author:** [@ReenigneArcher](https://github.com/ReenigneArcher) **Created:** 1/4/2023 **Status:** ❌ Closed **Base:** `master` ← **Head:** `add/dependabot` --- ### 📝 Commits (1) - [`d21b7a9`](https://github.com/games-on-whales/gow/commit/d21b7a9693446106b5264486de2781d847601e24) Create dependabot.yml ### 📊 Changes **1 file changed** (+18 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `.github/dependabot.yml` (+18 -0) </details> ### 📄 Description Dependabot will help keep project dependencies up to date. In this configuration I've added two package systems to monitor. 1. `docker`: This will update tags in docker files when you tag a specific version instead of `latest`. I am unsure if the docker ecosystem will recurse into directories. In one of my own repos, I found that dependabot does not recurse into directories for `npm`, although it does for `pip`, submodules, etc. 2. `github-actions`: This will update github actions when a new version is released. If you use an exact tag like `v2.1.0`, a PR will be made whenever anything newer is releaesed. If you use a major version tag like `v2` you won't get PR updates for every `v2.x.x` update, but you will for a `v3`+ release. - I have limited this to 10 open PRs per package ecosystem as to not completely overwhelm the repo with PRs. - I have set the branch to `master` but if in the future you use a staging/development branch you can change dependabot to monitor a different branch. ℹ️ Note that dependabot PRs do not have access to org/repo secrets by default, but you can add secrets for dependabot at the org or repo level if you need them. ![image](https://user-images.githubusercontent.com/42013603/210669755-532f673c-1407-42f0-81ec-64c8f13ef1e1.png) This is an example PR created by dependabot for a docker dependency. https://github.com/LizardByte/discord-bot/pull/138 And this is one for a GitHub action. https://github.com/LizardByte/Sunshine/pull/498 Using dependabot will eliminate the need to manually create PRs like this one: https://github.com/games-on-whales/gow/pull/78 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:49:33 +00:00