Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update GitHub Security guide with latest Starter Kit improvements #146

Merged
merged 2 commits into from
Mar 26, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -48,14 +48,19 @@ If you do not have organizational permissions or if you wish to customize securi
- For added security, we suggest turning on Dependabot security updates to automatically generate pull requests for known vulnerabilities in your dependencies.
- We also recommend enabling Dependabot version updates _if you are using a package manager for your project_. This will help you keep your dependencies up-to-date. To configure Dependabot version updates:
1. Create a `.github/dependabot.yml` file in your repository.
2. Specify the package-ecosystem, directory, and schedule for the updates. For example:
2. Specify the package-ecosystem, directory, schedule and branch to update. For example, the below demonstrates a Python [dependabot.yml](https://github.com/NASA-AMMOS/slim-starterkit-python/blob/main/.github/dependabot.yml) example from the [SLIM Python Starter Kit](https://nasa-ammos.github.io/slim/docs/guides/software-lifecycle/application-starter-kits/python-starter-kit/):
```yml
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
- package-ecosystem: 'pip'
ingyhere marked this conversation as resolved.
Show resolved Hide resolved
directory: '/' # location of package manifests
schedule:
interval: "daily"
interval: 'daily'
time: '09:00'
timezone: 'America/Los_Angeles'
target-branch: 'main'
labels:
- 'dependencies'
```
- To view Dependabot alerts and version updates:
- Head back to the main page of your repository.
Expand Down
Loading