The release frequency of some GHAs means we end up with daily
dependabot PRs, which results in lots of not-particularly-useful
review work. Reducing the update cadence to weekly shouldn't expose us
to much risk and will reduce PR churn.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Add Dependabot configuration to automatically update GitHub Actions on
the release-0.12 branch.
This will facilitate quick updates while using SHA-based versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
For quicker updates and easier, more consistent maintenance.
SHA-based versions should always be used to be sure the code we pull in
can't be changed without us, for security reasons at least. Dependabot
now supports SHA-based versions for GHAs. This patch should facilitate
their continued use.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Stephen KittandThomas Pantelis
Daniel FarrellandStephen Kitt