diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 19585d75a..ec0ed0318 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,12 +4,12 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "daily" + interval: "weekly" - package-ecosystem: npm directory: "/javascript" schedule: - interval: daily + interval: "weekly" - package-ecosystem: bundler directory: "/ruby" schedule: - interval: weekly + interval: "weekly" diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 52a74fe5d..7817b026a 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -2,9 +2,9 @@ name: Android CI on: push: - branches: [ master ] + branches: [ main ] pull_request: - branches: [ master ] + branches: [ main ] jobs: build: diff --git a/README.md b/README.md index f98593c37..ddee1745d 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,39 @@ -# Dependabot Demo Repository +
+ + + + Dependabot + +
+ +## Dependabot Demo Repository This repo contains some projects with outdated dependencies. Fork it to try out -Dependabot! +Dependabot :dependabot:! + +### Enabling Security Updates + +- In your fork, click the **Settings** tab +- In the left hand side navigation, click **Code security and analysis** +- Enable **Dependabot security updates** or **Grouped security updates** +- Dependabot will now start creating PRs for detected security vulnerabilities +- Go into the **Security** tab and click **Dependabot** in the left hand side navigation to see what Dependabot is working on + +screenshot showing Dependabot working on Security Updates + +After about 5 minutes you should see some PRs open. Merge them and the Securty Alerts will close 🎉 + +### Enabling Version Updates + +This demo includes a `dependabot.yml` which configures [Version Updates](https://docs.github.com/github/administering-a-repository/keeping-your-dependencies-updated-automatically), but forks don't automatically start with Dependabot enabled. + +The enable Dependabot on your fork: +- Click the **Insights** tab +- In the left hand side navigation, click **Dependency Graph** +- Click on the **Dependabot** tab +- Click on the **Enable Dependabot** button +- After a moment, refresh the page and you should see Dependabot hard at work + +screenshot showing Dependabot working on Version Updates + +After a few minutes, you should get some more PRs!