Keep GitHub Actions up to date with GitHub's Dependabot

[cclauss]

• Keeping your software supply chain secure with Dependabot
• Keeping your actions up to date with Dependabot
• Configuration options for the dependabot.yml file - package-ecosystem

Related to:

• .github: Keep Actions up to date with GitHub's Dependabot ardupilot#30533
• .github: Keep Actions up to date with GitHub's Dependabot mavlink#405
• .github: Keep Actions up to date with GitHub's Dependabot pymavlink#1065

[Ryanf55]

How can we run the new workflow to verify it works? Do we have to merge, then wait for the next calendar week to start?

[cclauss]

Merge it, and (if needed) a new pull request will normally be created within about 15 minutes.

Example:

• Bump the github-actions group with 6 updates pyscript/pyscript#1995

[Ryanf55]

This reduces maintenance burden of MAVProxy. I would like to try it. Approved!

[peterbarker]

We could... but the PRs are likely to be ignored like the pnes for pymavlink are: https://github.com/ArduPilot/pymavlink/pulls?page=2&q=is%3Apr+is%3Aopen

[Ryanf55]

Better than waiting till the github actions are totally dead and CI breaks though?

[cclauss]

the PRs are likely to be ignored

GitHub Actions are only used at CI test-time, while most other dependencies are also used at runtime.
This means that if the CI tests pass, maintainers have more confidence that the proposed changes will not break runtime.

GitHub Actions have very infrequent major version changes . setup-python, the most frequent, has only had four major upgrades in its lifetime.

When GitHub Actions are upgraded, it often happens in batches. The pattern: * proposed in this PR will consolidate all GHA updates into a single pull request to further reduce chattiness. Please see the example output provided above.

There is a tradeoff between supply chain security and chattiness. Given that we have a few GHAs that are updated rarely and usually in batches, and we are using pattern: * to ensure that there will only ever be a single GHA upgrade PR at a time.

[rmackay9]

The author ping'd me about this so I've added it to the EUDevCall. I'm not really qualified to review the PR

[cclauss]

Are there any remaining questions or todos on this one?

[cclauss]

Generated

• build(deps): bump the github-actions group with 2 updates #1611