From 7aba15aa13d195c862f2e6bb2d44af36a560d5c6 Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Tue, 21 Jun 2022 08:40:03 +0200 Subject: [PATCH] ci: disable dependabot PR creation for Actions Dependabot does not need to report available updates for vendored dependencies in the downstream repository. Updates to dependencies are synced from the upstream repository when needed. There is also the "Upstream First" requirement, which we follow closely. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#open-pull-requests-limit Signed-off-by: Niels de Vos --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 515b85684..b7722394c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -40,6 +40,8 @@ updates: - dependency-name: "k8s.io/pod-security-admission" - dependency-name: "k8s.io/sample-apiserver" - package-ecosystem: "gomod" + # ODF only: disable PR creation, synced from upstream + open-pull-requests-limit: 0 directory: "/actions/retest" schedule: interval: "weekly" @@ -50,6 +52,8 @@ updates: commit-message: prefix: "rebase" - package-ecosystem: "github-actions" + # ODF only: disable PR creation, synced from upstream + open-pull-requests-limit: 0 directory: "/" schedule: interval: weekly