From db7bb2c6a0aa66c20801c517ca3dc9798ccadf31 Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Wed, 1 Sep 2021 08:46:09 +0200 Subject: [PATCH] ci: disable dependabot PR creation Dependabot does not need to report available updates for vendored dependencies in the downstream repository. Updates to dependencies are synced from the upstream repository when needed. There is also the "Upstream First" requirement, which we follow closely. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#open-pull-requests-limit Signed-off-by: Niels de Vos --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e98947fd4..0ddec90b9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,6 +3,8 @@ version: 2 enable-beta-ecosystems: true updates: - package-ecosystem: "gomod" + # ODF only: disable PR creation, synced from upstream + open-pull-requests-limit: 0 directory: "/" schedule: interval: "weekly"