chore(deps): add Dependabot version updates config - #2386
Open
estefano-vechietti-azion wants to merge 1 commit into
Open
estefano-vechietti-azion wants to merge 1 commit into
estefano-vechietti-azion wants to merge 1 commit into
Conversation
Adds .github/dependabot.yml following the Azion standard
(get_workflow_guide('dependabot')). Addresses the OSSF Scorecard
Dependency-Update-Tool check.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
estefano-vechietti-azion
requested review from
bruno-andrade-azion,
isaque-bock-azion,
marcus-souza-azion and
pedro-ribeiro-azion
as code owners
September 22, 2026 19:31
estefano-vechietti-azion
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
O que muda
Adiciona
.github/dependabot.ymlcobrindo: github-actions,npm.Segue o padrão Azion (
get_workflow_guide('dependabot')):github-actionssempre presentecooldown: default-days: 7em todos os ecossistemas (regra zizmordependabot-cooldown)commit-message.prefix: chorecominclude: scope→ gerachore(deps):minor+patchagrupados num PR só; actions agrupadas em azion / oficiais / terceirosopen-pull-requests-limitentre 5 e 10Por quê
Fecha o check Dependency-Update-Tool do OSSF Scorecard, hoje falhando neste repo.
Dependabot alerts e security updates já estavam ativos via security configuration da org. O que faltava eram os version updates, que exigem este arquivo.
Revisão
Os diretórios saíram da árvore do repo. Vale conferir se cobrem os manifestos que vocês querem monitorar, e ajustar
intervalouopen-pull-requests-limitse o volume de PRs incomodar.Se o check Engineering Compliance aparecer vermelho aqui, não é por causa deste PR: ele avalia o repo inteiro, não o diff, e fica vermelho até o PR de Phase 1 Compliance entrar.
🤖 Generated with Claude Code