Create decision record for Using Dependabot to update GHA

[blulady]

Overview

We need a decision record for Using Dependabot to update GHA so that we are clear about what we need to do and it's easy for people to find the history behind the issue.

Details

A lot of our Github Actions are not the latest version. We want to be notified when our GHA dependencies are out of date. The issue below was created before the GH Dependabot was updated to include alerts for GitHub actions, as mentioned in the blog listed in the resources. So now that it is available from GH, we want to utilize the GH Dependabot. We want to make a decision record to clarify why we made this decision.
We have enabled the GH Dependabot to issue alerts for vulnerabilities and security issues here (also listed below). But we need to configure a dependabot.yml file to have dependabot create pull requests.

Action Items

• create a page in the wiki
• copy the template text on to that page
• link it to the page with the adopted decision record
• fill in the issue template prompts
• get a peer review
• create the new issue to follow through with the decision

Resources/Instructions

• https://github.blog/2022-08-09-dependabot-now-alerts-for-vulnerable-github-actions/#dependabot-alerts-for-github-actions
• https://github.com/hackforla/website/settings/security_analysis
• https://docs.github.com/en/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates
• https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates
• https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
• Update dependencies action 2065 #3414 this is the PR that started the investigation into if we could use the dependabot instead of a github action to accomplish the same task.
• https://github.com/hackforla/website/wiki/Decision-Records

[github-actions]

Hi @Suman2795, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

[Suman2795]

Availability: weekend
ETA:7th oct 2022

[github-actions]

@Suman2795

Please add update using the below template (even if you have a pull request). Afterwards, remove the 'To Update !' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the developer meeting discussion column and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel.

_{You are receiving this comment because your last comment was before Monday, November 7, 2022 at 11:21 PM PST.}

[Suman2795]

progress: filling the issue template ,will complete soon.

[blulady]

Hey Suman we chatted about this yesterday but I forgot to ask you to link this issue on that issue when you create it.

[Suman2795]

I will link the issue. Thanks Sarah!

[github-actions]

@Suman2795

Please add update using the below template (even if you have a pull request). Afterwards, remove the 'To Update !' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the developer meeting discussion column and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel.

_{You are receiving this comment because your last comment was before Monday, January 9, 2023 at 11:16 PM PST.}

[ExperimentsInHonesty]

@Suman2795 The website team has been back from break since Jan 3rd, but we have not had an update from you. Are you still working on this issue? If you are not, please let us know so that we can return it to the queue. If you are working on it, please provide an update as requested above.

[Suman2795]

The decision record for this issue:
https://github.com/hackforla/website/wiki/DR:Using-Dependabot-to-update-GHA

[github-actions]

@Suman2795

Please add update using the below template (even if you have a pull request). Afterwards, remove the 'To Update !' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the developer meeting discussion column and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel.

_{You are receiving this comment because your last comment was before Monday, January 23, 2023 at 11:16 PM PST.}

[github-actions]

@Suman2795

Please add update using the below template (even if you have a pull request). Afterwards, remove the 'To Update !' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the developer meeting discussion column and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel.

_{You are receiving this comment because your last comment was before Monday, January 30, 2023 at 11:17 PM PST.}

[ExperimentsInHonesty]

@Suman2795 Looks like you need to ask for a review from the Merge team for this issue. Please ask them at a meeting or in the slack channel.

[ExperimentsInHonesty]

Hi @suman did you get a review from anyone on this wiki you have written

The decision record for this issue:
https://github.com/hackforla/website/wiki/DR:Using-Dependabot-to-update-GHA

Please message the @hackforla/website-merge team on your response

[Suman2795]

Hi @ExperimentsInHonesty, I apologize for not updating earlier but I had the decision record and the new issue that needed to be created in this issue reviewed from Sarah , she had said that she would close the issue and I will message her again for this.

[blulady]

Sorry for the delay!! Closing this issue with the decision record and the issue . Great Job @Suman2795