Create dependabot.yml file for dependabot to create pull requests

[Suman2795]

Overview

GH Dependabot has been enabled to issue alerts for vulnerabilities and security. Therefore we need a configuration file, dependabot.yml, to create pull requests so that we maintain up to date security in our repo.

Action Items

• Read configure dependabot.yml
• Read Create decision record for Using Dependabot to update GHA #3598 to understand HfLA's decision for implementing dependabot
  • See associated Decision Record for Dependabot
• Create a dependabot.yml file in the .github and configure the file as per the instructions given in 1st link

Resources/Instructions

• Enabling Dependabot Version Updates
• Configuration Options for Dependabot.yml file
• ER for Decision Record: Create decision record for Using Dependabot to update GHA #3598
• Decision Record for Dependabot
• See previous work done here: my other branch was having a lot of git issues so I made a new branch #4102

[github-actions]

Hi @one2code, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

[one2code]

Availability: 11 AM - 5PM EST on 4/20/23, 1-4 PM EST on 4/21/23, and available to answer questions at various times between 8 PM -4 AM between 4/21/23 - 4/23/23
ETA: 4/26/23

[one2code]

Progress: Reviewed relevant documentation and began creating the config file on a new branch
Blockers: Understanding how to create the dependabot.yml, without having admin access in settings to automatically configure the dependabot as show in fig.1 . I reviewed relevant .yml files in the workflows directory to develop a deeper understanding of how to configure the dependabot.
Availability: 4/29/23-4/30/23 afternoon.
ETA: 4/30/23

[one2code]

Progress: Created the Dependabot.yml file based on the package managers listed in the package.json/lock file, and enabled version and security updates on my fork
Blockers: Having trouble testing it to verify that it works correctly. Need some guidance.
Availability: 5/5/23 Available 5-10pm EST. Then available to answer private messages on Slack (Travis) at various times throughout the weekend. Will be able to implement recommendations for testing during the evenings on the weekend, and will have all day available on 5/9/23 if need be.
ETA: 5/9/23

[one2code]

Progress: The Dependabot configuration file is now being read, as determined in insights>dependency graph>dependabot

Blockers: Difficulty in testing Github Actions without merging (create-dependabot.yml#3843 not found). Trying to find a way to test on a different branch. Tried changing the target-branch to "/", same issue persists. The npm package manifest is also not located in root, which will have to be resolved later.

Availability: Afternoon 5/10/23, evening 5/12/23, and afternoon 5/13 + 5/14 EST

ETA: 5/14/23

[blulady]

@one2code So it looks like we did do it correctly. It looks like Github no longer creates a public PR but sends an email instead. So check your emails...

[blulady]

@one2code So it looks like we did do it correctly. It looks like Github no longer creates a public PR but sends an email instead. So check your emails...

Actually it did create pr's in my repo...

[t-will-gillis]

PR 4733 associated with this issue has been merged.