Skip to content

Commit

Permalink
Update to X in STEP and README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
github-actions[bot] committed Dec 18, 2024
1 parent cd2a790 commit 0889ebb
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 44 deletions.
2 changes: 1 addition & 1 deletion .github/steps/-step.txt
Original file line number Diff line number Diff line change
@@ -1 +1 @@
4
X
71 changes: 28 additions & 43 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,49 +13,34 @@ _Secure your supply chain, understand dependencies in your environment, know abo

</header>

## Step 4: Enable and trigger Dependabot version updates

_Nicely done!_ :partying_face:

You now have automated the process for Dependabot to alert you to vulnerabilities with your dependencies and to create pull requests to update them to secure versions! At this point, you only need to review the pull request and then merge it to stay on top of security problems with Dependencies.

The security updates feature helps automate the process to resolve alerts, but what about just keeping up-to-date with version updates? We can also automate pull request generation for updated versions of dependencies using the Dependabot version updates feature.

**What are Dependabot version updates?**: In addition to security alerts, Dependabot can also take the effort out of maintaining your dependencies. You can use it to ensure that your repository automatically keeps up with the latest releases of the packages and applications it depends on. Similar to security alerts, Dependabot will identify an outdated dependency and create a pull request to update the manifest to the latest version of the dependency.

Let's see how this works!

### :keyboard: Activity 4.1: Enable and trigger Dependabot version updates

1. Navigate to the **Settings** tab and select **Code security and analysis**.
1. Locate "Dependabot version updates" and click **Configure** to open a new file editor with pre-poplulated contents. The file is called `dependabot.yml`.
1. Notice that the file is prepopulated to update the GitHub actions in the repository, the `github-actions` package ecosystem.
1. Copy the lines that define the GitHub actions updates and append them to the file.
1. Edit your copy of the content:
- Change the `package-ecosystem` to `nuget`.
- Change the `directory` to `/code/`.
- Change the `interval` to `weekly`.

The `dependabot.yml` file should now look like this.
```yaml
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "monthly"
- package-ecosystem: "nuget"
directory: "/code/"
schedule:
interval: "weekly"
```
1. Commit your changes directly to the `main` branch.

You have now configured Dependabot version updates to run and check for updates as follows:
- Check once a month for updates to GitHub Actions and create pull requests to update any that are out of date.
- Check once a week for updates to .NET packages and create pull requests to update any that are out of date. By default, this check runs on a Monday, to run the check on a different day, see [schedule.day](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleday).

Wait about 20 seconds then refresh this page (the one you're following instructions from). [GitHub Actions](https://docs.github.com/en/actions) will automatically update to display the next step.
## Finish

_Congratulations friend, you've completed this course!_

<img src="https://octodex.github.com/images/welcometocat.png" alt=celebrate width=300 align=right>

Here's a recap of all the tasks you've accomplished in your repository:

- You've learned how to view and use dependency graph.
- You've learned how to enable and use Dependabot alerts.
- You've learned how to enable and use Dependabot security updates.
- You've learned how to enable and use Dependabot version updates.

### Additional learning and resources

- [Dependency graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)
- [Exploring the dependencies of a repository](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository)
- [About supply chain security](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security)
- [Dependabot alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts)
- [GitHub Advisory Database](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/browsing-security-advisories-in-the-github-advisory-database)

### What's next?

- Learn more about securing your supply chain by reading: [Securing your supply chain](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security).
- [We'd love to hear what you thought of this course](https://github.com/skills/.github/discussions).
- [Learn another GitHub skill](https://github.com/skills).
- [Read the Get started with GitHub docs](https://docs.github.com/en/get-started).
- To find projects to contribute to, check out [GitHub Explore](https://github.com/explore).

<footer>

Expand Down

0 comments on commit 0889ebb

Please sign in to comment.