[Improve Existing Best Practice Guide]: Validating software dependencies (CT starter kit) using dependabot

[jpl-jengelke]

Checked for duplicates

Yes - I've already checked

Describe the needs

This is intended for the Continuous Testing Starter Kit.

It's desirable for OSS publishers to implement automatic security and bug scanning of software dependencies used within their repo. This SK will provide a guide on implementing basic dependabot checking for a software project with configurable options. It's GitHub Actions-based process that will be helped with a simple template.

[riverma]

Hi @jpl-jengelke - this is pretty interesting - is using dependabot free? The GitHub security page seems to imply this is a paid service? If so - a stand-alone GitHub action workflow file to add it to a given repo would be super useful, along with integration of this into your slim-starterkit-python and other repos. Probably very light overview of the dependabot solution as well as links to existing docs.

[jpl-jengelke]

The implementations I have used are all no cost.

[riverma]

That's great to hear @jpl-jengelke

[riverma]

Oh by the way, @jpl-jengelke can you please add labels to this ticket? Looking for the complexity level and the level of interest (requests) for this from the community. For the latter, we have one team interested in dependency management, and that's Unity. So at the least we can state "requested" until we check in with them for more. Also the category - which is likely "software lifecycle".

[riverma]

@jpl-jengelke - is this ticket complete? Please close if so.

[jpl-jengelke]

Closing as this has been published.