4 ms·
I think GitHub will do this for you now: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configur
by jzelinskie 5y ago
I think GitHub will do this for you now: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#package-ecosystem https://docs.github.com/en/code-security/supply-chain-securi...
- slimslenders 5y agoYa, it's similar. We needed to add an initial pinning PR, a vulnerability and change log comparison, and scanning for unsupported tags. We also added support for private registries so that we could use the same pattern for non-official images. But the inspiration came from Official image repositories.