Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Autobumper and dependabot config auto update #10112

Open
5 tasks
dekiel opened this issue Mar 12, 2024 · 0 comments
Open
5 tasks

Autobumper and dependabot config auto update #10112

dekiel opened this issue Mar 12, 2024 · 0 comments
Labels
area/ci Issues or PRs related to CI related topics

Comments

@dekiel
Copy link
Contributor

dekiel commented Mar 12, 2024

Description

Dependabot and autobumper are two tools we are using to automatically maintain up to date dependencies and lower reported CVEs in test-infra repository. Both tools are configured using config files stored in test-infra repo. These files must contain up to date configuration to let the tools update dependencies in all files. Process of updating tools configuration to reflect changes in test-infra repository must run in automated way to minimise latency.

Alternative approach to solve this problem is to use the tools with capability of automatic detection of files for dependency update.

Reasons

Manual, configuration update for dependabot and autobumper doesn't happen with acceptable frequency. Additionally, manual process is prone to the errors and unnecessary delays. This leads to usage of old and vulnerable images, libraries and tools. This situation is causing increased amount of CVEs detected for our software.

Acceptance Criteria

  • Dockerfiles dependencies are automatically updated in all files.
  • All OCI image versions are automatically updated when new versions is available.
  • All GitHub actions used in workflows are using newest versions.
  • Golang dependencies are updated for all modules existing in a repo.
  • Python dependencies are updated fro all modules existing in a repo.
@dekiel dekiel added the area/ci Issues or PRs related to CI related topics label Mar 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/ci Issues or PRs related to CI related topics
Projects
None yet
Development

No branches or pull requests

1 participant