Problem: The Dependabot configuration monitors Cargo and GitHub Actions dependencies but does not track Docker base image updates. Stale base images in the Dockerfile can accumulate unpatched vulnerabilities. Solution: Add a Docker package-ecosystem entry to dependabot.yml that proposes weekly base image updates, grouped by minor/patch, with a 3-PR concurrency limit. Labels (ci, dependencies) match the existing GitHub Actions ecosystem entry for consistent triage routing. Testing: Validated YAML syntax. Dependabot will activate automatically on the next scheduled scan after merge. Ref: zeroclaw-labs/zeroclaw#618 (item 1 — Dependency Update Automation) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| codeql | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| actionlint.yaml | ||
| CODEOWNERS | ||
| dependabot.yml | ||
| label-policy.json | ||
| labeler.yml | ||
| pull_request_template.md | ||