Skip to content

pre-commit template missing dependabot.yml #270

Description

@ukmo-ccbunney

The pre-commit configuration template does not check the .github/.dependabot.yml file.

This became apparent when the zizmor hook did not pick up a missing cooldown period in the .dependabot.yml file for Iris, but it does flag a warning when zizmor is run independently via the command line.

It aught to be throwing this warning when run against the Iris repo:

warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
 --> .github/dependabot.yml:8:5
  |
8 |   - package-ecosystem: "github-actions"
  |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
  |

See https://docs.zizmor.sh/audits/#dependabot-cooldown

This is due to an overly restrictive set of file filters at the top of the .pre-commit-config.yml:

# Alphabetised, for lack of a better order.
files: |
(?x)(
.github\/workflows\/.*|
benchmarks\/.+\.py|
docs\/.+\.py|
lib\/.+\.py|
noxfile\.py|
pyproject\.toml|
setup\.py|
src\/.+\.py
)

We could either:

  • relax the glob at line 16 to .github/*
  • explicitly add .github/dependabot.yml

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions