Conversation
There was a problem hiding this comment.
Code Review
This automated pull request syncs repository templates, and in doing so, removes the Dependabot configuration for GitHub Actions. This will prevent automated updates for actions, which is a potential security and maintenance concern. I've added a high-severity comment to question this change and understand the go-forward strategy for keeping actions up-to-date.
I am having trouble creating individual review comments. Click here to see my feedback.
.github/dependabot.yml (10-19)
Removing the github-actions ecosystem from Dependabot configuration will prevent automated updates for GitHub Actions used in this repository. This can lead to the use of outdated actions with potential security vulnerabilities. Is this change intentional? If so, it would be helpful to understand the new strategy for maintaining action dependencies.
Created by GitHub workflow (source).
Sync with coreos/repo-templates@5d21756.