mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-22 01:13:00 +02:00
Joachim Wiberg
a365238854
Add govulncheck CI and Dependabot for the two Go modules, src/webui and src/netbrowse, so vendored dependencies don't quietly accumulate CVEs between manual updates. The workflow reports every finding in the run summary but only fails on vulnerabilities our code actually calls in a dependency. Called stdlib vulnerabilities are surfaced too, but they're fixed by bumping the Buildroot host Go rather than a module's go.mod, so they don't gate the build. Dependabot ignores openconfig/goyang: it's pinned to our kernelkit fork via a replace directive and stepped by hand. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
16 lines
426 B
YAML
16 lines
426 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: gomod
|
|
directory: /src/webui
|
|
schedule:
|
|
interval: weekly
|
|
# goyang is pinned to our kernelkit fork via a replace directive and
|
|
# stepped by hand when we add patches; leave it for Dependabot to ignore.
|
|
ignore:
|
|
- dependency-name: github.com/openconfig/goyang
|
|
|
|
- package-ecosystem: gomod
|
|
directory: /src/netbrowse
|
|
schedule:
|
|
interval: weekly
|