Bringing supply chain security features to the Go community

Re:Bringing supply chain security features to the Go community by newman314 on Friday July 23, 2021 @11:58AM (#27932152)

While we are on the feedback train, please consider making the Docker dependabot action more intelligent.

Right now, I have a monorepo with multiple Dockerfiles in subdirectories.

I end up having to add an entire docker block scoped to each directory that has a Dockerfile which is painful. Ideally, I would have a way to specify using */Dockerfile as a way to scan for Docker dependencies.

Also, multi-stage Dockerfile configs seem to confuse Dependabot where it'll submit a pull request to update the "AS build" but not the image to be used for packaging...

I really like the promise/premise of Dependabot, just want it to be easier to use (and edit across multiple repos).

[ Parent | on HN ]

Re:Bringing supply chain security features to the Go community by asciimike on Monday July 26, 2021 @01:06PM (#27961979)

> I end up having to add an entire docker block scoped to each directory that has a Dockerfile which is painful. Ideally, I would have a way to specify using */Dockerfile as a way to scan for Docker dependencies.

Glob syntax in `directory` would be sufficient, yes?

[ Parent | on HN ]

Re:Bringing supply chain security features to the Go community by newman314 on Monday July 26, 2021 @06:29PM (#27966270)

It's unclear if you are saying if that already works but yes that would be sufficient. =D

[ Parent | on HN ]

Re:Bringing supply chain security features to the Go community by asciimike on Tuesday July 27, 2021 @02:07AM (#27969164)

It doesn't, and was meant as a question

[ Parent | on HN ]

Re:Bringing supply chain security features to the Go community by newman314 on Tuesday July 27, 2021 @03:12AM (#27969522)

In that case, yes, glob syntax would work well.

[ Parent | on HN ]