Closed
Description
Dockerfile updates can be handled by dependabot automatically. Only minor versions bump should be allowed to automatically merge. Security checks can run in nightly builds using https://github.com/aquasecurity/trivy-action which we already use to check security issues in our docker images (now checked manually).
Dependabot example for dockerfile updates: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates
Activity