From 4a935ad990a1aa07f2e668c3bd44380f9d118926 Mon Sep 17 00:00:00 2001 From: pmady Date: Fri, 26 Dec 2025 15:05:59 -0600 Subject: [PATCH] Add Dependabot configuration for automated dependency updates Add dependabot.yml to enable automated dependency updates for: - GitHub Actions workflows (weekly) - Python pip packages (weekly) This follows OpenSSF Best Practices Badge recommendations and is part of the Step Security hardening measures. Part of #2035 Signed-off-by: pmady --- .github/dependabot.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..f8e1c539c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: BSD-3-Clause +# Copyright Contributors to the OpenColorIO Project. + +version: 2 + +updates: + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly"