Skip to content
GG Docs

CI info

.github/workflows/main.yml

  • Directory.github/
    • Directoryworkflows/
      • main.yml
    • dependabot.yml

The ‘main.yml’ github action is triggered on every push to the repo. It builds the project and conditionally runs the related Sonarqube scans depending on if any files have changed. See more here for how that works Source helper.

Dependabot

Dependabot runs every workday in the morning. It checks for any dependency updates and creates a PR if it finds any. It also checks for any security vulnerabilities and creates a PR if it finds any.

Updates are then manually reviewed and merged in the following order:

  1. Security updates (Any change to Dependabot or CodeQL github-actions counts as a security update).
  2. Breaking updates.
  3. Non-breaking ‘github-actions’ updates.
  4. Non-breaking ‘dependency’ updates.
  5. Non-breaking ‘devDependency’ updates.

If after merging a PR a Dependabot PR has a conflict, Dependabot will automatically update the PR with the latest changes and rebase it. This can take a few minutes. To see the progress of these updates they can be found here.

CI secrets

Dependabot doesn’t get access to repo secrets to be able to deploy the various web projects after a dependency changes. These secrets are duplicated here.

Tokens and Certificates

Most project certificates automatically renew themselves. However the cloudflare tokens to deploy need updating every 90 days. On a solo project like this it isn’t really necessary, but just a good habit to keep.