Create dependabot.yml

[MIchaelMainer]

Part of component governance review

[peombwa]

Thanks for surfacing this! To avoid PowerShell assembly dependency conflicts, we will need to investigate how this can be safely used with our assembly resolver.

[MIchaelMainer]

Interesting. As it is currently, the automated use of dependabot would then trigger manual changes to the PowerShell Assembly Load Context every time a dependency is out of date, correct?

We can also consider using Component Governance task in AzDO.

[peombwa]

That's right! It looks like we will need a post dependabot script to ensure dependencies are also updated in the PowerShell Assembly Load Context. I can look into this.

[MIchaelMainer]

Required reading for this work item.

https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

[baywet]

closing since this was added through another PR

msgraph-sdk-powershell/.github/dependabot.yml

Line 1 in a96b772

version: 2