GitHub · GH-500
Dependency review and Dependabot configuration
GH-500 · Lesson 9 of 16 · 1:08:02
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: dependency review in pull requests, the dependency review action and its options for severity, scopes, and licenses, enforcing it with rulesets, version updates in dependabot.yml with groups, ignore rules, and cooldowns, permissions and alert assignment, and workflows, notifications, webhooks, and the REST API. Includes three original practice questions.
Preview the topics
- Contoso’s legal team wants every pull request that adds a dependency under a license outside an approved list to fail before merging. Which option should the dependency review action use?
- Contoso’s release managers need to view and dismiss Dependabot alerts in the payments repositories, but must not push code. What should an owner give them?
- Contoso wants a ticket opened in its service desk every time a new Dependabot alert appears, within seconds, without polling. What should the integration use?