validate dependabot configuration

[geekosaur]

Borrowed from Ubuntu
(ubuntu/authd@3f9df8f)

Sadly, this won't check our existing config unless I make a dummy update.

Template B: This PR does not modify behaviour or interface

E.g. the PR only touches documentation or tests, does refactorings, etc.

Include the following checklist in your PR:

• Patches conform to the coding conventions.
• Is this a PR that fixes CI? If so, it will need to be backported to older cabal release branches (ask maintainers for directions). (only matters on master)

[geekosaur]

Does anyone know what the whitespace check is upset about? I don't see any lines with extra spaces or tabs. (I think.)

[ffaf1]

File not ending with \n?

[geekosaur]

Looks like it.

[geekosaur]

Okay, I've finally got this doing what it should be. The original one wanted extra permissions I couldn't figure out how to grant, but I don't think we want or need what it wanted to do (add/update a comment, on top of the job success/failure indication). I've also verified that it succeeds when it should and fails when it should.

Unfortunately, it's not answering the question that led me to make this PR: why didn't dependabot notify us of the updated actions when it's configured to do so?

[Kleidukos]

cheers

[ulysses4ever]

❤️

[ulysses4ever]

Unfortunately, it's not answering the question that led me to make this PR: why didn't dependabot notify us of the updated actions when it's configured to do so?

Indeed. I hoped something from the relevant settings page may be the reason, but it doesn't look like it https://github.com/haskell/cabal/settings/security_analysis

Quick google search also doesn't bring any insights.