cncf/clomonitor

Add in updateCLI in check for dependency update tool check

cwayne18 opened this issue · 4 comments

cwayne18 commented

For the dependency update tool check, AFAICS it currently only checks for Dependabot/Renovate, while some projects may be using (updateCLI)[https://updatecli.io/] to do the same kind of automation. Could it make sense to check for updateCLI configs as well?

tegioz commented

Hi @cwayne18 👋

Yes, that makes sense. CLOMonitor relies on OpenSSF Scorecard for this check, so it'd be great if this was implemented upstream. Otherwise we can extend that check on our end, that'd be another option. BTW they also support Sonatype Lift and PyUp, we need to update our docs 😉

cwayne18 commented

Aha yes, somehow I knew but completely had forgotten this would need to go upstream sorry! 🤦

  • 👍1
caniszczyk commented
tegioz commented

Will close this one for now, please feel free to reopen if needed 🙂