Update

Author: Måns Thörnvik

.github/dependabot.yml

@@ -1,11 +1,50 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
 version: 2
+
 updates:
-  - package-ecosystem: "actions" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: gomod
+    directory: /sample-go-app
+    schedule:
+      interval: weekly
+    groups:
+      minor:
+        update-types:
+          - minor
+      patches:
+        update-types:
+          - patch
+
+  - package-ecosystem: pip
+    directory: /sample-py-app
+    schedule:
+      interval: weekly
+    groups:
+      minor:
+        update-types:
+          - minor
+      patches:
+        update-types:
+          - patch
+
+  - package-ecosystem: docker
+    directory: /sample-go-app
+    schedule:
+      interval: weekly
+    groups:
+      minor:
+        update-types:
+          - minor
+      patches:
+        update-types:
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
-      interval: "weekly"
+      interval: weekly
+    groups:
+      minor:
+        update-types:
+          - minor
+      patches:
+        update-types:
+          - patch

.github/workflows/go.yaml

@@ -5,6 +5,7 @@ on:
 
 permissions:
   contents: read
+  security-events: write
 
 jobs:
   build:
@@ -46,6 +47,13 @@ jobs:
         with:
           version: v2.12.0
           working-directory: sample-go-app
+          args: --output.sarif.path=results.sarif
+
+      - name: Upload SARIF report
+        if: always() && matrix.go-version-alias == 'stable'
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: sample-go-app/results.sarif
 
       - name: Install dependencies
         run: go mod download

.github/workflows/main.yaml

@@ -10,6 +10,7 @@ on:
 permissions:
   contents: read
   packages: write
+  security-events: write
 
 jobs:
   go:

.github/workflows/pull-request.yaml

@@ -10,6 +10,7 @@ on:
 permissions:
   contents: read
   packages: write
+  security-events: write
 
 jobs:
   go: