Dependabot helps us keep things up to date

• Dependabot is known for updating your app dependencies
• But it can also be configured via YAML to update GH Action versions
• You likely want it to check monthly or weekly

# .github/dependabot.yml in every repo with GHAs
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

You can do this in the extra credit slides later

• It supports updating your repos for lots of package ecosystems (full list)
• It can update your Dockerfile FROM base image versions
• It can update image versions in Kubernetes manifests & Helm charts

Concurrency limits can save you money

• Avoid multiple commits in the same branch/PR from running at the same time

• Add this at workflow level, before jobs, in every workflow

# cancel any previously-started, yet still active runs of this workflow on the same branch
concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

You can do this in the extra credit slides later

Workflow design and parallelization

• Generally, one workflow per purpose (build and test image, lint code, deploy)
• Jobs are isolated from each other on different runners
• Jobs run in parallel by default, but:
• Jobs can depend on each other to control order
• Workflows can depend on another one finishing, or call another workflow directly
• It’s OK to only have one job per workflow
• ProTip: Creating a Matrix can simplify parallel testing (split up testing, or test on multiple OSes)
• If your job has dependency services, use service containers or Docker Compose
• Service containers are simpler. Docker Compose means you can easily reuse locally
• Over time, optimize for speed (parallelization) and cost (less minutes). It’s a balance
• Reusable workflows (Wednesday!) will greatly affect your workflow design