Repository-level dependency management configuration not detected
Looks for a local Dependabot or Renovate configuration file at the repository root without validating its contents.
| Detail | Value |
|---|---|
| Check ID | MISSING_DEPENDENCY_SECURITY_AUTOMATION |
| Severity | Low |
| How it runs | Deterministic scan |
Anchor to How to fixHow to fix
Add a Dependabot or Renovate configuration file at the repository root, or verify existing coverage.
The scan looks for .github/dependabot.yml, renovate.json, and the other conventional Renovate filenames, including the .github/, .gitlab/, and .renovaterc variants. It reads the filename only: a file that's present but misconfigured, disabled, or scoped to a directory your app doesn't live in still passes.
.github/dependabot.yml
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 10
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?