github dependabot configuration and simple demo

Github dependabot scans your repository for dependencies that are outdated, vulnerable package, run tests automatically and can even auto-merge if it is safe to do so. 

It is different from CodeQL or CQL where CQL would do security code scanning for coding and vulnearabilities. 

How to enable dependabot? 

Goto your repository -> Settings -> Advanced Security -> under the tab Dependabot and then turn it on.

To enable your package malware alerts, you can click on the "Dependabot rules" and then you will see this layout here where you can enable it by clicking on the "pencil" button.

When will you get the scan results? 

You typically get the scan results minutes. 

In my repo here, https://github.com/kepungnzai/dotnet-dependabot-test - we have old and vulnerable packages and then dependabot come back with a PR for me which looks something like this - which is amazing!