allow excluding orgs/actions from pinning

[raboof]

In some contexts, all versions of the actions from certain orgs (such as https://github.com/actions/ or the projects' own org) are trusted. In such a scenario, the value of pinning is less obvious compared to 3rd-party repo's (and should be weighed against the additional dependabot churn). It might be helpful to be able to exclude such orgs from pinning.

[netomi]

I could imagine that we support a config file, e.g. in yaml format that specifies with wildcard what actions to ignore.

[netomi]

Maybe we should honor the configuration as present in the dependabot.yaml of the repo:

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/controlling-dependencies-updated

There is support for ignoring dependencies.

[raboof]

Maybe we should honor the configuration as present in the dependabot.yaml of the repo:

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/controlling-dependencies-updated

There is support for ignoring dependencies.

I like the idea, but for example for the SLSA case you mentioned you might still want dependabot to upgrade the tags even if you don't want octopin to convert it to a hash, right? You might have similar situations here?

[netomi]

hmm indeed, the ignore should only be taken into account for the pinning, updates shall work normally.

So we need to come up with our own format ...