Configuration file is documented at https://docs.github.com/en/code-security/supply-chain-security/enabling-and-disabling-version-updates
link2xt