add a dependabot config to automate vendoring #9748
Conversation
openshift-ci-robot
added
the
approved
|
Let's do this for the other projects as well. |
|
Will it also sign its commits? That's another one we noticed |
Yes, this bug should be fixed on their side. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: saschagrunert, vrothberg The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
While dependabot has turned out great to automate updating dependencies, a major painpoint was that we had to manually run `make vendor` for each and every commit. It was causing noise. Adding the config file to `.github/dependabot.yml` will take of also updating the `./vendor` tree. `containers/common` is using this config for a while successfully. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <[email protected]>
vrothberg
force-pushed
the
lazy-vendoring
branch
from
560abe8 to
1ca74b0
Compare
| directory: "/" | ||
| schedule: | ||
| interval: daily | ||
| open-pull-requests-limit: 10 |
There was a problem hiding this comment.
Not that we probably would, but what happens if we get 12 updates? Do the last two get queued up for "by hand" submission? Or am I misinterpreting this? If I'm on, I think I'd feel more comfortable at 15 or 20.
There was a problem hiding this comment.
That should be scheduled for the next day. @saschagrunert, did you set 10 for a specific reason or was it a gut feeling?
There was a problem hiding this comment.
If there are 10 PRs open Dependabot will not create new ones. I think this is a good amount to avoid spamming the project. :)
There was a problem hiding this comment.
Thanks @saschagrunert . So if it doesn't create number 11 and 12, is a notification sent out or will it just do those the next day?
|
LGTM |
|
/lgtm |
github-actions
bot
added
the
locked - please file new issue/PR
While dependabot has turned out great to automate updating dependencies,
a major painpoint was that we had to manually run
make vendorfor eachand every commit. It was causing noise.
Adding the config file to
.github/dependabot.ymlwill take of alsoupdating the
./vendortree.containers/commonis using this configfor a while successfully.
Signed-off-by: Valentin Rothberg [email protected]
@saschagrunert @edsantiago @rhatdan PTAL