Add dependabot config #210
Conversation
kolyshkin
requested review from
mrunalp,
rhatdan,
runcom and
thaJeztah
as code owners
|
LGTM, another thread I would like to start is enabling rubberstamp approvals and auto-merge automation for minor dependency updates. Dependabot can create quite a few PRs and overwhelm maintainers. I can try a proof of concept and propose a mechanism separately from this. Perhaps we can start with selinux and if successful apply the mechanism to other projects? cc: @kolyshkin @rhatdan wdyt? |
.github/dependabot.yml
Outdated
| version: 2 | ||
| updates: | ||
| # Dependencies listed in go.mod | ||
| - package-ecosystem: "gomod" |
There was a problem hiding this comment.
With this repository being a library, I don't think we need to update module versions, unless there's a critical reason for it in the call path. Doing so would violate go modules MVS (which requires lowest version to be specified)
There was a problem hiding this comment.
Right. I'll remove this.
(Wonder what to do about other repos such as runc, which is a library and a binary at the same time)
There was a problem hiding this comment.
Yeah, those can be the tricky ones. I think currently it's probably OK (we update main, but not release branches), although we could be more conservative if the updates we pull in bring no changes to code used in runc itself
This way it can create PRs to update github workflow rules deps. Signed-off-by: Kir Kolyshkin <[email protected]>
Not a big deal for this repo, as we don't have lots of dependencies and we don't require 2 LGTMs here, so any single maintainer can merge. OTOH I'd love some automation for github.com/opencontainers/runc (which requires two LGTMs, while we can easily do with just one for dependabot and other simple PRs, but I don't know how to do that). |
thaJeztah
left a comment
thaJeztah
left a comment
There was a problem hiding this comment.
LGTM
updating actions sounds good to me, and shouldn't hurt. Let's see if the "daily" works well
|
LGTM |
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.11.0` -> `v1.12.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>opencontainers/selinux (github.com/opencontainers/selinux)</summary> ### [`v1.12.0`](https://github.com/opencontainers/selinux/releases/tag/v1.12.0) [Compare Source](opencontainers/selinux@v1.11.1...v1.12.0) This release removes deprecated functions from the `label` package, and improves documentation and error reporting of `SetCreateKey`. #### What's Changed - VERSION: remove by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#217 - CI: add AlmaLinux 8, CentOS Stream 9, and Fedora by [@​AkihiroSuda](https://github.com/AkihiroSuda) in opencontainers/selinux#221 - ci: install git-core by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#224 - CI: add openSUSE Tumbleweed by [@​AkihiroSuda](https://github.com/AkihiroSuda) in opencontainers/selinux#223 - Bump Go version, deps, fix some linter issues... by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#218 - label: remove deprecated stuff by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#228 - Improve SetKeyCreate error reporting, fix test flakes by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#227 **Full Changelog**: opencontainers/selinux@v1.11.1...v1.12.0 ### [`v1.11.1`](https://github.com/opencontainers/selinux/releases/tag/v1.11.1) [Compare Source](opencontainers/selinux@v1.11.0...v1.11.1) #### What's Changed - Bump to v1.11.0 by [@​rhatdan](https://github.com/rhatdan) in opencontainers/selinux#197 - fix some error by [@​ningmingxiao](https://github.com/ningmingxiao) in opencontainers/selinux#200 - ci: update Go 1.21 support by [@​michalbiesek](https://github.com/michalbiesek) in opencontainers/selinux#202 - Extend `build-cross` target with `riscv64` arch by [@​michalbiesek](https://github.com/michalbiesek) in opencontainers/selinux#201 - Remove nolint annotations for unix errno comparisons by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#203 - ci: bump some actions by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#205 - Misc nitpicks by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#206 - pwalk, pwalkdir: fix walk vs remove race by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#204 - Update GitHub Actions CI Go matrix for Go v1.22 by [@​austinvazquez](https://github.com/austinvazquez) in opencontainers/selinux#209 - Update GitHub Actions packages to resolve deprecation warnings. by [@​austinvazquez](https://github.com/austinvazquez) in opencontainers/selinux#208 - Add dependabot config by [@​kolyshkin](https://github.com/kolyshkin) in opencontainers/selinux#210 - build(deps): bump tim-actions/get-pr-commits from 1.3.0 to 1.3.1 by [@​dependabot](https://github.com/dependabot) in opencontainers/selinux#211 - build(deps): bump golangci/golangci-lint-action from 4 to 6 by [@​dependabot](https://github.com/dependabot) in opencontainers/selinux#213 - Show SELinux label on failure by [@​rhatdan](https://github.com/rhatdan) in opencontainers/selinux#216 #### New Contributors - [@​ningmingxiao](https://github.com/ningmingxiao) made their first contribution in opencontainers/selinux#200 - [@​michalbiesek](https://github.com/michalbiesek) made their first contribution in opencontainers/selinux#202 - [@​dependabot](https://github.com/dependabot) made their first contribution in opencontainers/selinux#211 **Full Changelog**: opencontainers/selinux@v1.11.0...v1.11.1 </details> --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/801 Reviewed-by: earl-warren <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>
4 participants
This way it can create PRs to update various dependencies (in Go modules and github workflow rules).
Cc @rhatdan