Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: add dependabot #236

Closed
wants to merge 4 commits into from
Closed

ci: add dependabot #236

wants to merge 4 commits into from

Conversation

k1lgor
Copy link

@k1lgor k1lgor commented Jun 24, 2023

Initial discussions

Types of changes

What types of changes does your code introduce?
Put an x in the boxes that apply

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Test (add, remove, modify test(s))
  • Other

What I did

Add dependabot to check on daily basis
and resolves #225

Dependabot needs to be enabled from the Security tab as well
image

How I did it

I am not sure about

How I tested

I'm not a dummy, so I've checked these

  • 📑 I documented correctly following our guidelines
  • 💯 I tested locally and it is working
  • 🟢 My code does not fail neither code linting checks nor unit test.

Thank you!

@k1lgor k1lgor requested a review from Minipada as a code owner June 24, 2023 19:00
@k1lgor k1lgor changed the title ci: add dependabot #225 ci: add dependabot Jun 24, 2023
Signed-off-by: Plamen Ivanov <[email protected]>
@Minipada
Copy link
Owner

Hi @k1lgor !
Thanks for your pr!

I have some questions. This repo both uses poetry and requirements.txt and requirements-dev.txt and I would like all to be handled. Is it possible with dependabot?

@k1lgor
Copy link
Author

k1lgor commented Jun 25, 2023

Hi @Minipada.
So basically package-ecosystem must update and poetry packages as well. Here is some example from other repo which uses only poetry.
About the two req.txt files it could be done like this:

version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    security:
      open-pull-requests-limit: 5
    path-filters:
      - path: "requirements.txt"
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    security:
      open-pull-requests-limit: 5
    path-filters:
      - path: "requirements-dev.txt"

and I can add a check for gh actions as well.

@k1lgor
Copy link
Author

k1lgor commented Jun 25, 2023

if this didn't work, we could change it to package-ecosystem: "poetry"

@Minipada
Copy link
Owner

Yes please, if you could check for both poetry and pip for dependabot along with dev environment, it would be great. If not possible, i will investigate, maybe I drop the requirements.txt ...

@k1lgor
Copy link
Author

k1lgor commented Jun 25, 2023

As per official documentation
image
poetry is covered when package-ecosystem is set to pip and the interval could be weekly, or monthly as well.

version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    security:
      open-pull-requests-limit: 5
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
    security:
      open-pull-requests-limit: 5

Signed-off-by: Plamen Ivanov <[email protected]>
Signed-off-by: Plamen Ivanov <[email protected]>
@k1lgor
Copy link
Author

k1lgor commented Sep 17, 2023

close due to inactivity from owner

@k1lgor k1lgor closed this Sep 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Set dependabot to make PR automatically, which update pyproject based on security alerts
2 participants