Updated Dependabot to look at GHA, Pants Python, and NPM deps #22771
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,20 +1,86 @@ | ||
| # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference | ||
|
|
||
| version: 2 | ||
| updates: | ||
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "monthly" | ||
| groups: | ||
| gha-deps: | ||
| patterns: | ||
| - "*" | ||
|
|
||
| - package-ecosystem: "cargo" | ||
| directory: "/src/rust" | ||
| groups: | ||
| rust-security-updates: | ||
| applies-to: security-updates | ||
| patterns: | ||
| - "*" | ||
| update-types: | ||
| - "minor" | ||
| - "patch" | ||
| rust-version-updates: | ||
| applies-to: version-updates | ||
| patterns: | ||
| - "*" | ||
| labels: | ||
| - "category:internal" | ||
|
Member
Author
There was a problem hiding this comment. Unnecessarily specific - implies there is currently a reason for precisely this, which isn't the case at the moment. |
||
| - "dependencies" | ||
| - "release-notes:not-required" | ||
| reviewers: | ||
|
Member
Author
There was a problem hiding this comment. Only have default reviewers for Rust, as I don't want to hammer everyone with updates |
||
| - benjyw | ||
| - cburroughs | ||
| - huonw | ||
| - sureshjoshi | ||
| - tdyas | ||
| - tgolsson | ||
| schedule: | ||
| interval: "weekly" | ||
|
|
||
| - package-ecosystem: pip | ||
| directory: "/3rdparty/python" | ||
| groups: | ||
| python-security-updates: | ||
| applies-to: security-updates | ||
|
Contributor
There was a problem hiding this comment. What does this do? Is it intended to just be things with an CVE? (The screenshot looked like a wider net)
Member
Author
There was a problem hiding this comment. Yeah, so, what I'm trying to get setup is to split out security-only updates from general version updates. So far, it doesn't seem to be working - but that might be a result of issues being so out of date that any security update is necessarily a version update - and it gets captured there. I won't really know until this lands and we watch it for a few iterations to see how it plays out over time.
Member
Author
There was a problem hiding this comment. Spirit being, security updates are more urgent, generally fewer breaking changes, and overall quicker to land |
||
| patterns: | ||
| - "*" | ||
| update-types: | ||
| - "minor" | ||
| - "patch" | ||
| python-version-updates: | ||
| applies-to: version-updates | ||
| patterns: | ||
| - "*" | ||
| labels: | ||
| - "category:internal" | ||
| - "dependencies" | ||
| - "release-notes:not-required" | ||
| schedule: | ||
| interval: weekly | ||
|
|
||
| - package-ecosystem: "npm" | ||
| directories: | ||
| - "build-support/**/*" | ||
| - "src/python/pants/backend/javascript/**/*" | ||
| - "src/python/pants/backend/typescript/**/*" | ||
| - "testprojects/src/js/**/*" | ||
| groups: | ||
| js-security-updates: | ||
| applies-to: security-updates | ||
| patterns: | ||
| - "*" | ||
| update-types: | ||
| - "minor" | ||
| - "patch" | ||
| js-version-updates: | ||
| applies-to: version-updates | ||
| patterns: | ||
| - "*" | ||
| labels: | ||
| - "category:internal" | ||
| - "dependencies" | ||
| - "release-notes:not-required" | ||
| schedule: | ||
| interval: "weekly" | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hypothetically, this should create 2 PRs - one for security updates (important, but less invasive) - while the generic version updates are more informational and can be skipped or ignored.
Right now, it's just batching everything into version updates