Open mmorel-35 opened 4 months ago
I think I need more context here - why do we need to support Renovate here?
This will help update Bazel and github-actions dependencies . I have an example of the setup on my fork here
With Bzlmod and its Minimum Version Selection, it's actually better to not update dependencies of "library projects" (such as rulesets). That avoids forcing users to upgrade.
It would make sense to test against the latest versions of all deps in CI on a regular basis, but that's not covered by the currently available tooling.
I'd also err on keeping things as they currently are. We are a small project and dependency management hasn't been an issue so far, but too much dependency churn can increase maintenance cost.
You can parametrize the bot to only propose updates for a type of dependencies. So it could be only github-actions for example.
Renovate provides a way to receive pr when a new version is available for a dependency.
Only renovate (vs dependabot) handle bazel dependencies . This setup configuration dor a weekly check with renovate. It requiees to be activated on the project or organisation level to work correctly . See doc to finalize