Dependabot

[davidbieder]

must-have

• bug-fix updates in dependencies result in a branch, PR, PR checks, auto-merge, bug-fix release
• bug-fix updates in devDependencies result in a branch, PR, PR checks, auto-merge, no release
• bug-fix updates in peerDependencies results in no action

should-have

• minor updates in dependencies result in a branch, PR, PR checks, auto-merge, minor release
• minor updates in devDependencies result in a branch, PR, PR checks, auto-merge, no release
• minor updates in peerDependencies results in no action

nice-to-have

• major updates in dependencies result in a branch, PR, PR checks, no auto-merge, major release after manual merge to main
• major updates in devDependencies result in a branch, PR, PR checks, no auto-merge, no release after manual merge to main
• major updates in peerDependencies results in no action, PR, PR checks, no auto-merge, major release after manual merge to main

It's possible that dependabot does not support peer dependencies, that's ok.

Be careful about creating spammy test releases. Consider npm test project based on a copy of the existing project.

[jeromeweiss]

• Dependabot has no configuration to distinguish between minor and patch updates to create custom PRs!
• It's only possible to define a prefix commit message for dependencies and devDependencies.

There are two solutions/ ways to go:

1. We auto-merge all patch and minor updates without a semantic release to the main branch and do not mention dependency updates in the release notes (except manually merged major updates with breaking changes). Next time someone manually releases a new version the dependency updates go live too.

OPTIONAL: We use a general semantic prefix for the commit message (e.g. "build:" or "ci:") and auto-merge all patch and minor dependency updates. This does not release something until someone manually releases a new version.

2. Dependabot can be configured to merge PRs into a separate dependency or release branch. This means the branch could be merged somewhere by manually writing a commit message that is semantic-release confirm (e.g. once a week).

Note: The first solution seems to be how other popular libraries do (e.g. react-testing-library).

[jeromeweiss]

New decision:

• no auto-merge setup right now
• dependencies = prefix "fix:" and devDependencies = prefix "build:" (doesn't matter if minor or patch update)

[jeromeweiss]

No PRs for dependencies with caret will be created. PRs for dependency and dev-dependency updates without caret work as expected.

Test repo with different kind of outdated dependencies: https://github.com/jeromeweiss/render-with-decorators-test/pulls

[jeromeweiss]

Should we deactivate the GitHub auto-merge button/service for all of the render-with-repos like in flix?

That means in every PR an auto-merge button will be shown (while checks are running or when branch is outdated). Clicking the button once will auto-merge the PR automatically after all checks are green. It's not necessary to go later to the PR again, check that everything is green, and then manually click the merge/ rebase button.