search

fatiando / harmonica

Forward modeling, inversion, and processing gravity and magnetic data
https://www.fatiando.org/harmonica
BSD 3-Clause "New" or "Revised" License
208 stars 68 forks source link

Use Dependabot to update GitHub Actions workflows #455

Closed leouieda closed 6 months ago

leouieda commented 6 months ago

The Actions we use have pinned versions and it's almost impossible to keep up with new releases of them. Add configuration for Dependabot to track the Actions versions and send pull requests when new versions are available. This only works if version numbers are pinned instead of the commit hashes. I think the benefit of being updated out weight any risk associated with this.

santisoler commented 6 months ago

I noticed that dependabot replaces the hashes from commits with tags. Do we want to allow it to do so for actions that use our tokens?

If so, maybe we should update those comments saying we are actually pinning the commit hashes, right?

leouieda commented 6 months ago

Hey Santi, I thought it would be fine. The only one we actually use is the Cancel Workflow one, which honestly, we can probably get rid of. The others are official PyPI actions, official Codecov actions, and official GitHub actions, so it shouldn't be a problem.

leouieda commented 6 months ago

Now that I think about it, the only reason commits would be safer is if we audited the action to know that the particular commit doesn't do anything dangerous. We don't do this so I think the risk is pretty much the same.

leouieda commented 6 months ago

Would you agree to remove the Cancel workflow actions?

santisoler commented 6 months ago

I see. I think cancelling workflows is a nice feature, so we avoid using resources unnecessarily, but we can live with that.

I haven't look too much into it, but I think there's a way to cancel previous workflows through GitHub Actions API, specifically configuring the concurrency: https://www.meziantou.net/how-to-cancel-github-workflows-when-pushing-new-commits-on-a-branch.htm

I might need to research on that. But for now, feel free to remove it.

leouieda commented 6 months ago

You can also do it manually. But yes, I think our development pace is slow enough that this isn't significant. I'll remove it here and elsewhere.

leouieda commented 6 months ago

Done! Merging this in then.