search

flathub-infra / flatpak-builder-lint

A linter for flatpak-builder manifests
MIT License
48 stars 115 forks source link

chore: add dependabot configuration for scheduled dependency updates #361

Closed kbdharun closed 3 months ago

kbdharun commented 3 months ago

Changes

Continuing #166, this PR adds a dependabot config file to schedule automatic dependency updates (with PRs by dependabot) in a monthly schedule. This would ensure the dependencies are up to date and would allow addressing any breaking changes in the dependent packages then and there.

Detailed Explanation of changes

version: 2 # this is the version type of the dependabot config file with 2 being the recent one
updates:
  - package-ecosystem: "github-actions" # checks for updates to the GitHub actions in use.
    directory: "/" # scans the full root directory for updates (optionally, we can make this fine-grained to point to .github/workflows)
    schedule:
      interval: "monthly" # scheduling dependabot updates monthly

  - package-ecosystem: "pip"  # checks for updates to the Python (Poetry) deps in use.
    directory: "/" # scans the full root directory for updates
    schedule:
      interval: "monthly" # scheduling dependabot updates monthly
bbhtt commented 3 months ago

Thanks for the PR. Dependabot is not super high on the list of things to add because the CI setup of linter depends on org.flatpak.Builder where the linter is actually shipped and the manifests there needs to be manually updated and kept in sync with the dependencies here. So just merging dependabot updates won't help.

Also the linter lives in the critical chain of Flathub's build process and it is also served to third parties who use direct upload via docker images built from master. So it is quite sensitive and I personally think we should be conservative and make updates only when necessary.