search

marcoroth / dependabot-bump-together-action

GitHub Action to bump multiple dependencies with dependabot in a single pull request
MIT License
8 stars 3 forks source link

Go back to using Dockerfile #14

Closed banesullivan closed 2 years ago

banesullivan commented 2 years ago

Option 2

This goes back using the Dockerfile to build the image on-the-fly so that using a tag in downstream actions will work

banesullivan commented 2 years ago

I'm in favor of reverting back to this for simplicity

marcoroth commented 2 years ago

Yeah, I'm also in favor of this option. But I guess we also need to update the Dockerfile in order to pull down the right tag.

banesullivan commented 2 years ago

But I guess we also need to update the Dockerfile in order to pull down the right tag.

I don't think that is needed. The Dockerfile pulls the latest dependabot/dependabot-core and this PR would render the container registry for this repo useless (in production)

marcoroth commented 2 years ago

Oh right, but then we also don't need the container registry anymore

banesullivan commented 2 years ago

but then we also don't need the container registry anymore

Yep... 🤷🏻 I've been pretty excited about ghcr.io and using all over the place. My bad introducing it here when it really isn't all that needed.

marcoroth commented 2 years ago

I mean it would make sense to speed it up.

But if you compare the run times it doesn't seem to make much of a difference. The two runs today are using the pre-built Docker image and the two from two days ago are building it on-the-fly.

Screenshot 2022-01-23 at 04 04 44
banesullivan commented 2 years ago

Exactly... I was hoping that pulling from ghcr.io would speed it up but considering that the base dependabot/dependabot-core image is 4GB, that's always going to be the limiting factor:

REPOSITORY                                       TAG          IMAGE ID       CREATED         SIZE
dependabot/dependabot-core                       latest       c611f4026e2b   9 days ago      4.1GB

And we need that image for all of the different packaging runtimes (npm, pip, etc.)

marcoroth commented 2 years ago

Yeah, so it really comes down to the network/download speed.