search

microsoft / windows-drivers-rs

Platform that enables Windows driver development in Rust. Developed by Surface.
Apache License 2.0
1.51k stars 67 forks source link

Consider switching Dependabot to Renovatebot #133

Open wmmc88 opened 7 months ago

wmmc88 commented 7 months ago 
          This version, along with the versions in the cargo-make makefiles(including the other pinned binary dependencies) should be auto-updated by pipelines (similar to other things managed by dependabot). It looks like this is [not supported by dependabot yet](https://github.com/dependabot/dependabot-core/issues/9420), but there's another popular open source tool called [renovatebot that supports this](https://docs.renovatebot.com/modules/manager/regex/).

_Originally posted by @wmmc88 in https://github.com/microsoft/windows-drivers-rs/pull/127#discussion_r1548752698_

All dependencies should have update prs generated automatically. this included pinned binary dependencies in github actions, dependencies specified in cargo-make makefiles, etc

wmmc88 commented 1 month ago

This is a native feature of renovatebot. Given https://github.com/dependabot/dependabot-core/issues/4009, and the fact that dependabot is overly eager about updating our Cargo.toml dependency versions right now, we should consider just switching everything over to renovatebot.

overly eager about updating our Cargo.toml dependency versions right now

Right now, both lockfile and manifest are updated by dependabot. This is the desired behavior for our sample drivers in the examples folder, but the core library crates should be only updating their lockfiles automatically (to validate that dependencies aren't violating semver) and only upreving the versions in the manifests when there is a major version change. This allows the resolver to accept a wider range of dependencies when this repos crates are used downstream