Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CI] Dependabot to run on all packages. Pin Packages. Remove unused packages #4795

Merged
merged 10 commits into from
Feb 7, 2022

Conversation

unlikelyzero
Copy link
Collaborator

@unlikelyzero unlikelyzero commented Jan 26, 2022

Closes
#4794
#3178
#4808

Describe your changes:

This will remove the allowlist for dependabot and allow it to scan all of our dependencies for changes.
Pin as many packages as we can
Remove as many packages as we can

All Submissions:

  • Have you followed the guidelines in our Contributing document?
  • Have you checked to ensure there aren't other open Pull Requests for the same update/change?
  • Is this change backwards compatible? For example, developers won't need to change how they are calling the API or how they've extended core plugins such as Tables or Plots.

Author Checklist

  • Changes address original issue?
  • Unit tests included and/or updated with changes?
  • Command line build passes?
  • Has this been smoke tested?
  • Testing instructions included in associated issue?

Reviewer Checklist

  • Changes appear to address issue?
  • Changes appear not to be breaking changes?
  • Appropriate unit tests included?
  • Code style and in-line documentation are appropriate?
  • Commit messages meet standards?
  • Has associated issue been labelled unverified? (only applicable if this PR closes the issue)
  • Has associated issue been labelled bug? (only applicable if this PR is for a bug fix)

@codecov
Copy link

codecov bot commented Jan 26, 2022

Codecov Report

Merging #4795 (6c4fb06) into master (e434b29) will decrease coverage by 0.00%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #4795      +/-   ##
==========================================
- Coverage   56.83%   56.83%   -0.01%     
==========================================
  Files         722      722              
  Lines       22819    22819              
  Branches     1658     1658              
==========================================
- Hits        12970    12969       -1     
- Misses       9432     9433       +1     
  Partials      417      417              
Impacted Files Coverage Δ
...c/plugins/persistence/couch/CouchObjectProvider.js 81.77% <0.00%> (-0.45%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e434b29...6c4fb06. Read the comment docs.

This reverts commit 6064f52.
@unlikelyzero unlikelyzero added the dependencies Pull requests that update a dependency file label Jan 27, 2022
@shefalijoshi
Copy link
Contributor

We should disallow certain dependency updates like angular, webpack etc.

@unlikelyzero unlikelyzero linked an issue Jan 28, 2022 that may be closed by this pull request
2 tasks
@unlikelyzero unlikelyzero removed a link to an issue Jan 28, 2022
2 tasks
@unlikelyzero unlikelyzero changed the title [CI] Dependabot to run on all packages [CI] Dependabot to run on all packages. Pin Packages. Remove unused packages Jan 28, 2022
"style-loader": "^1.0.1",
"uuid": "^3.3.3",
"v8-compile-cache": "^1.1.0",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't see any reference to this

"file-saver": "1.3.8",
"git-rev-sync": "1.4.0",
"html-loader": "0.5.5",
"html2canvas": "1.4.1",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bump

"css-loader": "^4.0.0",
"comma-separated-values": "3.6.4",
"copy-webpack-plugin": "10.2.0",
"core-js": "3.20.3",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not a direct dependency but one which is used in many of the webpack / linting libraries

@unlikelyzero
Copy link
Collaborator Author

We should disallow certain dependency updates like angular, webpack etc.

Since angular is going to be removed, I think we can use the @dependabot ignore syntax when that package comes up.

Webpack should be bumped now that we have some level of e2e coverage and an exhaustive node testing chain

@unlikelyzero unlikelyzero added the pr:daveit Disables PR Cop label Jan 28, 2022
@akhenry
Copy link
Contributor

akhenry commented Feb 7, 2022

Agree, the dependabot workflow works better for our purposes.

Reviewer Checklist

  1. Changes appear to address issue? Y
  2. Appropriate unit tests included? N/A - build config only
  3. Code style and in-line documentation are appropriate? Y
  4. Commit messages meet standards? Y
  5. Has associated issue been labelled unverified? (only applicable if this PR closes the issue) Y

@akhenry
Copy link
Contributor

akhenry commented Feb 7, 2022

I notice that this removes the verify script, with the upside being the removal of a dependency (concurrently). On balance I think this is OK (removing dependencies and simplifying our scripts are a few of my favorite things 🎵 ).

@akhenry akhenry merged commit 869c2ab into master Feb 7, 2022
@akhenry akhenry deleted the no-more-dependabot-allowlist branch February 7, 2022 20:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file pr:daveit Disables PR Cop
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Build] Remove API Doc Generation [CI] Remove dependabot whitelist
4 participants