chore: add config for enabling Dependabot version updates #1347
Conversation
ianbotsf
added
the
no-changelog
This comment has been minimized.
This comment has been minimized.
1 similar comment
Affected ArtifactsNo artifacts changed size |
| version: 2 | ||
| updates: | ||
| - package-ecosystem: gradle | ||
| directory: / |
There was a problem hiding this comment.
In the documentation I see:
Use to define the location of the package manifests for each package manager
which makes me think it should be pointing to /gradle? But I also see this:
For GitHub Actions, use the value /.
which I think means Dependabot would automatically upgrade our GitHub action dependencies.
Do we need both?
There was a problem hiding this comment.
I don't think so. Technically, the package manifest for Gradle starts from /settings.gradle.kt (if it exists) and /build.gradle.kts. It typically spiders out from there and may include /gradle/libs.versions.toml but the root is still / I think. I believe this configuration would vary if we had a monorepo containing many independent Gradle projects in various subdirectories.
I found an example in kotlin-logging and they use / too.
| - package-ecosystem: gradle | ||
| directory: / | ||
| schedule: | ||
| interval: daily # means every _weekday_ (Monday through Friday) |
There was a problem hiding this comment.
It would be nice to also trigger it on a release of aws-crt-kotlin or aws-kotlin-repo-tools. I don't think that's possible with this yaml configuration though
There was a problem hiding this comment.
The options for schedule are pretty limited. It's either a simple interval like daily or a cron expression. I think auto-creating PRs on release of upstream software will require a GitHub action or backend tooling.
There was a problem hiding this comment.
Yes I was thinking of a GitHub action that can trigger a Dependabot scan manually, there's a bit of discussion here: dependabot/dependabot-core#2980
3 participants
Issue #
(none)
Description of changes
Enables Dependabot version updates.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.