chore(dependabot): revise configuration #10186
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Operate on all package directories Update devDependencies too Weekly instead of daily Only "patch" level bug fixes for now
Deploying agoric-sdk with
|
| Latest commit: |
d37de09
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://52450a07.agoric-sdk.pages.dev |
| Branch Preview URL: | https://ta-dependabot.agoric-sdk.pages.dev |
mujahidkay
approved these changes
Oct 2, 2024
The manual process is ad-hoc and less than weekly. |
turadg
added
automerge:rebase
mergify bot
added a commit
that referenced
this pull request
Oct 2, 2024
incidental ## Description [#10186](#10186) ran but timed out: https://github.com/Agoric/agoric-sdk/actions/runs/11150379306/job/30991381517 Reviewing the logs it looks like it did a lot of duplicate work querying for each package. Maybe that's a bug in Dependabot. Meanwhile, we only need to update the yarn.lock so this leaves out the 'packages" wildcard. It adds two other top-level directories that are Yarn workspaces. ### Security Considerations none ### Scaling Considerations none ### Documentation Considerations none ### Testing Considerations have to test in master ### Upgrade Considerations none
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
incidental
Description
To reduce manual effort to keep dependencies green.
There was already a dependabot config file but it seems inoperational.
This changes it to
If that doesn't start it running I'll dig in more
Security Considerations
Trusts Github to only update patch releases. Increases rate of supply chain updates.
But this is just automating what we do already. PRs will still be reviewed.
Scaling Considerations
none
Documentation Considerations
none
Testing Considerations
Needs master to test
Upgrade Considerations
none