-
Notifications
You must be signed in to change notification settings - Fork 228
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add dependabot for managing dependencies #435
Comments
let's take kubernetes libraries as an example: Would the bot update to 1.26 when it's released? Or would it update to 1.25 when 1.24 is out of support? |
To be clear, it looks at what you have in your go.mod so it would upgrade k8s.io/client-go v0.24.3 to the latest when there is a release. We can tell the bot to ignore dependencies if you want to control kubernetes apis closer |
if there is support for semantic versioning, it would be nice to upgrade to the latest patch version, but not minor. |
You can see an example of a PR it creates here armadaproject/armada#1670 and it has a decent amount of options. |
/assign @kannon92 I'll go ahead and add the yml. If we don't like it, we can just remove it from repo very easily. |
What would you like to be added:
We should add a bot to automatically upgrade our dependencies in go.mod.
Why is this needed:
Managing dependencies is tedious and can become a security problem if left alone for too long.
Completion requirements:
To do this, one just needs to add a dependabot.yml file to the .github
See below for an example:
https://github.com/kubernetes-sigs/controller-runtime/blob/master/.github/dependabot.yml
The text was updated successfully, but these errors were encountered: