Add workflow to bump package after dependabot merge

[Odilhao]

No description provided.

[ekohl]

I'd still argue for an approach where requirements.txt isn't strict, but rather pins to ranges, for example using pulp ~= 3.39.0 (which also allows installing 3.39.1). Then you'd install that and see if you need to update packaging. Otherwise requirements.txt goes out of sync with the rest of the repository all the time.

An additional benefit is that it can also work for stable branches: just pin to the .z stream.

In foreman-packaging we have:

• https://github.com/theforeman/foreman-packaging/blob/master/.github/workflows/bump_packages.yml

This builds up a list of updates to start. Each branch has a script to list the available updates. In practice that's https://github.com/theforeman/foreman-packaging/blob/rpm/develop/list_updatable_packages and https://github.com/theforeman/foreman-packaging/blob/deb/develop/scripts/list_updatable_packages.

For pulpcore-packaging, that could take https://github.com/theforeman/pulpcore-packaging/blob/rpm/develop/automation/_generate_deps.sh and format it in compatible way.

Then we have generated a matrix with jobs to update. You can see how we do that for RPMs here:

https://github.com/theforeman/foreman-packaging/blob/afb6040d279916cb79065468e719ea6495c163fc/.github/workflows/bump_packages.yml#L33-L36

For pulpcore-packaging you may want to take a different approach and group them, but in my experience with foreman-packaging it's better to have them split so you can review things individually.

[ekohl]

I'd strongly advise against big shell scripts in YAML. Create a separate shell script and run that. If it's limited to just GHA, store it in .github. That way you can modify it with proper syntax highlighting and tools like shellcheck.

[Odilhao]

I'd still argue for an approach where requirements.txt isn't strict, but rather pins to ranges, for example using pulp ~= 3.39.0 (which also allows installing 3.39.1). Then you'd install that and see if you need to update packaging. Otherwise requirements.txt goes out of sync with the rest of the repository all the time.

We have dependabot enabled now, and it's working to keep with z-streams of pulpcore and pulp-rpm, we need this due to VCRs on Katello that can get broken when we do major upgrades.

I'll refactor later this week and move from being one big script inside of YAML to one standalone script.

I do have plans to revive the _generate_deps.sh, unfortunately right now we have packages that still use setup.py and other that don't use it anymore or never used, and the spec generation is not straightforward in the dependency side. For now we will only focus on getting the core components of pulp up to date, to later implement as Foreman is doing right now.

[Odilhao]

@ekohl I think we are now in a better shape for another review. 😄

[Odilhao]

Let me tag @evgeni as well, I heard that he loves GH-actions

[zjhuntin]

Logic of this looks good to me!

[Odilhao]

Merging and YOLO