Repository navigation
Initial dependabot automation for bump of rocm-systems - #2400
Conversation
ScottTodd
left a comment
ScottTodd
left a comment
There was a problem hiding this comment.
Thanks! I tagged #223 in the PR description for you
Also in the future please follow the branch naming guidelines: https://github.com/ROCm/TheRock/blob/main/CONTRIBUTING.md#branch-creation-and-naming (looks like you used the default that github creates when you edit from the web UI)
| reviewers: | ||
| - "ScottTodd" | ||
| - "marbre" | ||
| - "geomin12" |
There was a problem hiding this comment.
Copying some comments from #2252 (comment)
Fine to start as you have this now, but we should add a github team or some labels to help with review, rather than tag individual maintainers like this.
Agree on having this reviewers centralized. we can have two approach:
- move reviewers field outside to some CODEOWNERS.yaml and maintain it there in code.
- low hanging would be to have teams setup in github as suggested by @ScottTodd
We do have https://github.com/orgs/ROCm/teams/therockinfra available, with 19 members right now. That's maybe too wide a group in my opinion (as responsibility then gets diffused too much and everyone on the list assumes someone else will review). I would prefer to have an automated rotation with ~2 members active at a time, cycling once week or so.
There was a problem hiding this comment.
Oh... reviewers doesn't even work anymore, see https://github.blog/changelog/2025-04-29-dependabot-reviewers-configuration-option-being-replaced-by-code-owners/
| schedule: | ||
| interval: "daily" |
There was a problem hiding this comment.
Actually, can we use a cronjob schedule instead of this "daily interval"?
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#interval
We can line that up with what #2401 will do for rocm-libraries.
I think we should trigger sometime overnight PST so when developers start their workday they will have a bump PR ready to review with builds/tests completed already. Maybe 2AM? 11PM? open to suggestions...
| github-actions: | ||
| patterns: | ||
| - "*" | ||
| - package-ecosystem: "gitsubmodule" |
There was a problem hiding this comment.
We might want to include the date in the commit message and PR title, but I don't see a way to do that: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#commit-message--
(I'm seeing how consistent with #2401)
## Motivation Dependabot to bump commit hash of rocm-systems on a daily basis Progress on #223
) Progress on #223. As reported at #2400 (comment), dependabot no longer supports the `reviewers` field and instead suggests that projects use `CODEOWNERS`: https://github.blog/changelog/2025-04-29-dependabot-reviewers-configuration-option-being-replaced-by-code-owners/.
) Progress on #223. As reported at #2400 (comment), dependabot no longer supports the `reviewers` field and instead suggests that projects use `CODEOWNERS`: https://github.blog/changelog/2025-04-29-dependabot-reviewers-configuration-option-being-replaced-by-code-owners/.
) Progress on #223. As reported at #2400 (comment), dependabot no longer supports the `reviewers` field and instead suggests that projects use `CODEOWNERS`: https://github.blog/changelog/2025-04-29-dependabot-reviewers-configuration-option-being-replaced-by-code-owners/.
…Cm#2487) Progress on ROCm#223. As reported at ROCm#2400 (comment), dependabot no longer supports the `reviewers` field and instead suggests that projects use `CODEOWNERS`: https://github.blog/changelog/2025-04-29-dependabot-reviewers-configuration-option-being-replaced-by-code-owners/.
Motivation
Dependabot to bump commit hash of rocm-systems on a daily basis
Progress on #223