Skip to content

Update Dependabot Scheduled Config#26867

Merged
jentfoo merged 3 commits intomasterfrom
jent/dependabot_config
May 25, 2023
Merged

Update Dependabot Scheduled Config#26867
jentfoo merged 3 commits intomasterfrom
jent/dependabot_config

Conversation

@jentfoo
Copy link
Copy Markdown
Contributor

@jentfoo jentfoo commented May 24, 2023

Update Dependabot with the following:

  • Add jentfoo to reviewers list
  • Remove crypto ignore on api (no longer using forked version)
  • Add configurations for missing gomod paths

Although we are looking to explore Renovate I think we should still correct these gaps soon. As an alternative I am open to correcting these gaps with Renovate first to help validate Renovate and then just merging this for completeness after.

Update Dependabot with the following:
* Add `jentfoo` to reviewers list
* Remove `crypto` ignore on `api` (no longer using forked version)
* Add configurations for missing gomod paths
@jentfoo jentfoo self-assigned this May 24, 2023
@github-actions github-actions Bot requested review from jimbishopp and r0mant May 24, 2023 21:21
@jentfoo jentfoo requested review from adaadb6, reedloden and wadells May 24, 2023 21:23
@rosstimothy
Copy link
Copy Markdown
Contributor

Do we really need to include everything under examples? I'm a bit concerned about how many additional PRs that might produce per week.

@jentfoo
Copy link
Copy Markdown
Contributor Author

jentfoo commented May 24, 2023

Examples are definitely lower priority. But if we expect people to reference or start from them, it seems like we should keep them up to date. That said this PR is expanding the scope fairly dramatically, so I could be convinced to do examples as another iteration.

@wadells
Copy link
Copy Markdown
Contributor

wadells commented May 24, 2023

Do we really need to include everything under examples? I'm a bit concerned about how many additional PRs that might produce per week.

Some of the stuff under examples has progressed well past an example. For instance, our virtually all of internal use of teleport depends on examples/chart. We could refactor to split out the more example stuff from the production grade stuff.

@rosstimothy
Copy link
Copy Markdown
Contributor

I think most users will be required to change go.mod prior to using the examples anyway since most of them depend on api and they will most definitely want to use the version of api that matches their target cluster and not whatever version we happen to have in the examples. desktop-registration only directly depends on api so I'm not sure if it will ever result in any updates.

@codingllama
Copy link
Copy Markdown
Contributor

+1 for removing examples from automatic updates - I don't want to spend eng time every week touching them up.

Some of the stuff under examples has progressed well past an example. For instance, our virtually all of internal use of teleport depends on examples/chart. We could refactor to split out the more example stuff from the production grade stuff.

We should certainly do that, calling prod code "examples" is highly misleading. Who is a good person to tag for the refactor?

Copy link
Copy Markdown
Contributor

@codingllama codingllama left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good, thanks Jent.

Comment thread .github/dependabot.yml Outdated
jentfoo and others added 2 commits May 25, 2023 07:45
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Comment thread .github/dependabot.yml
time: "09:00" # 9am UTC
ignore:
# Forked/replaced dependencies
- dependency-name: golang.org/x/crypto
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch.

@jentfoo
Copy link
Copy Markdown
Contributor Author

jentfoo commented May 25, 2023

I have removed examples from this PR. II still do believe we need a continual update process for examples, but I don't want that to block the rest of this and I have no concerns figuring it out in another iteration.

I will try to today to get a few more PR's up to update these dependencies before the scheduled run (reduce the Dependabot qty)

Copy link
Copy Markdown
Contributor

@rosstimothy rosstimothy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @jentfoo!

@codingllama
Copy link
Copy Markdown
Contributor

I still do believe we need a continual update process for examples

I kind of disagree here, I don't think examples should create a continuous maintenance burden. It's important that they remain useful (as in they work with current Teleport), but a pre-release check could do. Touching up their dependencies, barring for CVEs, doesn't seem important.

@jentfoo jentfoo added this pull request to the merge queue May 25, 2023
Merged via the queue into master with commit 61448c9 May 25, 2023
@jentfoo jentfoo deleted the jent/dependabot_config branch May 25, 2023 20:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants