Automate bumping submodules to latest tagged commit - #8001
Conversation
Dependabot feature was merged to track latest _tagged_ commit instead of latest _head_ commit, so we can use this for libraries where we wish to track the latest release. - dependabot/dependabot-core#13052 Merged 17 Feb 2026, so we need to wait for a release that is after that. - https://github.com/dependabot/dependabot-core/releases v0.361.1 was published before the merge, so needs a later release. - https://github.com/github/dependabot-action/releases This pulls in dependabot-core Docker images, so also have to wait for propagation in this repo. After this has a release that contains the latest dependabot-core, this should be good to go. It will then only activate once it hits `stable` (default branch), not yet on `unstable`.
|
Dependabot-core release was pushed: So, now we wait for https://github.com/github/dependabot-action/releases to update |
|
A PR was opened against github/dependabot-actions that proposes updating to the new dependabot-core release. |
|
Updating to an looks likely to fix the jenkins/nimbus-eth2/linux/x86_64/nix CI failure. |
|
github/dependabot-action now contains the new dependabot-core, it's still pending release: |
|
Followup feedback addressed: We don't need it for nimbus, as we want the default behaviour, but it may delay the time until the github/dependabot-action gets its next release, so. |
|
Some comment that this is apparently working: dependabot/dependabot-core#1639 (comment) Maybe the github/dependabot-action release isn't needed? https://github.com/github/dependabot-action/releases |
|
@etan-status I believe it is working. See LizardByte/Sunshine#4858 It bumped to the last release which was in 2024, even though there was a commit 1 month ago. |
|
Thanks. Have run it in a fork of this repo and it works fine, suggesting bumps to releases instead of head. |
3 participants
Dependabot feature was merged to track latest tagged commit instead of latest head commit, so we can use this for libraries where we wish to track the latest release.
Merged 17 Feb 2026, so we need to wait for a release that is after that.
v0.361.1 was published before the merge, so needs a later release.
This pulls in dependabot-core Docker images, so also have to wait for propagation in this repo. After this has a release that contains the latest dependabot-core, this should be good to go. It will then only activate once it hits
stable(default branch), not yet onunstable.