Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency management #2594

Open
richardsheridan opened this issue Mar 5, 2023 · 5 comments · Fixed by #2592
Open

Dependency management #2594

richardsheridan opened this issue Mar 5, 2023 · 5 comments · Fixed by #2592

Comments

@richardsheridan
Copy link
Contributor

The current setup of dependabot is intensively manual and has some negative interactions with pip-tools. I've created 2 PRs with opposite solutions to this problem: #2593 maxes out dependabot usage and automates the PR merges, but sacrifices the precise output of pip-compile, whereas #2592 drops dependabot entirely and does a periodic (and also manually triggerable) pip-compile bump.

Personally I would favor dropping dependabot mainly because of the fewer commits, but I recognize that monthly mass updates are marginally more likely to have difficult-to-diagnose breakage from bad interactions.

@pquentin
Copy link
Member

pquentin commented Mar 5, 2023

Thanks for this! I'd like to try #2592 first.

@Zac-HD
Copy link
Member

Zac-HD commented Mar 22, 2023

FWIW having a weekly Action with pip-compile has been fantastic for Hypothesis, and I'd strongly encourage it.

That also makes it easy to sneak in other automated fixes, e.g. running the (maybe-newly-updated) autoformatters and committing that too, updating vendored data files, etc. We even have a script that writes the changelog entry 😁

@richardsheridan
Copy link
Contributor Author

Thanks! It looks like we will eventually be moving that direction. We are hung up on how to automatically merge the PRs at the moment, but it looks like you are using the automatic github token. Did you find a way to run CI on those PRs or do you simply click each one?

@Zac-HD
Copy link
Member

Zac-HD commented Mar 22, 2023

CI runs automatically, since it's a tightly-scoped personal access token from my account, and then I (or another maintainer) review and click "merge" on each one.

@jakkdl
Copy link
Member

jakkdl commented Apr 5, 2023

I think this should stay open since #2592 is cludgey, and we don't close this until the mentioned machine account or similar is added.

@jakkdl jakkdl reopened this Apr 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants