add automatic dependency updater #3516
Conversation
anonrig
force-pushed
the
yagiz/add-dep-updater
branch
from
4c5107f to
37a781e
Compare
| steps: | ||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| - name: Update dependencies | ||
| run: build/deps/update-deps.py |
There was a problem hiding this comment.
Hard to understand how that works but I would love to see separate PRs for each dependency, would be easier to deconflict.
There was a problem hiding this comment.
Basically this will run the shell script, if there are any tracking changes, the next workflow step will execute and it will open a pull-request.
There was a problem hiding this comment.
I would love to see separate PRs for each dependency
This might be hard to implement since we might have to deduplicate the dependency list in this workflow file as well (to use in matrix)
There was a problem hiding this comment.
Can we use dependabot instead?
There was a problem hiding this comment.
AFAICT Dependabot doesn't execute custom scripts (build/deps/update-deps.py). We can use dependabot for package.json, but not for our update-deps related dependencies. I'll open another PR for adding dependabot for package.json
There was a problem hiding this comment.
We've gotten dependabot PRs before, I think it's already set up in some capacity.
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
There was a problem hiding this comment.
We should use tag @v4, which generally results in using the latest patch release in the 4.x series, as we currently do with various actions in the other workflows. (There are some concerns about specifying a tag as malicious actors could change the tag to point to a different commit as a supply chain attack but this is unlikely with a repo owned by GitHub itself.)
I've checked it out and it seems like we could with not too much work. Renovate supports a dep updater called "asdf" that updater also supports custom plugins that need to output certain primitives such as list-deps list-dep-versions update-dep We could easily make our updater script emit those outputs and write a plugin and use that with renovate. The nice upside is we have full control over our deps logic while still enjoying renovate in both internal and external repos. While not too difficult that's admittedly still a little project and we'll need to find some time to do that. |
Let's roll our own dependency updater