Re: [ALL] Using Dependabot for automatic dependency updates?

2019-03-25 Thread Matt Sicker
I wasn't thinking of automating this fully at any point. The bot does file PRs for each dependency individually. I'm not sure how configurable everything is, but I do like the sound of having multiple dependency management profiles for compatibility testing purposes. On Mon, 25 Mar 2019 at 13:07,

Re: [ALL] Using Dependabot for automatic dependency updates?

2019-03-25 Thread Gary Gregory
This reminds me: What happened to Apache Gump? Didn't it handle this? Gary On Mon, Mar 25, 2019 at 2:02 PM Gary Gregory wrote: > There room for automation in this area, but I only seen it as an > informative step for now. Like the tool saying "I've ran the build with > this change and it's gree

Re: [ALL] Using Dependabot for automatic dependency updates?

2019-03-25 Thread Gary Gregory
There room for automation in this area, but I only seen it as an informative step for now. Like the tool saying "I've ran the build with this change and it's green/red". Today, without this tool, I could see a tool doing : - create a branch for a change and push it, create a PR - look at what GitHu

Re: [ALL] Using Dependabot for automatic dependency updates?

2019-03-25 Thread Ralph Goers
I have mixed feelings. Gary has been manually doing this for quite a while and I have always had concerns - besides driving his commit count artificially through the roof. Managing dependencies really needs to be managed carefully. When we upgrade a dependency that effectively becomes the minim

[ALL] Using Dependabot for automatic dependency updates?

2019-03-25 Thread Matt Sicker
Hi all, Various Jenkins projects have been using Dependabot [1] to automatically make PRs to update dependencies. We could use this for most of our components it looks like. What do you think about adopting use of this bot? [1]: https://dependabot.com/ -- Matt Sicker