Live data from Hacker News

Show HN: Updatecli – What if Dependabot and Ansible had a child?

news.ycombinator.com

21–30 of 39 posts

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#21
I like the idea of automatic proposed changes triggered by external events, but I'm not sure a monolithic tool with plugins is the best way of going about it. The Unix way to solve this problem would be to decompose your program into a couple of different programs that just do one thing, with flexible inputs and outputs.

"Sources": what does this do? Collect information. This doesn't need to be a particular program, this could just be a data specification that any program could generate data according to the spec. Thus you could have a dozen different programs that could each generate the spec.

"Conditions": This also doesn't need to be a dedicated program. Any program that can read the data specification can have one or two lines of simple logic; a couple lines of shell script would work fine. For complicated conditions you could use a more complex language, or build applications with specific features that are needed often.

"Targets": This part seems a little complicated, could use deconstructing a bit more. If you want to modify a YAML file, that is one dedicated kind of action to take. If you want to commit that file to a Git repo, that's another action. Opening a PR is another action (PRs aren't a Git primitive). Those three things could be separated but run one after another, all as separate programs.

The plugin aspect is certainly useful for being able to share pre-made solutions. But those "plugins" don't need to be strongly coupled to a monolithic application. Drone.io is a fantastic example of a loosely-coupled cloud-native design; every plugin is actually a Docker container, which is just an abstraction around arbitrary applications that uses environment variables and command-line options. (Also, the data specs absolutely needs a version number, and should consider backwards compatibility)

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#23

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

[deleted]

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#24
post #17

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

> Nope. Nope, nope, nope. Maybe it's just me, but I read this as a joke. As much as we dislike YAML it's not really something we have the luxury of ignoring, especially in the infrastructure field.

No post body was provided.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#25
I like how some are missing the point of the tool because you mentioned (assuming jokingly) that we all love YAML.

Anyway, looks really cool. Dependabot seems to some strange limitations, and I'll probably look into using this.

Out of curiousity, how are you linked to the Jenkins project? Are you just an OSS contributor or do you do this full time?

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#26
I wrote something similar but to keep a local system up-to-date: https://github.com/kdeldycke/meta-package-manager#readme

With Meta Package Manager you can aggregate the results of all package managers available on your machine:

    $ mpm outdated
    ╭──────────────┬─────────────┬─────────┬───────────────────┬────────────────╮
    │ Package name │ ID          │ Manager │ Installed version │ Latest version │
    ├──────────────┼─────────────┼─────────┼───────────────────┼────────────────┤
    │ curl         │ curl        │ brew    │ 7.79.1            │ 7.79.1_1       │
    │ git          │ git         │ brew    │ 2.33.0            │ 2.33.0_1       │
    │ openssl@1.1  │ openssl@1.1 │ brew    │ 1.1.1l            │ 1.1.1l_1       │
    │ rake         │ rake        │ gem     │ 13.0.3            │ 13.0.6         │
    │ Telegram     │ 747648890   │ mas     │ 8.1               │ 8.1.3          │
    │ npm          │ npm@8.0.0   │ npm     │ 7.24.0            │ 8.0.0          │
    │ pip          │ pip         │ pip     │ 21.2.4            │ 21.3           │
    │ regex        │ regex       │ pip     │ 2021.9.30         │ 2021.10.8      │
    ╰──────────────┴─────────────┴─────────┴───────────────────┴────────────────╯
    8 packages total (brew: 3, pip: 2, gem: 1, mas: 1, npm: 1, apm: 0, cask: 0, composer: 0).
Bonus point: it solves XKCD #1654 (Universal Install Script).

(edit: formatting)

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#27
interesting. so if i understand this correctly, it's like a bridge between all those little version numbers and hashes in config files for modern infrastructure and full scale automation (from running of scripts to provisioning a short lived test environment) for checking if those little numbers and hashes need to be bumped. cool!

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#28
post #25

I like how some are missing the point of the tool because you mentioned (assuming jokingly) that we all love YAML. Anyway, looks really cool. Dependabot seems to some strange limitations, and I'll probably look into using this. Out of curiousity, how are you linked to the Jenkins project? Are you just an OSS contributor or do you do this full time?

I worked for 5 years at CloudBees within the community team so maintaining the infrastructure project was one the things I worked on https://GitHub.com/jenkins-infra

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#29
post #2

this tool looks amazing. dependabot but open-source, with a plugin system, and you can run it locally. great idea, looking forward to trying it out!

agreed, FYI dependabot is open source for non-commercial use and you can run it locally https://github.com/dependabot/dependabot-core/blob/main/LICE...

"Open Source, but not for X" is not open source, it's source available.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#30

I wrote something similar but to keep a local system up-to-date: https://github.com/kdeldycke/meta-package-manager#readme With Meta Package Manager you can aggregate the results of all package managers available on your machine: $ mpm outdated ╭──────────────┬─────────────┬─────────┬───────────────────┬────────────────╮ │ Package name │ ID │ Manager │ Installed version │ Latest version │ ├──────────────┼─────────────…

Might be worth a "Show HN" of its own...
Post reply on HN