41–50 of 76 posts
I use it at work and it’s fantastic.
Earlier quoted context omitted.
>> Why not a tool that bumps dependencies and let’s you propose yourself? SO it opens an issue and gives you a patch file... Or emails it to you? > Why does it seem to these tools have converged on the bot-makes-PR implementation? Because git and the PR is the common choke point that every one knows and loves. A lot of dev's look down on "patches"... there are tons of people who happily use linux who think that all k…
Patch files? Normal tools change files. If I `sed -i` in my project I just change the files in my project. Then I (separately) can add and commit them. Same for (for example) linting tools. This bot-PR workflow is outside of that normal.
Yes it bypasses YOUR workflow, but a PR works for everyone who uses GitHub.
If you want something else that works for everyone who uses GitHub it's an issue, or an email with a patch file. Why a patch file. DO you want to own the change the bot suggested? There are a lot of orgs where the ownership matters more than the linting.
You could just make the change yourself, sure, and then run it through your normal workflow... then your the author and commuter of the change...
Why does it seem to these tools have converged on the bot-makes-PR implementation? Why not a tool that bumps dependencies and let’s you propose yourself? I can’t use one of these tools because the integration is GitHub-only.
Here's an example (made this repo to test a Renovate issue against): https://github.com/sunshowers/renovate-test-2
Earlier quoted context omitted.
Patch files? Normal tools change files. If I `sed -i` in my project I just change the files in my project. Then I (separately) can add and commit them. Same for (for example) linting tools. This bot-PR workflow is outside of that normal.
You mean on some individual person's laptop when that person remembers to run it?
Why does it seem to these tools have converged on the bot-makes-PR implementation? Why not a tool that bumps dependencies and let’s you propose yourself? I can’t use one of these tools because the integration is GitHub-only.
If you had to submit the PR yourself, you’d have to remember to do it in the first place (and take the time to do it). Bumping a bunch of patch version numbers has never been the hard part and isn’t really what these tools solve. Their purpose is to reduce the effort involved to an absolute minimum so there are no excuses to fall behind on updates. Some of these tools, like Renovate, even have the ability to automati…
I’ve seen a fair number of open “dependabot” PRs just lying around.
Cloudflare adopted Renovate when I worked there. Not sure if it was the config wasn’t good (we did try to wrangle with it a bit by customizing), but I found it to be a lot more pain that it was worth. PRs that wouldn’t build would be opened, trivial dependency updates that weren’t worth the PR time would be proposed, etc. There’s also the security aspect of supply chain attacks of “button press” updates. I think havi…
I automated renovate PR into its own branch. Then twice a month I automatically create a PR through GitHub actions for me to review all changes at once. I also added a cooldown period that Renovate should only add updates that are out for at least 14 days.
So you have nothing to do except a big review once in a while.
Earlier quoted context omitted.
Across how many repos? My team owns a dozen.
Monorepos definitely make it easier. There's a use for dependency bots, especially when collected into one PR so that it can be treated like a newsletter. Was wanting to point out that good habits can go far, but if you're hitting limits then automation is a boon Ideally if there's multiple repos maintenance can be divided amongst those repo's owners, & once you've divided work between multiple people it becomes more…
It's downright excellent.
Dependabot is the biggest source of PR spam for me as it's config is so simplistic, you can't easily make it group upgrades. So, when I see suddenly almost a hundred PRs created, I do the upgrade myself, push it, and then Dependabot closes the PR, but I love the hundreds of emails around this process, too.
I use it at work and it’s fantastic.
It is, but at some point several dependencies might not be updated successfully for whatever reason, and I would like Renovate to retry to PRs or just close them in favour of running other dependency updates and then trying again.
Earlier quoted context omitted.
But are they broken because of renovate? Or just the underlying dependency updates?
It's the dependency updates. It doesn't consider if the update makes sense or not. If it fixes vulnerabilities it must be updated, but just for the sake of updating, I don't see the point.