Migrate to a less noisy Dependabot config - #13733
aiolibsbot wants to merge 2 commits into
Conversation
Follow CPython's setup: check master only, quarterly, with a 14-day cooldown. GitHub Actions bumps are grouped and limited to major versions. Release branches get bumps via Patchback backports; security updates are unaffected by schedule, cooldown and grouping.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #13733 +/- ##
=======================================
Coverage 99.03% 99.03%
=======================================
Files 135 135
Lines 50987 50987
Branches 2683 2683
=======================================
Hits 50495 50495
Misses 369 369
Partials 123 123
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Merging this PR will not alter performance
Comparing Footnotes
|
| # Only `master` is tracked: Patchback carries version bumps into the | ||
| # release branches along with the backports. |
There was a problem hiding this comment.
As per my comment on the issue, this leaves dependencies that are 3.x only unmanaged, and likely causes conflicts etc.
| groups: | ||
| actions: | ||
| patterns: | ||
| - '*' |
There was a problem hiding this comment.
Grouping these makes my maintenance more difficult as I now have to get every single dependency working in order to get anything updated, instead of dealing with one at a time.
| - package-ecosystem: pip | ||
| directory: / | ||
| schedule: | ||
| interval: quarterly |
There was a problem hiding this comment.
And a quarterly update is going to be a massive update, while also meaning that we are very late in testing new dependency versions that our users are likely already using.
What do these changes do?
Replaces the Dependabot config with one modelled on CPython's, as requested in #13732. It checks
masteronly, runs quarterly with a 14-day cooldown, and groups GitHub Actions updates into one PR limited to major bumps. The file now uses no-indent sequences with---/...document markers.Changes from CPython's version: the
dependencieslabel stays (CPython'sskip issue/skip newslabels mean nothing here). The pip entry keeps aiohttp'sversioning-strategy: increase-if-necessary,allow: dependency-type: allandopen-pull-requests-limit: 10, because a quarterly run over our many lock files would stall with the default limit of 5. The autobahn Docker entry stays, now quarterly.Are there changes in behavior for the user?
No. This only affects contributors and maintainers.
Is it a substantial burden for the maintainers to support this?
No. It means less noise. Two trade-offs for reviewers:
3.14/3.15target-branchentries are gone (including the one added in Point Dependabot GitHub Actions updates at 3.14 too #13727). Release branches only get bumps if a Dependabot PR onmastergets a backport label, and nothing applies that label automatically.actions/setup-python@v7.0.0,github/codeql-action/*@v4.38.0,sigstore/gh-action-sigstore-python@v3.5.0) will only get major bumps through version updates. Security updates are not affected byschedule,cooldown,groupsoropen-pull-requests-limit, so advisories still produce PRs right away.Related issue number
Fixes #13732
Checklist
CONTRIBUTORS.txt— N/ACHANGES/folderValidation output
Drafted with Kōan (Claude Opus 5); reviewed by .
Quality Report
Changes: 3 files changed, 55 insertions(+), 79 deletions(-)
Code scan: clean
Tests: failed (FAILED)
Branch hygiene: clean
Generated by Kōan