Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically upgrade dependencies with Renovate. #140

Closed
bmarty opened this issue Mar 6, 2023 · 2 comments
Closed

Automatically upgrade dependencies with Renovate. #140

bmarty opened this issue Mar 6, 2023 · 2 comments
Assignees
Labels

Comments

@bmarty
Copy link
Member

bmarty commented Mar 6, 2023

Since Dependabot does not support gradle catalog (yet), our dependencies are not updated and we are starting to get some vulnerability reports.

Renovate is another app which can do this work: https://github.com/renovatebot/renovate

  • install the app https://github.com/apps/renovate on the project.
  • The app should create a PR. Once merge, the app will start creating PR to upgrade or dependency.

If this is working properly, we may consider deactivating Dependabot to having duplication.

@bmarty bmarty self-assigned this Mar 6, 2023
@bmarty
Copy link
Member Author

bmarty commented Mar 7, 2023

Configuration is finished, we may iterate in the future. The tool has created this PR: #147 and I have tweaked configuration in the file renovate.json.

For ref, the tool has created a dashboard issue: #150 that I have pinned to the project.

@bmarty bmarty closed this as completed Mar 7, 2023
@bmarty bmarty added the Z-Setup label Mar 7, 2023
@bmarty
Copy link
Member Author

bmarty commented Mar 7, 2023

What's remaining is:

  • deactivate (or remove) Dependabot
  • update the documentation about Dependabot

For now I want to check that Renovate are creating all the PR that Dependabot used to create (but I think this will be the case)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant