Add github action to check if OAF is Up to Date

[Coperh]

fixes: maykinmedia/open-api-framework#44

[Coperh]

Can see the PRs it makes here: https://github.com/Coperh/objects-api/pulls

(have it set to 2 PRs since one was queued forever

[annashamray]

Let's discuss it

I see the created PR for python dependencies updates libraries which are included in open-api-framework
If we implement this we fill loose the reason why OAF was created
I think we can implement this dependabot auto-update in OAF itself, and then just update OAF version in the APIs
Is it possible to make dependabot monitoring only OAF new versions?

@alextreme @joeribekker what do you think?

[joeribekker]

I see the created PR for python dependencies updates libraries which are included in open-api-framework
If we implement this we fill loose the reason why OAF was created
I think we can implement this dependabot auto-update in OAF itself, and then just update OAF version in the APIs

I see your point and I largely agree. Although registrations have some deps that are outside the OAF scope and also require updating in these components. Best solution would be to place the OAF-deps out of scope (but thats probably not possible) and let that be handled in the OAF-repo.

I'm still interested to see the effects. Dependabot could update OAF and conclude that because OAF was updated, other libraries are then also updated and dont need individual updating.

Is it possible to make dependabot monitoring only OAF new versions?

No clue but @Coperh can probably answer that.

[Coperh]

@annashamray You can allow dependabot to only update certain libraries:

allow:
- dependency-name: "open-api-framework"

You can do the same with exclude

[annashamray]

@joeribekker @Coperh
After looking and OAF dependencies and seeing that they are not pinpoint to particular version, but mostly have ">=", it feels like my previous comment is not applicable, because we can have the same OAF version but different versions of its dependencies.

So let's try using it with current implementation.

[annashamray]

@Coperh Am I correct that with the current configuration a PR like this (Coperh#2) would be created for Python dependencies?

If that's correct then I have a question. In this PR only ci.txt and dev.txt are updated, and base.txt is left out. I'm afraid that in this case the next time we use pip-compile all these updated would be overwritten

[Coperh]

@annashamray

Dependabot seems very inconsistent. Sometimes its all in one PR like Coperh#13, sometimes in separate PRs

It does not really work with the current structure since dev.txt does not inherit from base

[Coperh]

@annashamray Completely changed it to an action that checks if compile-dependencies changes anything.

I think I can remove the --exit-code and create a PR with the changes as well, but I have not looked fully into it.

[Coperh]

Example in my personal repo: https://github.com/Coperh/objects-api/actions/runs/10902015010/job/30252978244

[annashamray]

Could you please rename the PR, because it's not about dependabot anymore?