Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adds automatic dependabot checks #135

Open
wants to merge 1 commit into
base: development
Choose a base branch
from
Open

Adds automatic dependabot checks #135

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

version: 2
updates:
- package-ecosystem: "npm" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "monthly"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think weekly is fine?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On one of the projects I work on, we have this set to "monthly", and then we allow dependabot to create as many simultaneous PRs as it wants, which results in one day a month with lots and lots of dependency PRs, and then no dependency PRs for the rest of the month.

In some ways, not having constant "dependabot noise" feels nice. The cost, of course, is a bigger barrage of PRs once a month.

For a project as small as our website, though, I think either way is fine. We don't have don't many dependencies to begin with.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@anaulin agree. I set to monthly for that reason -- this site is fairly small. Is there an additional setting for depbot to create "simultaneous" PRs or was that just a figure of speech?

Copy link
Member

@anaulin anaulin Oct 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a figure of speech. By default, dependabot opens at most 5 simultaneous PRs for version updates; so if you need more than 5 updates in a month, and the frequency is set to monthly, then it will open 5 PRs and stop until the next month, and some of your dependencies will go un-updated.

You can see this in action on the Convene repo, where dependabot opens 5 PRs each week(ish).

There is a setting to let dependabot open PRs up to a set number: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the monthly + unlimited!