Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Renovatebot To Group Dependencies #24

Merged

Conversation

Jdubrick
Copy link
Contributor

@Jdubrick Jdubrick commented Jan 6, 2025

What does this PR do?:

This PR aims to group the dependencies by their type, in this case it will attempt to group them in one of the following 3:

  • gh actions
  • python
  • container images

I also added a piece that ensures that major updates are separated from the groups so we don't need to fiddle with breaking grouped changes.

Which issue(s) this PR fixes:

N/A, done in response to #22 (comment)

PR acceptance criteria:

Testing and documentation do not need to be complete in order for this PR to be approved. We just need to ensure tracking issues are opened and linked to this PR, if they are not in the PR scope due to various constraints.

  • Tested and Verified

  • Documentation (READMEs, Product Docs, Blogs, Education Modules, etc.)

How to test changes / Special notes to the reviewer:

Need to verify if Renovate can pick these changes up via PR, may need to give it a quick test on my local repo first as well.

Signed-off-by: Jordan Dubrick <jdubrick@redhat.com>
@Jdubrick Jdubrick marked this pull request as draft January 6, 2025 18:19
@Jdubrick Jdubrick changed the title Update Renovatebot To Group Dependencies [WIP] Update Renovatebot To Group Dependencies Jan 6, 2025
@Jdubrick Jdubrick changed the title [WIP] Update Renovatebot To Group Dependencies Update Renovatebot To Group Dependencies Jan 6, 2025
@Jdubrick Jdubrick marked this pull request as ready for review January 6, 2025 20:17
@Jdubrick Jdubrick requested a review from thepetk January 6, 2025 20:17
@Jdubrick
Copy link
Contributor Author

Jdubrick commented Jan 6, 2025

@thepetk I marked this ready as review now. I did some more investigating as to why the current set of dependency updates aren't grouping even though they should fall into the python group. I believe it is because they are SECURITY vulnerabilities and those are excluded from grouping unless you override it for all security issues. For general dependency updates we should see grouping with the new settings.

wdyt?

Copy link
Contributor

@thepetk thepetk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM in general. Only added a suggestion.

@Jdubrick I think is the expected behavior right? Mostly to avoid having a security update blocked by another dependency update that is grouped in the same PR (e.g if we want to merge the security update but there's a problem with another update on the same PR).

Signed-off-by: Jordan Dubrick <jdubrick@redhat.com>
@Jdubrick Jdubrick requested a review from thepetk January 7, 2025 15:35
Copy link
Contributor

@thepetk thepetk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

very nice work! Once we are confident about this config we can think of updating the registry configuration too, following the work done here.

@Jdubrick
Copy link
Contributor Author

Jdubrick commented Jan 8, 2025

Thanks @thepetk, agreed! We can see how this works moving forward and if we like the grouping then the registry utilizing it too would be a good addition

@Jdubrick Jdubrick merged commit 8c3324e into redhat-ai-dev:main Jan 8, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants