mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-11-14 02:10:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
ed6d28a1fc
ceph-csi/.github/dependabot.yml

40 lines
1.5 KiB
YAML
Raw Normal View History

ci: add dependabot config for updating vendored packages Vendored dependencies need updating on regular basis. This is currently done manually by developers, but it can be automated by Dependabot. By dropping the dependabot.yml config file in the .github/ directory the bot should get enabled. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-08-26 15:57:12 +00:00
---
version: 2
updates:
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
ci: do not let dependabot automatically rebase When dependabot creates a PR, and an other gets merged, the bot automatically triggers a rebase. This will drop any approvals, causing delays in the review/merge process. The project uses Mergify to automatically rebase when needed, and approvals are retained when Mergify rebases PR. By disabling the auto-rebasing done by dependabot, fewer rebases should be needed, contributors only need to review once, and CI jobs are triggered less often. Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-11-02 11:02:06 +00:00
rebase-strategy: "disabled"
ci: add dependabot config for updating vendored packages Vendored dependencies need updating on regular basis. This is currently done manually by developers, but it can be automated by Dependabot. By dropping the dependabot.yml config file in the .github/ directory the bot should get enabled. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-08-26 15:57:12 +00:00
labels:
- rebase
commit-message:
prefix: "rebase"
ci: ignore k8s.io/kubernetes dependencies These dependencies are pulled in by k8s.io/kubernetes with version v0.0.0. It is therefore required to use 'replace' in go.mod to select a compatible version of the additional k8s.io packages. Dependabot does not seem to update packages listed in 'replace', only under 'require'. That means, the version updates done by Dependabot do not have any effect, as the contents is replaced with a different version anyway. Ignoring these packages prevents the creation of non-functional PRs. Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-08-31 07:28:02 +00:00
ignore:
# k8s.io/kubernetes prevents auto-updating these
- dependency-name: "k8s.io/api"
- dependency-name: "k8s.io/apiextensions-apiserver"
- dependency-name: "k8s.io/apimachinery"
- dependency-name: "k8s.io/apiserver"
- dependency-name: "k8s.io/cli-runtime"
- dependency-name: "k8s.io/client-go"
- dependency-name: "k8s.io/cloud-provider"
- dependency-name: "k8s.io/cluster-bootstrap"
- dependency-name: "k8s.io/code-generator"
- dependency-name: "k8s.io/component-base"
- dependency-name: "k8s.io/component-helpers"
- dependency-name: "k8s.io/controller-manager"
- dependency-name: "k8s.io/cri-api"
- dependency-name: "k8s.io/csi-translation-lib"
- dependency-name: "k8s.io/kube-aggregator"
- dependency-name: "k8s.io/kube-controller-manager"
- dependency-name: "k8s.io/kube-proxy"
- dependency-name: "k8s.io/kube-scheduler"
- dependency-name: "k8s.io/kubectl"
- dependency-name: "k8s.io/kubelet"
- dependency-name: "k8s.io/legacy-cloud-providers"
- dependency-name: "k8s.io/metrics"
- dependency-name: "k8s.io/mount-utils"
- dependency-name: "k8s.io/pod-security-admission"
- dependency-name: "k8s.io/sample-apiserver"
Reference in New Issue Copy Permalink