mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-11-09 16:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
ee503fae54
ceph-csi/.github/dependabot.yml

102 lines
2.9 KiB
YAML
Raw Normal View History

ci: add dependabot config for updating vendored packages Vendored dependencies need updating on regular basis. This is currently done manually by developers, but it can be automated by Dependabot. By dropping the dependabot.yml config file in the .github/ directory the bot should get enabled. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-08-26 15:57:12 +00:00
---
version: 2
ci: use dependabot group feature enable dependabot raising PR by groups to reduce PR and save CI resources. This uses the beta groups feature of dependabot More details here https://docs.github.com/en/code-security/\ dependabot/dependabot-version-updates/\ configuration-options-for-the-dependabot.yml-file#groups Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2023-08-29 07:20:20 +00:00
enable-beta-ecosystems: true
ci: add dependabot config for updating vendored packages Vendored dependencies need updating on regular basis. This is currently done manually by developers, but it can be automated by Dependabot. By dropping the dependabot.yml config file in the .github/ directory the bot should get enabled. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-08-26 15:57:12 +00:00
updates:
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
ci: do not let dependabot automatically rebase When dependabot creates a PR, and an other gets merged, the bot automatically triggers a rebase. This will drop any approvals, causing delays in the review/merge process. The project uses Mergify to automatically rebase when needed, and approvals are retained when Mergify rebases PR. By disabling the auto-rebasing done by dependabot, fewer rebases should be needed, contributors only need to review once, and CI jobs are triggered less often. Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-11-02 11:02:06 +00:00
rebase-strategy: "disabled"
ci: use dependabot group feature enable dependabot raising PR by groups to reduce PR and save CI resources. This uses the beta groups feature of dependabot More details here https://docs.github.com/en/code-security/\ dependabot/dependabot-version-updates/\ configuration-options-for-the-dependabot.yml-file#groups Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2023-08-29 07:20:20 +00:00
groups:
golang-dependencies:
patterns:
- "github.com/golang*"
ci: group golang.org/x/ under golang dependencies Golang dependencies are already grouped, but they only contain packages from `github.com/golang*`. There are more Golang standard packages that are located at `golang.org/x/*`. Because of the tight relationship between these packages, it is more efficient to group updates together. Signed-off-by: Niels de Vos <ndevos@ibm.com>
2023-10-10 07:37:02 +00:00
- "golang.org/x/*"
ci: use dependabot group feature enable dependabot raising PR by groups to reduce PR and save CI resources. This uses the beta groups feature of dependabot More details here https://docs.github.com/en/code-security/\ dependabot/dependabot-version-updates/\ configuration-options-for-the-dependabot.yml-file#groups Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2023-08-29 07:20:20 +00:00
k8s-dependencies:
patterns:
- "k8s.io*"
- "sigs.k8s.io*"
github-dependencies:
patterns:
- "github.com*"
exclude-patterns:
ci: do not include go-ceph in generic GitHub package rebases go-ceph is an important package that we consume. It is better to have that as separate rebase PR from Dependabot and not include it in the general GitHub package group. Signed-off-by: Niels de Vos <ndevos@ibm.com>
2023-10-11 07:36:25 +00:00
- "github.com/ceph/*"
ci: use dependabot group feature enable dependabot raising PR by groups to reduce PR and save CI resources. This uses the beta groups feature of dependabot More details here https://docs.github.com/en/code-security/\ dependabot/dependabot-version-updates/\ configuration-options-for-the-dependabot.yml-file#groups Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2023-08-29 07:20:20 +00:00
- "github.com/golang*"
- "github.com/container-storage-interface/spec"
ci: add dependabot config for updating vendored packages Vendored dependencies need updating on regular basis. This is currently done manually by developers, but it can be automated by Dependabot. By dropping the dependabot.yml config file in the .github/ directory the bot should get enabled. See-also: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-08-26 15:57:12 +00:00
labels:
- rebase
commit-message:
prefix: "rebase"
ci: ignore k8s.io/kubernetes dependencies These dependencies are pulled in by k8s.io/kubernetes with version v0.0.0. It is therefore required to use 'replace' in go.mod to select a compatible version of the additional k8s.io packages. Dependabot does not seem to update packages listed in 'replace', only under 'require'. That means, the version updates done by Dependabot do not have any effect, as the contents is replaced with a different version anyway. Ignoring these packages prevents the creation of non-functional PRs. Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-08-31 07:28:02 +00:00
ignore:
# k8s.io/kubernetes prevents auto-updating these
- dependency-name: "k8s.io/api"
- dependency-name: "k8s.io/apiextensions-apiserver"
- dependency-name: "k8s.io/apimachinery"
- dependency-name: "k8s.io/apiserver"
- dependency-name: "k8s.io/cli-runtime"
- dependency-name: "k8s.io/client-go"
- dependency-name: "k8s.io/cloud-provider"
- dependency-name: "k8s.io/cluster-bootstrap"
- dependency-name: "k8s.io/code-generator"
- dependency-name: "k8s.io/component-base"
- dependency-name: "k8s.io/component-helpers"
- dependency-name: "k8s.io/controller-manager"
- dependency-name: "k8s.io/cri-api"
- dependency-name: "k8s.io/csi-translation-lib"
- dependency-name: "k8s.io/kube-aggregator"
- dependency-name: "k8s.io/kube-controller-manager"
- dependency-name: "k8s.io/kube-proxy"
- dependency-name: "k8s.io/kube-scheduler"
- dependency-name: "k8s.io/kubectl"
- dependency-name: "k8s.io/kubelet"
- dependency-name: "k8s.io/legacy-cloud-providers"
- dependency-name: "k8s.io/metrics"
- dependency-name: "k8s.io/mount-utils"
- dependency-name: "k8s.io/pod-security-admission"
- dependency-name: "k8s.io/sample-apiserver"
ci: add actions/retest to dependabot checks Adding actions/retest to the dependabot configuration makes sure all vendored packages will get updated when new releases are available. Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-11-18 07:24:04 +00:00
- package-ecosystem: "gomod"
directory: "/actions/retest"
schedule:
interval: "weekly"
rebase-strategy: "disabled"
labels:
- rebase
- ci/skip/e2e
ci: no need to run multi-arch-build for `/actions/retest` Signed-off-by: Niels de Vos <ndevos@redhat.com>
2023-02-20 12:46:23 +00:00
- ci/skip/multi-arch-build
ci: add actions/retest to dependabot checks Adding actions/retest to the dependabot configuration makes sure all vendored packages will get updated when new releases are available. Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-11-18 07:24:04 +00:00
commit-message:
prefix: "rebase"
ci: add `/api` to dependabot configuration Signed-off-by: Niels de Vos <ndevos@redhat.com>
2023-02-20 12:45:36 +00:00
- package-ecosystem: "gomod"
directory: "/api"
schedule:
interval: "weekly"
rebase-strategy: "disabled"
ci: use dependabot group feature enable dependabot raising PR by groups to reduce PR and save CI resources. This uses the beta groups feature of dependabot More details here https://docs.github.com/en/code-security/\ dependabot/dependabot-version-updates/\ configuration-options-for-the-dependabot.yml-file#groups Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2023-08-29 07:20:20 +00:00
groups:
golang-dependencies:
patterns:
- "github.com/golang*"
k8s-dependencies:
patterns:
- "k8s.io*"
- "sigs.k8s.io*"
github-dependencies:
patterns:
- "github.com*"
exclude-patterns:
- "github.com/golang*"
ci: add `/api` to dependabot configuration Signed-off-by: Niels de Vos <ndevos@redhat.com>
2023-02-20 12:45:36 +00:00
labels:
- rebase
- ci/skip/e2e
- ci/skip/multi-arch-build
commit-message:
prefix: "rebase"
ci: Included githubactions in the dependabot config This should help with keeping the GitHub actions updated on new releases. This will also help with keeping it secure. Dependabot helps in keeping the supply chain secure: https://docs.github.com/en/code-security/dependabot GitHub actions up to dat: e https://docs.github.com/en/code-security/dependabot/ \ working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot dependency-update-tool: https://github.com/ossf/scorecard/blob/main/docs/checks.md Signed-off-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2022-05-03 14:21:45 +00:00
- package-ecosystem: "github-actions"
directory: "/"
schedule:
ci: fix formatting for the interval in dependabot configuration as per the documentation `""` has to be mentioned for the schedule interval value field. This commit ensures it and make it consistent. Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
2022-11-11 13:31:34 +00:00
interval: "weekly"
rebase-strategy: "disabled"
ci: Included githubactions in the dependabot config This should help with keeping the GitHub actions updated on new releases. This will also help with keeping it secure. Dependabot helps in keeping the supply chain secure: https://docs.github.com/en/code-security/dependabot GitHub actions up to dat: e https://docs.github.com/en/code-security/dependabot/ \ working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot dependency-update-tool: https://github.com/ossf/scorecard/blob/main/docs/checks.md Signed-off-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2022-05-03 14:21:45 +00:00
labels:
- rebase
- ci/skip/e2e
commit-message:
ci: fix formatting for the interval in dependabot configuration as per the documentation `""` has to be mentioned for the schedule interval value field. This commit ensures it and make it consistent. Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
2022-11-11 13:31:34 +00:00
prefix: "rebase"
Reference in New Issue Copy Permalink