Set up Dependabot #14199
Set up Dependabot #14199
Conversation
Signed-off-by: Sora Morimoto <sora@morimoto.io>
| - package-ecosystem: github-actions | ||
| directory: / | ||
| schedule: | ||
| interval: daily |
There was a problem hiding this comment.
Hm, perhaps weekly (or monthly) would do?
Also, beware of
ocaml/.github/workflows/build.yml
Lines 275 to 276 in 12e34c5
which is using
checkout@v1 on purpose as the i386 workflows don't work on newer versions.
There was a problem hiding this comment.
Yeah, that's a good point. It would be nice if only that line could be disabled.
|
(I'm not excited by Dependabot in general, but no worry on my side if this is restricted to github actions -- and not other kind of dependencies of the OCaml distribution. I think the people helping with github actions should decide.) |
|
It only affects GitHub Actions, of course, but Jan's point is certainly a good one. |
|
I'd be more excited by a bot which commented on PRs that actually update the workflows (which is when I tend to check for new versions of the actions). FWIW, actions/checkout@v5 doesn't actually change or fix anything beyond the interpreter it runs on 🤷 |
I’m gonna set up Dependabot to auto-update GitHub Actions versions, like in the other OCaml org repos. Just adding a config file makes it work. Lately I saw some repos already using the new
actions/checkoutrelease and some not.Ref: ocaml/graphics#50