Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Demonstrate switch from buildSrc/version.properties to gradle/libs.versions.toml to enable dependabot to perform automated upgrade #206

Merged
merged 18 commits into from
Oct 11, 2024

Conversation

cwperks
Copy link
Owner

@cwperks cwperks commented Oct 11, 2024

Description

Opening this PR in draft to explore what it will take to enable dependabot to perform automated upgrades on the dependency versions listed in buildSrc/version.properties.

This issue came up for discussion on my very first PR on the project: opensearch-project#3772.

Dependabot works on version catalogs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#gradle

To test this I pushed to the main branch of my fork and used Dependabot CLI to run dependabot in a dry-run mode where it displays what PRs would be created without actually creating a PR.

To test, I created a sample dependabot configuration like this:

job:
  package-manager: gradle
  allowed-updates:
    - update-type: all
  source:
    provider: github
    repo: cwperks/opensearch
    directory: /

And ran it with ~/go/bin/dependabot update -f ./.github/dependabot_server.yml

See joda update in the output:

updater | +-------------------------------------------------------------------------------------------+
updater | |                            Changes to Dependabot Pull Requests                            |
updater | +---------+---------------------------------------------------------------------------------+
updater | | created | org.apache.ant:ant ( from 1.10.14 to 1.10.15 )                                  |
updater | | created | com.netflix.nebula:gradle-extra-configurations-plugin ( from 10.0.0 to 10.0.1 ) |
updater | | created | com.netflix.nebula:nebula-publishing-plugin ( from 21.0.0 to 21.1.0 )           |
updater | | created | com.netflix.nebula:gradle-info-plugin ( from 12.1.6 to 13.3.0 )                 |
updater | | created | org.apache.rat:apache-rat ( from 0.15 to 0.16.1 )                               |
updater | | created | net.java.dev.jna:jna ( from 5.14.0 to 5.15.0 )                                  |
updater | | created | com.avast.gradle:gradle-docker-compose-plugin ( from 0.17.6 to 0.17.9 )         |
updater | | created | org.apache.maven:maven-model ( from 3.9.6 to 3.9.9 )                            |
updater | | created | com.networknt:json-schema-validator ( from 1.2.0 to 1.5.2 )                     |
updater | | created | org.ajoberstar.grgit:grgit-core ( from 5.2.1 to 5.3.0 )                         |
updater | | created | org.wiremock:wiremock-standalone ( from 3.6.0 to 3.9.1 )                        |
updater | | created | org.spockframework:spock-core ( from 2.3-groovy-3.0 to 2.3-groovy-4.0 )         |
updater | | created | joda-time:joda-time ( from 2.12.7 to 2.13.0 )                                   |
updater | +---------+---------------------------------------------------------------------------------+

Related Issues

Resolves opensearch-project#3782

Check List

  • Functionality includes testing.
  • API changes companion pull request created, if applicable.
  • Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
@cwperks cwperks merged commit a811208 into main Oct 11, 2024
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Dependabot does not scan for versions in versions.properties
1 participant