Skip to content

gh-109110: Hash-pin GitHub Actions #109111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pnacht wants to merge 2 commits into from
Closed

gh-109110: Hash-pin GitHub Actions #109111

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
00a7453
Hash-pin GitHub Actions
pnacht Sep 7, 2023
a5a850f
Set dependabot to use grouped updates
pnacht Sep 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Set dependabot to use grouped updates 
Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
  • Loading branch information
@pnacht
pnacht committed Sep 7, 2023
commit a5a850f8c3216e065b93db4f424927df0eae5d62
9 changes: 4 additions & 5 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,10 @@ updates:
labels:
- "skip issue"
- "skip news"
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-minor"
- "version-update:semver-patch"
Comment on lines -10 to -14
Copy link
Copy Markdown
Contributor

@ambv ambv Sep 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dependabot doesn't just update GHA, this looks like will cause deps in Doc/requirements.txt to start pinging us with every micro-release, no?

Copy link
Copy Markdown
Author

@pnacht pnacht Sep 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not visible in the PR diff, but the start of this block in the dependabot.yml file declares it's only for GitHub Actions.

There is another block with - package-ecosystem: pip which handles version bumps for Python dependencies, but it's actually only looking at the /Tools/ directory. And that block doesn't have an ignore field, so CPython is currently receiving minor and patch version bumps for those dependencies (example).

However, Doc/requirements.txt is currently ignored by dependabot version bumps. (But it still receives security updates whenever a dependency has a vulnerability).

groups:
github-actions:
patterns:
- "*"
- package-ecosystem: "pip"
directory: "/Tools/"
schedule:
Expand Down