Repository navigation
Conversation
Dependabot ignores github.com/basecamp/basecamp-sdk/go for version updates; security updates still come, since they honour only an ignore's explicit versions.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Member
Author
|
Closing. Rob answered on the pipeline card: Dependabot stays the main path for SDK bumps, and sdk-bump (basecamp/coworker#281) becomes the backstop. It opens its own PR only when Dependabot's is missing after a grace period or fails to build. So no ignore is needed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Dependabot stops opening version updates for
github.com/basecamp/basecamp-sdk/go. SDK bumps will come from coworker's sdk-bump (basecamp/coworker#281). On the day a release is published it opens one PR here that bumps the module, refreshes the Nix vendorHash and sdk-provenance.json, and runs go build and go vet. It opens even when the bump doesn't compile, with the errors in the body. It closes Dependabot's older SDK bumps in favour of its own.Why
Dependabot's grouped Go bump has carried the SDK until now. Every 0.x minor breaks the API, so that bump came days late and failed to compile: #911 opened four days after v0.25.0 and is still open.
Security updates for the SDK keep coming. An ignore with no
versionsblocks version updates only: for security updates Dependabot applies just the explicitversions(dependabot-core:return versions if security_updates_only).Merge order: sdk-bump's schedule entry is still disabled. Merge this when it gets turned on. Merged before then, nothing bumps the SDK here except a person.
Testing
.github/dependabot.ymlchanges.Summary by cubic
Adds a Dependabot ignore for
github.com/basecamp/basecamp-sdk/goso SDK version bumps come from coworker's sdk-bump instead of Dependabot's grouped bump, which arrived days late and didn't compile since each 0.x minor breaks the API. Security updates still arrive: Dependabot applies only an ignore's explicitversionsto those.Merge this only after sdk-bump's schedule entry is enabled, otherwise nobody bumps the SDK here except a person.
Written for commit 8fdb71e. Summary will update on new commits.