[ci] Disable dependabot PRs#11072
Conversation
|
These are security updates. I think we should at least consider keeping this bot. There are many new PRs opened because we've fallen behind on security-related updates. |
|
Dependabot in principle is good but the PR workflow it uses isn’t great for us (it swarms CI with a bunch of jobs since each update spawns 2 CI jobs, one for the PR and another for the in-repo branch). I think it’d be better to use the alerts and do the updates ourselves: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts |
A bunch of these just got created (e.g. #11070) and are clogging up CI with 2x normal number of builds since they push to a branch and make a PR.
|
It has been a while since this PR was updated, @areusch please leave a review or address the outstanding comments. @driazati if this PR is still a work in progress, please convert it to a draft until it is ready for review. |
|
@kparzysz-quic i do think it would be good to avoid excessive CI load from dependabot. Also, I'm not sure it will know how to work with gen_reqiurements...we'll likely need to adopt a reqiurements.txt style for specifying our deps. maybe we could revisit the PRs when we do that? |
|
Sure, I'm ok with disabling it. |
A bunch of these just got created (e.g. apache#11070) and are clogging up CI with 2x normal number of builds since they push to a branch and make a PR. Co-authored-by: driazati <driazati@users.noreply.github.com>
A bunch of these just got created (e.g. apache#11070) and are clogging up CI with 2x normal number of builds since they push to a branch and make a PR. Co-authored-by: driazati <driazati@users.noreply.github.com>
A bunch of these just got created (e.g. apache#11070) and are clogging up CI with 2x normal number of builds since they push to a branch and make a PR. Co-authored-by: driazati <driazati@users.noreply.github.com>
3 participants
A bunch of these just got created (e.g. #11070) and are clogging up CI with 2x normal number of builds since they push to a branch and make a PR.
cc @Mousius @areusch