Dex tagging on master branch to support dependabot

[janisz]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Problem Description

Dependabot does not works with dex. The last version it recognizes is 2.13.1 and incorectly tries to downgrade to it.

Proposed Solution

Tag on the main branch as described in dependabot/dependabot-core#6947 (comment)

Alternatives Considered

No response

Additional Information

• Dependabot downgrades Go mod incompatible dependency  dependabot/dependabot-core#6947 (comment)

[sagikazarmark]

New minor versions are tagged from the main branch, patch versions are tagged from release branches, but I'm not sure I understand the problem with that.

Also, Dex is not supposed to be imported as a module under normal circumstances. Can I ask what your use case is for doing so?

[janisz]

We are using just open shift connector as a lib.
https://sourcegraph.com/search?q=context:global+repo:%5Egithub%5C.com/stackrox/stackrox%24+dexidp&patternType=standard&sm=1&groupBy=path

[sagikazarmark]

Looking at this again: I believe the explanation given in the linked issue is wrong.

Most tags are indeed on the main branch (except maybe some patch versions that contain backported fixes)

The pseudo version is the result of the fact the Dex module does not have a /v2 segment as required by Go modules. It was a decision made early that we can't change at this point. If Dex ever sees a version 3, we are going to fix it.

Again, Dex is not really supposed to be imported as a library, so it's not really prepared for this use case.

[sagikazarmark]

I'm gonna close this issue for now as there isn't anything we can do at the moment.