Enable dependabot for libraries

[dmikurube]

No description provided.

[hiroyuki-sato]

LGTM👍

Could you tell me the detail about dependabat check libraries?

gradle/libs.versions.toml contains the following libraries.

    compileOnly libs.embulk.spi
    compileOnly libs.slf4j

    implementation libs.embulk.util.config
    implementation libs.validation
    implementation platform(libs.jackson.bom)
    implementation libs.bundles.jackson

    implementation libs.embulk.util.file

    implementation libs.commons.compress
    implementation libs.commons.codec
    implementation libs.commons.io
    implementation libs.commons.lang3

.github/dependabot.yml contains.

      - dependency-name: "org.embulk.embulk-plugins"
      - dependency-name: "org.embulk:embulk-spi"
      - dependency-name: "org.embulk:embulk-util-config"
      - dependency-name: "org.embulk:embulk-util-file"
      - dependency-name: "org.apache.commons:commons-lang3"
      - dependency-name: "commons-codec:commons-codec"
      - dependency-name: "commons-io:commons-io"
      - dependency-name: "org.apache.commons:commons-compress"

There are no entries slf4j and jackson and validation. IIUC, Those libraries update without dependabat. So, It does not contain in .github/dependabot.yml
Is my understanding correct?

[dmikurube]

Good question. For built-in plugins, I now enable dependabot only for :

• implementation dependencies (not for compileOnly nor testImplementation)
  • slf4j-api is rejected.
  • embulk-spi is our own, then to be upgraded, though.
• Non-Jackson
  • Jackson is often sensitive about compatibilities between versions.
  • I now think it still needs manual confirmation.
  • We may try automatic upgrades only for "the patch version (the third digit)" later.
• Non-Validation API
  • Validation API would just follow embulk-util-config.

[hiroyuki-sato]

Thanks! LGTM👍

I created the issue embulk/embulk#1658 for future development.

[dmikurube]

Thanks!

Documenting is always good, but note that the policy may often change depending on the siatuations, including the tooling quality, the update policy of each library project, our clean up, and else...