Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EVG-15449: use Dependabot for automated dependency upgrades #247

Merged
merged 1 commit into from
Dec 1, 2021
Merged

EVG-15449: use Dependabot for automated dependency upgrades #247

merged 1 commit into from
Dec 1, 2021

Conversation

Kimchelly
Copy link
Contributor

Jira: https://jira.mongodb.org/browse/EVG-15449

This enables Dependabot automatic upgrades for Go modules. Dependabot will periodically check all dependencies in go.mod for newer stable versions (it doesn't upgrade unversioned repos) and bump them if there's a newer one available. This initial merge will also trigger Dependabot to do an immediate check for new dependency versions, so merging this may trigger other Dependabot PRs to be opened.

  • Check for updates monthly to make it minimally annoying.
  • Increase the open PR limit from the default of 5. It's preferable to get all the available upgrades ASAP rather than have Dependabot incrementally give us a subset of all the available updates.
  • I set myself as the reviewer on all the Dependabot PRs and merge the ones that appear every month. If they pass CI tests, they'll be merged. If not, I'll open tickets to triage, investigate, and fix so that we can upgrade.

@Kimchelly Kimchelly merged commit 2d3068f into mongodb:main Dec 1, 2021
@Kimchelly Kimchelly deleted the EVG-15449_dependabot branch December 1, 2021 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant