question: how do we handle when there're new package updates?

[tuananh]

how do we handle when there're new package updates? is there any job to notify if a package is stale?

[kaniini]

we are building a bot to automatically attempt package updates :)

[tuananh]

that's great to hear. is there a timeline for it? I'm very curious how Wolfi is going to handle it. I mean dealing with github release is alright but there are packages hosted on personal domain, etc...

[Dentrax]

Yesterday, I was about to file an issue for bot proposal. Today, I saw this issue when I ended up here to open a new issue, what a coincidence!

My bot idea was simple: It should traverse all y{aml,ml} files, read the content as build.Configuration, extract the package.version, pipeline[] | with uses: fetch selector to get repo releases (a tricky point since not all URIs are GitHub, custom fetcher per host may require). Apply the new changes and export the mutated config structure. PR the changes. Something like this.

cc @developer-guy

[rawlingsj]

is there a timeline for it?

Hope to have something early next week.

[rawlingsj]

My bot idea was simple: It should traverse all y{aml,ml} files, read the content as build.Configuration, extract the package.version, pipeline[] | with uses: fetch selector to get repo releases (a tricky point since not all URIs are GitHub, custom fetcher per host may require). Apply the new changes and export the mutated config structure. PR the changes. Something like this.

Yeah this is a similar approach that we're experimenting with ATM. As well as using a service like https://release-monitoring.org/ to know about new package updates. Should have something to share next week.

[Lunarequest]

Maybe we could add something like f-e-d-c https://github.com/flathub/flatpak-external-data-checker