Attila Doroszlai created HDDS-17608:
---------------------------------------
Summary: Use Forking Renovate to upgrade Maven dependencies
Key: HDDS-17608
URL: https://issues.apache.org/jira/browse/HDDS-17608
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Attila Doroszlai
Some problems with Dependabot:
- It eagerly creates pull requests, regardless of an update's merits or
compatibility. Sometimes dependencies have "no-op" releases, or come with
changes irrelevant for our project. We can simply close the pull request, but
it is still an unnecessary CI run.
- It creates branches in the main repo for its PRs instead of using a fork.
- It only updates the default branch ({{master}}). If older release branches
are on different minor/major version of some dependency, then we need a
separate change, not a simple backport.
- Cooldown does not seem to work the way it is [described in
docs|https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-].
It is supposed to upgrade to the current latest version _if there was no more
recent release within the cooldown period_. Instead, it simply updates to the
_latest version that predates the cooldown period_. So it just delays updates,
does not skip them. This puts the burden on the reviewer to check if there are
even newer versions than the one in the PR.
- It cannot cope with multiple versions of the same dependency (e.g. Hadoop in
Ozone).
[Renovate|https://docs.renovatebot.com/] is a third-party tool, but free for
open source projects. Apache Infra's [GitHub Actions
Policy|https://infra.apache.org/github-actions-policy.html] mentions it as an
alternative to Dependabot. According to the docs, it solves some problems
mentioned:
- can create draft PRs
- there is a version that [uses forks|https://github.com/apps/forking-renovate]
- can maintain multiple branches
We should check what is needed to use it for Apache Ozone, and start using it
if possible.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
