Repository navigation
feat: setup Dependabot for kubeflow/notebooks - #1014
Conversation
|
/ok-to-test |
9d7b48d to
2c3716e
Compare
andyatmiami
left a comment
andyatmiami
left a comment
There was a problem hiding this comment.
thanks for driving forward on this @christian-heusel
just a couple comments to address and/or respond to:
angularinfrontendfornotebooks-v2seems like a copy/paste error- i'm not convinced the
dockersection really provides much value right now
2c3716e to
3d9f0aa
Compare
Main things to note about this setup are the following ones: - We target three different branches (`main`, `notebooks-v1`, `notebooks-v2`) via the `target-branch` directive - The `cooldown` option delays updates a little to as a prevention mechanism for supply-chain attacks, similar to the `min-release-age` in NPM - We try to group dependencies where sensible, however this will most likely need a bit of iteration - Only allow non-breaking upgrades for things like the k8s packges and angular - Disable some targets that can be re-enabled later on Fixes kubeflow#818 Signed-off-by: Christian Heusel <christian@heusel.eu>
3d9f0aa to
4f95a89
Compare
andyatmiami
left a comment
andyatmiami
left a comment
There was a problem hiding this comment.
Thanks for addressing feedback @christian-heusel - just wanna get some thoughts from frontend folks in case they have strong opinions on what this should look like out the gate ...
|
/lgtm @thesuperzapper - need you to approve as this lives on |
|
Thanks this is great to start automatically telling us about dependency updates, we can uncommnent the notebooks-v2 ones once we have E2E tests and are more confident in merging updates. /approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: thesuperzapper The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
github-project-automation
Bot
moved this from Needs Triage
to Done
in Kubeflow Notebooks
Main things to note about this setup are the following ones:
main,notebooks-v1,notebooks-v2) via thetarget-branchdirectivecooldownoption delays updates a little to as a prevention mechanism for supply-chain attacks, similar to themin-release-agein NPM (see ci: set min age fornpminstalled packages #1003)notebooks-v1is disabled to keep a good signal-to-noise ratio when starting outFixes #818
cc @jenny-s51 who did the initial version of this in #819
cc @andyatmiami who also gave a lot of input during development
I have already used this in a separate repository to evaluate it, checkout https://github.com/christian-heusel/notebooks-playground if you want to have a look!