Skip to content

Commit

Permalink
Rip out dependabot - its worse than useless - its annoying
Browse files Browse the repository at this point in the history
Dependabot has a ton of issues with its rust integration that makes
it wholly useless, and very annoying:
 * It has no concept of MSRV, opening PRs that are not going to pass
   CI.
 * It has no concept of patch-level - if we depend on tokio 1.X,
   that means any version of tokio > 1.X, but dependabot insists on
   opening a PR to "update us" to tokio 1.X + 1, even though it
   doesn't impact what version of our users use (and often violates
   MSRV).
 * It has no concept of dependencies that rely on each other,
   causing it to open a PR to update us to bitcoin_hashes X + 1,
   even though we're still depending on rust-bitcoin Y which
   depends on bitcoin_hashes X, causing build failure.
 * It hogs CI resources, getting CI run twice, once for the branch
   once for the PR.
 * It creates branches directly on the rust-lightning repo, making
   it look like the work is somehow connected to the
   lightningdevkit project, even though it isn't, and spamming the
   local clones of project contributors.

At the end of the day, dependabot has never meaningfully
contributed to notifying us of an important dependency, and,
really, we don't have enough dependencies for it to matter.
  • Loading branch information
TheBlueMatt committed Jul 13, 2022
1 parent f3d5b94 commit a911ca8
Showing 1 changed file with 0 additions and 36 deletions.
36 changes: 0 additions & 36 deletions .github/dependabot.yml

This file was deleted.

0 comments on commit a911ca8

Please sign in to comment.