Configure Dependabot

[ghost]

We should have dependabot enabled to make sure that our dependencies are up-to-date

[enricogior]

Which dependencies are you referring to?

[ghost]

Nuget, GitHub Actions

[enricogior]

Only we can then skip those notifications and not being spammed.
Nuget packages update is not something that should be done without validation of the updates.
In August we had a serious bug because of a blind update.

[ghost]

Well only for GitHub Actions? @jsoref's Action is in alpha. Surely it is better to keep it up-to-date?

[ghost]

something that should be done without validation of the updates.

It's like an ordinary PR. You will have CI running and you would have to approve it. You can checkout the branch and build and test yourself.

[ghost]

You don't have to upgrade dependencies manually like in #7618. Dependabot also includes the changelog and individual commits between the old and the new version in the PR so that you can scan through it to find any possible incompatibilities.

[enricogior]

OK

[ghost]

Also since each dependencies have its own PR. Its easy to validate each dependency/accept only upgrading some dependencies

[jsoref]

Fwiw, I'm likely to make a PR for my action for at least the next version, but in the long run, it's probably worth having dependabot do the legwork (in the near term, it's probably more likely to update the checkout action periodically).

[ghost]

I am already bombarded with Pull Requests. I don't think we should merge them until after the release of 0.27. I haven't finished configuring it yet. I have to add every single directory with project file in the config file. There might be a better way of doing this. I just don't know

See https://github.com/alannt777/PowerToys/pulls

[ghost]

There are 76 pull requests to be exact

[ghost]

This is a problem. Since we have 76 pull requests, we cannot merge them right in. We would have to be slow and precise while merging them to make sure that nothing goes wrong.

Then one could say, "Don't bother"

That does not make sense in a security point of view and it is important to use the newer version (not necessary to have the latest unless in the event of a security vulnerability)

[Aaron-Junker]

Does this make the build process longer? When yes i'm not for this. But when not its ok for me

[ghost]

This has nothing to do with the build. I runs once every day in GitHub-hosted servers, not in Azure Pipelines

[ghost]

UPDATE: 102 pull requests

[jsoref]

For perspective, the overhead is mostly review (and if you're paying for the build time triggered by PRs). We run it w/ some small repos w/ quite a few scala/java and yarn dependencies and allocate a non trivial amount of time reviewing the PRs and approving them (a fractional person per week out of a small team).

The other approach is to ignore the problem and then deal with breakage/security problems on the late side.

Both approaches are frustrating. In the long run, it's better to let dependabot incrementally manage the PRs than try to upgrade everything at once with months in between upgrades and have no idea what caused a break.

[ghost]

How about adding project directories into Dependabot config slowly? This would drastically reduce the amount of PRs and it becomes easy to manage everything.

[crutkas]

Reason why you don’t do dependencies in all the time is you have to test. We do this at the start of an iteration typically.

If something also is stable, we may not want to update intentionally. More so with code paths we don’t update regularly

[crutkas]

@jsoref please make a dedicated PR.

[ghost]

Will have to wait for dependabot/dependabot-core#2178

[crutkas]

@alannt777, something shouldn't be in progress before we've agreed to the work

[crutkas]

Sync'ed with @enricogior, we want to be very deliberate on updating. We do this update monthly and do have automated security bots that warn us for security issues.