Skip to content

Conversation

@cyrorama
Copy link
Contributor

This PR updates the dependabot settings to add auto merge support.

See this for more info: https://docs.google.com/document/d/1IsbASOo7kSbDrFGYvdOjyUfzZhbprcnh8qtehE4U1ew/edit

github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Approve and merge Dependabot PRs for development dependencies
# Auto-merge the PR if either:
# a) it has the `development-dependencies` label, which we add for certain
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This dependabot setup differs from the norm. It is missing the steps:

  • Get unique committers
  • Disable auto-merge if there are commits from someone other than Dependabot
  • Add the Needs QA label to dependabots after any change by someone other than the dependabot bot

I believe I set it up like this a while back by guidance from @JacobEvelyn . IIRC, I think we omitted these because it wasn't needed. Additionally, we don't use buildkite here since the code is small enough to rely on github actions.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cyrorama if we're assigning these out it seems a little strange to me that we wouldn't disable auto-merging if someone had committed on a PR here. I'm not clear on what we gain from not doing those steps really. Any thoughts?

Copy link

@mkrumholz mkrumholz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cyrorama sorry I missed this update earlier. This looks good to me!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants