1607327 - switch to dependabot (ichnaea)

Status: RESOLVED FIXED

(Location :: General, task, P1)

Description

[Will Kahn-Greene [:willkg] ET needinfo? me]

Seems like pyup is dead. There are several options to switch to, one of which is dependabot. dependabot seems fine except that it doesn't do batch updates, so it'll create one PR per library that needs updating.

There's an issue for implementing batch updates, so I think that'll happen eventually.

In the meantime, having that even without the batch updates is significantly better than having pyup do nothing and having to assemble it by hand.

Comment 1

[Will Kahn-Greene [:willkg] ET needinfo? me]

I think I have access to add this to Ichnaea. Grabbing this to do now.

I'll set it up similarly to how we set up pyup.

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

Attachment: pr 1022: bug 1607327: switch to dependabot

Comment 3

[Will Kahn-Greene [:willkg] ET needinfo? me]

jwhitlock merged PR #1022: "bug 1607327: switch to dependabot" in aa49a6f.

Comment 4

[Will Kahn-Greene [:willkg] ET needinfo? me]

I added ichnaea to dependabot and now the PRs are flowing in. OMG.

The next step is to shut off pyup. I don't know how to do that offhand. I did remove the config file, but if pyup ever starts working again, it'll switch to the default configuration for the org. That would be unenthusing.

Comment 5

[Will Kahn-Greene [:willkg] ET needinfo? me]

Ichnaea is on dependabot and got a slew of PRs.

Ichnaea is no longer in pyup (thank you, Greg!).

We're done here.

Comment 6

[Will Kahn-Greene [:willkg] ET needinfo? me]

Oh, whoops--it's not removed from pyup, yet. I'm re-opening.

Comment 7

[Will Kahn-Greene [:willkg] ET needinfo? me]

Ichnaea is now removed from pyup. We're all done here.