Dependabot configuration notes
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 61
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
This is just an observation, that currently dependabot is tracking the main branch of our submodules and thus will produce PRs for all commits.
There is currently no way to get dependabot to only update submodules when a new version is tagged.
This is a long standing complaint:
https://github.com/dependabot/dependabot-core/issues/1639
There is a PR to address this:
https://github.com/dependabot/dependabot-core/pull/13052
But it is not yet merged.
Current strategy is to check manually if the update corresponds to a release, and to simply close PRs for main branch commits with no tags.
If this gets too annoying we can disable dependabot.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue records Dependabot behavior for submodules and links to dependabot-core issue #1639 and pull request #13052, but names no repository files, tests, or concrete change. Read those references first; the current strategy is manual checking and closing untagged updates, so completion criteria are not defined.
Written by the indexing model from the issue text.
Assessment
- Domain
- devops
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100