dependabot / dependabot/dependabot-core
How can I match `dependabot-updater-*` releases to `dependabot-core` releases?
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Code improvement description
Hi 👋
Thank you for all the recent work about automating releases
One question that I have at the moment is how should we match `dependabot-core` releases to updater releases.
For example, at the time of this writing, the latest release for `dependabot-updater-npm` is [v2.0.20230823005255](https://github.com/orgs/dependabot/packages/container/dependabot-updater-npm/121066535?tag=v2.0.20230823005255) while the latest release of `dependabot-core` is [v0.227.0](https://github.com/dependabot/dependabot-core/releases/tag/v0.227.0)
In an ideal world, these two should have the same version as previously I used to just pull the image `dependabot/dependabot-core:{tag}` that used to map 1:1
At the same time, I understand that this is hard to correct at this point as you already published versions in a different range and you can't probably go back to the 0.x range
How do you know what's the right version to use between the released version of each artifact?
I am currently using the [CI logs](https://github.com/dependabot/dependabot-core/actions/runs/5904774850/job/16017572751) that in this case points to `v2.0.20230818161341` but that's manual and tedious
Contributor guide
Research direction
Review the linked dependabot-core v0.227.0 release, dependabot-updater-npm v2.0.20230823005255 package, and CI log. Determine the authoritative relationship between core and updater releases, then document how users should identify the matching updater version without manual log inspection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- release
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100