freedomofpress / freedomofpress/securedrop-dev

Automate routine dependency updates (that dependabot can't)

Open
#28 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

We have some dependencies that we need to routinely update, but dependabot can't do them because they're not straightforward package things.

Primarily this includes:

Infra has some new update tooling that we should be able to leverage for this purpose.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the Rust toolchain update example in securedrop-client#2458 and the securedrop-builder update commit 6c0a257df6e574a5f5b756db866197b482759eb6. Then inspect the new update tooling from Infra and determine how it could cover these non-package dependencies. Done means routine updates for both targets are automated and the resulting changes can be verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, rust
Domain
build-system, devops, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.