chore: replace dependabot with renovate - #72
Merged
Conversation
Operator decision: one dependency tool for the platform unless the second can do something the first cannot. config:recommended enables the github-actions and dockerfile managers, so coverage is unchanged. This repo was missed in the first sweep because the survey command used `head -5` and the truncated output was read as the complete list. Four repos carry dependabot; three are forks whose upstream config is not ours to change, and this was the fourth.
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
PR Code Suggestions ✨No code suggestions found for the PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Why
One dependency tool for the platform unless the second does something the first cannot.
config:recommendedenables the github-actions and dockerfile managers, so coverage is unchanged.Note on how this was found
This repo was missed in the first sweep — the survey command used
head -5and I read the truncated output as the complete list. Four repos carry dependabot; three are forks whose upstream config is not ours to change, and this is the fourth.Renovate is the standard because the platforms dependency surface is mostly things dependabot cannot see: 21 ArgoCD Helm chart pins and 11 kustomization
newTagfields.PR Type
Other
Description
Remove
.github/dependabot.ymlconfiguration fileConsolidate dependency management onto Renovate
Maintain coverage via recommended GitHub Actions config
Diagram Walkthrough
File Walkthrough
dependabot.yml
Deprecate and remove Dependabot configuration file.github/dependabot.yml