Re: [tractusx-dev] New Dependabot Tractus-X Release Guideline

[Andrea Bertagnolli <andrea.bertagnolli@xxxxxxxxx>]

Hello,

In addition to what Paul said (which I totally agree with), please note that currently dependabot is not able to update either gradle wrapper nor maven wrapper, you'll need to do that manually.

Andrea 

On Tue, Jan 16, 2024, 19:47 Paul Latzelsperger via tractusx-dev <tractusx-dev@xxxxxxxxxxx> wrote:

Hi all,

Tractus-X EDC  (and upstream EDC, fwiw) has been using dependabot for quite some time now and with good success, and we have yet to encounter any real issues.

Usually, breaking changes of libs only happen on major version bumps, in which case some manual work is required. If there are breaking changes, we typically fix them either in a separate PR (as Felipe suggested), or - if the changeset is limited - directly on the dependabot PR. The latter can only be done by committers. I would personally avoid libraries that don't do minor/patch upgrades.

There is one small pitfall though: as you know, EF requires the presence of a DEPENDENCIES​ file, and Tx-EDC has opted to always keep that up-to-date and fail the build if it is out-of-date. The worklfow action for this can be checked our here.

Naturally, every dependabot PR will cause that file to get out-of-date (and thus fails the build), so we approach this in on of two ways:

• if there is just one dependabot PR, we manually update the DEPENDENCIES​ file directly on the PR
  
• if there are several dependabot PRs, we merge all but one, and manually update the file on the last one

While it would be trivial to automatically regenerate the DEPENDENCIES file during the build, we opted against it for three reasons:

1. That would cause potentially a ton of spurious commits by a bot, confusing the reflog even more
   
2. Developer awareness: updating a dependency should be a conscious effort and not done inadvertently
3. IP lab requests: whenever we update a dependency, we potentially need to  file an IP lab request, which we do constantly over time, as opposed to once before a release.

Lastly, I would like to remark that having "non-updateable dependencies" in a project is a serious smell. Every project should always keep their deps up to date to avoid security vulnerabilities etc. Not doing so only builds technical debt and fosters developer laziness and will cause pain down the road.

sorry for the wall of text, thanks for reading.

paul

---

From: tractusx-dev <tractusx-dev-bounces@xxxxxxxxxxx> on behalf of Felipe Zampa via tractusx-dev <tractusx-dev@xxxxxxxxxxx>
Sent: Tuesday, January 16, 2024 4:44 PM
To: tractusx developer discussions <tractusx-dev@xxxxxxxxxxx>
Cc: Felipe Zampa <felipe.zampa@xxxxxxxxxxxxxx>
Subject: Re: [tractusx-dev] New Dependabot Tractus-X Release Guideline

 

Hello everyone,

 

Please apologize the reaction being sent as a reply-all to the list.

 

Together with that positive feedback, I want to thank you Tomasz for the Dependabot TRG and ask if there is any plan on how to move forward with some specific dependency update in case it breaks the build.

 

In the past, on a small team, I had a good experience closing those Dependabot PRs and opening a ticket to investigate and fix that specific update.

 

Also, it can be helpful to have documented for each project the list of “non-updatable dependencies”, as they might incur breaking changes, re-work, or any other consequence that blocks a library to be updated to a specific version.

 

Any thoughts about that?

 

Thank you.

 

Felipe Zampa Fonseca
Application Architect Core Services 
Cofinity-X GmbH │c/o Im Mediapark 5 │50670 Köln
E :  felipe.zampa@xxxxxxxxxxxxxx
M : +49 176 15344601

Booking   | LinkedIn  
 

 

Mandatory Disclosure Statement: www.cofinity-x.com/impressum
This e-mail may contain trade secrets or privileged, undisclosed, or otherwise confidential information. If you have received this e-mail in error, you are hereby notified, that any review, copying, or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation. 

 

 

From: tractusx-dev <tractusx-dev-bounces@xxxxxxxxxxx> on behalf of Tomasz.Barwicki--- via tractusx-dev <tractusx-dev@xxxxxxxxxxx>
Date: Tuesday, January 16, 2024 at 12:27
To: tractusx-dev@xxxxxxxxxxx <tractusx-dev@xxxxxxxxxxx>
Cc: Tomasz.Barwicki@xxxxxxxxxxxxx <Tomasz.Barwicki@xxxxxxxxxxxxx>
Subject: [tractusx-dev] New Dependabot Tractus-X Release Guideline

Dear Tractus-X Community,

I hope this email finds you well. I’m excited to share an update regarding new GitHub Dependabot Tractus-X Release Guideline.
The aim of the TRG is to help us automatically track and manage dependencies, ensuring that our projects remain secure and up to date.

 

The document is currently available in draft form and is ready for your review.
You can access the document here.

Encourage you to review the document at your earliest convenience. Feel free to share any comments, suggestions, or questions you may have directly on the document or by replying to this email.

Thank you for your continued support and collaboration.

Best regards,

Tomasz Barwicki

 

_______________________________________________
tractusx-dev mailing list
tractusx-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org