janhoy commented on code in PR #855: URL: https://github.com/apache/solr-operator/pull/855#discussion_r4362308045
########## .github/dependabot.yml: ########## @@ -0,0 +1,103 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot configuration for the Solr Operator. +# +# Goals: keep the number of dependency PRs low and make each one mergeable +# with little human effort. +# - Everything runs on a monthly cadence. +# - Updates are grouped, so one PR covers many bumps. +# - A cooldown keeps brand-new releases out until they have had a week to +# settle (and to be patched, if needed). +# +# The companion workflow .github/workflows/dependabot-licenses.yaml regenerates +# dependency_licenses.csv on Dependabot PRs so that "make check-licenses" passes. +# +# Reference: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference + +version: 2 +updates: + + # GitHub Actions used in .github/workflows/* + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 7 Review Comment: `cooldown` is a documented Dependabot option, added in 2025 and GA since: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown- . The supported-ecosystems table there lists both `github-actions` and `gomod` with `default-days` supported, which is the only sub-key used here. Keeping it. I did add a note in the file header that cooldown applies to version updates only, never to security updates, and linked the docs section directly. ########## .github/dependabot.yml: ########## @@ -0,0 +1,103 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot configuration for the Solr Operator. +# +# Goals: keep the number of dependency PRs low and make each one mergeable +# with little human effort. +# - Everything runs on a monthly cadence. +# - Updates are grouped, so one PR covers many bumps. +# - A cooldown keeps brand-new releases out until they have had a week to +# settle (and to be patched, if needed). +# +# The companion workflow .github/workflows/dependabot-licenses.yaml regenerates +# dependency_licenses.csv on Dependabot PRs so that "make check-licenses" passes. +# +# Reference: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference + +version: 2 +updates: + + # GitHub Actions used in .github/workflows/* + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 7 + labels: + - "dependencies" + - "github-actions" + commit-message: + prefix: "ci" + groups: + github-actions: + patterns: + - "*" + + # Go modules (go.mod / go.sum) + # + # Only direct dependencies are updated by Dependabot version updates (the + # default), which keeps the indirect tree under control of "go mod tidy". + # Security updates still cover indirect dependencies. + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 7 Review Comment: `cooldown` is a documented Dependabot option, added in 2025 and GA since: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown- . The supported-ecosystems table there lists both `github-actions` and `gomod` with `default-days` supported, which is the only sub-key used here. Keeping it. I did add a note in the file header that cooldown applies to version updates only, never to security updates, and linked the docs section directly. ########## .github/workflows/dependabot-licenses.yaml: ########## @@ -0,0 +1,92 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot cannot run "make fetch-licenses-list", so every Go dependency bump +# it opens fails "make check-licenses" until a human regenerates +# dependency_licenses.csv. This workflow does that step for Dependabot PRs: +# +# 1. Regenerate dependency_licenses.csv (and tidy go.mod/go.sum). +# 2. If anything changed, commit it to the PR branch. +# 3. Re-dispatch the regular PR checks on the new commit. A push made with +# GITHUB_TOKEN never starts pull_request workflows on its own (this is +# GitHub's loop protection), but workflow_dispatch events always do, and +# their check runs attach to the PR's new head commit. +# +# Dependabot branches live in this repository and only Dependabot (or a +# committer) can push to them, so running "make" on the PR contents is no more +# dangerous than the regular PR checks. + +name: Dependabot license list + +on: + pull_request: + branches: + - 'main' + - 'release-*' + paths: + - 'go.mod' + - 'go.sum' + +jobs: + update-license-list: + name: Regenerate dependency_licenses.csv + if: github.actor == 'dependabot[bot]' && github.repository == 'apache/solr-operator' + runs-on: ubuntu-latest + # Dependabot-triggered workflows get a read-only GITHUB_TOKEN unless the + # permissions are raised explicitly. + permissions: + contents: write + actions: write + + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.ref }} Review Comment: Good catch. In 1bdbb56 the job now checks out `github.event.pull_request.head.sha` instead of the branch, so the fix-up commit is always based on the commit the event was about. The push stays non-forced on purpose: if Dependabot rebased or force-pushed meanwhile, the push is rejected as non-fast-forward and this run fails, while the new head has already produced a new `pull_request` event and a fresh run. A `concurrency` group keyed on the PR number with `cancel-in-progress` makes the stale run get cancelled rather than racing. I chose not to rebase-then-push or use `--force-with-lease`, since a fix-up built on a head that is no longer the PR head should be discarded, not rebased blindly. ########## .github/workflows/dependabot-licenses.yaml: ########## @@ -0,0 +1,92 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot cannot run "make fetch-licenses-list", so every Go dependency bump +# it opens fails "make check-licenses" until a human regenerates +# dependency_licenses.csv. This workflow does that step for Dependabot PRs: +# +# 1. Regenerate dependency_licenses.csv (and tidy go.mod/go.sum). +# 2. If anything changed, commit it to the PR branch. +# 3. Re-dispatch the regular PR checks on the new commit. A push made with +# GITHUB_TOKEN never starts pull_request workflows on its own (this is +# GitHub's loop protection), but workflow_dispatch events always do, and +# their check runs attach to the PR's new head commit. +# +# Dependabot branches live in this repository and only Dependabot (or a +# committer) can push to them, so running "make" on the PR contents is no more +# dangerous than the regular PR checks. + +name: Dependabot license list + +on: + pull_request: + branches: + - 'main' + - 'release-*' + paths: + - 'go.mod' + - 'go.sum' + +jobs: + update-license-list: + name: Regenerate dependency_licenses.csv + if: github.actor == 'dependabot[bot]' && github.repository == 'apache/solr-operator' + runs-on: ubuntu-latest + # Dependabot-triggered workflows get a read-only GITHUB_TOKEN unless the + # permissions are raised explicitly. + permissions: + contents: write + actions: write + + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.ref }} + + - name: Setup go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: Regenerate the dependency license list + run: make fetch-licenses-list + + - name: Detect changes + id: changes + run: | + if git diff --quiet -- dependency_licenses.csv go.mod go.sum; then + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "changed=true" >> "$GITHUB_OUTPUT" + git --no-pager diff -- dependency_licenses.csv go.mod go.sum + fi + + - name: Commit and push + if: steps.changes.outputs.changed == 'true' + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add dependency_licenses.csv go.mod go.sum + git commit -m "Regenerate dependency_licenses.csv for Dependabot update" + git push origin "HEAD:${{ github.event.pull_request.head.ref }}" Review Comment: Good catch. In 1bdbb56 the job now checks out `github.event.pull_request.head.sha` instead of the branch, so the fix-up commit is always based on the commit the event was about. The push stays non-forced on purpose: if Dependabot rebased or force-pushed meanwhile, the push is rejected as non-fast-forward and this run fails, while the new head has already produced a new `pull_request` event and a fresh run. A `concurrency` group keyed on the PR number with `cancel-in-progress` makes the stale run get cancelled rather than racing. I chose not to rebase-then-push or use `--force-with-lease`, since a fix-up built on a head that is no longer the PR head should be discarded, not rebased blindly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
