Skip to content

Commit 9fed5eb

Browse files
yrodiereyrodiere
committed
Enable dependabot for most dependencies
The idea is that we'd merge updates in the "build-dependencies" group as-is, without a Jira issue. **We would still have to adjust/re-create other update PRs** (such as Jandex) to assign them a Jira issue. We could consider limiting the dependencies covered by dependabot, but I find that grouping, at least, allows a fairly manageable rate of dependabot PRs. Runtime dependency updates should be more rare anyway, as their number is limited and they're generally less active (e.g. Jakarta Persistence doesn't release a micro every week). The most important ones are the runtime ones, e.g. bytebuddy, so we could consider ignoring/limiting build dependency updates if necessary.
1 parent 106200b commit 9fed5eb

File tree

3 files changed

+137
-8
lines changed

3 files changed

+137
-8
lines changed

‎.github/dependabot.yml

Lines changed: 125 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,6 @@ registries:
66
username: dummy # Required by dependabot
77
password: dummy # Required by dependabot
88
updates:
9-
- package-ecosystem: "gradle"
10-
directory: "/"
11-
allow:
12-
- dependency-name: "com.gradle*"
13-
registries:
14-
- gradle-plugin-portal
15-
schedule:
16-
interval: "weekly"
179
- package-ecosystem: github-actions
1810
directory: "/"
1911
schedule:
@@ -25,3 +17,128 @@ updates:
2517
allow:
2618
- dependency-name: "actions/*"
2719
- dependency-name: "redhat-actions/*"
20+
- package-ecosystem: "gradle"
21+
directory: "/"
22+
registries:
23+
- gradle-plugin-portal
24+
schedule:
25+
interval: "weekly"
26+
day: "wednesday"
27+
open-pull-requests-limit: 20
28+
groups:
29+
# These are used in tooling we publish (Gradle, Ant, Maven plugins)
30+
# and thus must be treated as runtime dependencies,
31+
# which cannot be included in the build-dependencies group below.
32+
tooling-dependencies:
33+
patterns:
34+
# Note: Gradle tooling dependencies seem to be tied to the version of Gradle we use for building.
35+
- "org.apache.ant*"
36+
- "org.apache.maven:maven-plugin-api"
37+
- "org.apache.maven:maven-project"
38+
- "org.apache.maven.shared:file-management"
39+
- "org.apache.maven.plugin-tools:maven-plugin-annotations"
40+
# This group combines all build-only dependencies. Published artifacts do not depend on them.
41+
# Grouping such dependencies will make Dependabot create PRs with a branch name
42+
# following the pattern (`dependabot/maven/build-dependencies-.*`)
43+
# and with a title like `Bump the build-dependencies group with 8 updates` that we can easily
44+
# use for Hibernate Bot rules.
45+
build-dependencies:
46+
patterns:
47+
# Gradle plugins:
48+
- "com.gradle*"
49+
- "org.moditect*"
50+
- "de.thetaphi*"
51+
- "org.gradlex*"
52+
- "org.hibernate.build*"
53+
- "org.hibernate.orm.build*"
54+
- "org.hibernate.orm.database-service*"
55+
- "org.hibernate.orm.antlr*"
56+
- "io.github.gradle-nexus*"
57+
- "biz.aQute.bnd*"
58+
- "org.checkerframework*"
59+
- "org.jetbrains.gradle*"
60+
- "com.dorongold*"
61+
- "org.asciidoctor*"
62+
- "com.diffplug.spotless*"
63+
# Local build plugin dependencies:
64+
- "org.apache.maven*"
65+
- "org.apache.httpcomponents*"
66+
# DB drivers:
67+
- "com.h2database:h2"
68+
- "org.orbisgis:h2gis"
69+
- "org.hsqldb:hsqldb"
70+
- "org.apache.derby*"
71+
- "org.postgresql:*"
72+
- "com.mysql:mysql-connector-j"
73+
- "org.mariadb.jdbc:mariadb-java-client"
74+
- "com.oracle.database.*"
75+
- "com.microsoft.sqlserver:mssql-jdbc"
76+
- "com.ibm.db2:jcc"
77+
- "com.sap.cloud.db.jdbc:ngdbc"
78+
- "net.sourceforge.jtds:jtds"
79+
- "com.ibm.informix:jdbc"
80+
- "org.firebirdsql.jdbc:jaybird"
81+
- "com.altibase:altibase-jdbc"
82+
# Other test dependencies
83+
- "org.apache.groovy:groovy-jsr223" # used for scripting maven plugin
84+
- "org.apache.commons:commons-lang3" # used in hibernate-search-util-common tests
85+
- "org.apache.commons:commons-math3" # used to solve dependency convergence for Wiremock
86+
- "org.openjdk.jmh:*" # performance testing dependency
87+
- "com.google.guava:guava" # Guava is used in our test utils
88+
- "org.asciidoctor:*" # Asciidoctor is used for rendering the documentation
89+
- "org.jboss.marshalling:jboss-marshalling" # JBeret IT dependency
90+
- "org.wildfly.security:wildfly-security-manager" # JBeret IT dependency
91+
- "org.springframework.boot:*" # Spring is only for ITs
92+
- "io.agroal:agroal-spring-boot-starter" # part of Spring dependencies, is only for ITs
93+
- "dev.snowdrop:narayana-spring-boot-starter" # part of Spring dependencies, is only for ITs
94+
- "org.mockito:*"
95+
- "org.hamcrest:*"
96+
- "org.apache.logging.log4j:*"
97+
- "org.assertj:*"
98+
- "org.jsoup:*"
99+
- "org.junit*"
100+
- "org.jboss.weld.se:*"
101+
- "org.jboss.narayana.*:*"
102+
- "org.wildfly.transaction:*"
103+
- "org.jboss:jboss-transaction-spi"
104+
- "org.jboss.shrinkwrap*"
105+
- "org.jboss.byteman*"
106+
hibernate:
107+
patterns:
108+
- "org.hibernate*"
109+
jakarta:
110+
patterns:
111+
- "jakarta.*"
112+
- "org.glassfish*"
113+
- "org.eclipse:yasson"
114+
ignore:
115+
# Avoid non-patch updates for complex dependencies and their implementation, even if we only use them for tests.
116+
- dependency-name: "org.hibernate*"
117+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
118+
- dependency-name: "jakarta.*"
119+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
120+
- dependency-name: "org.jboss.narayana*"
121+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
122+
- dependency-name: "org.jboss.weld*"
123+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
124+
- dependency-name: "org.wildfly*"
125+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
126+
- dependency-name: "org.glassfish*"
127+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
128+
- dependency-name: "org.eclipse:yasson"
129+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
130+
- dependency-name: "org.apache.maven*"
131+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
132+
- dependency-name: "org.apache.ant*"
133+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
134+
# Avoid non-patch updates for JUnit, because it is exposed in hibernate-testing,
135+
# which contains @BytecodeEnhanced, which is very sensitive to internal changes in JUnit.
136+
- dependency-name: "org.junit*"
137+
update-types: ["version-update:semver-major", "version-update:semver-minor"]
138+
# Sticking to SLF4J 1.x for now since later versions require upgrading providers
139+
# (Log4j, ... see https://www.slf4j.org/faq.html#changesInVersion200),
140+
# and also because we only need this dependency for Maven,
141+
# which is currently still on SLF4J 1.x
142+
# (see https://central.sonatype.com/artifact/org.apache.maven/maven-embedder/3.9.9/dependencies)
143+
- dependency-name: "org.slf4j:*"
144+
update-types: ["version-update:semver-major"]

‎.github/hibernate-github-bot.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22
jira:
33
projectKey: "HHH"
44
insertLinksInPullRequests: true
5+
ignore:
6+
# See the `build-dependencies` group in Dependabot's configuration file
7+
- user: dependabot[bot]
8+
titlePattern: "Bump.*the (build-dependencies|workflow-actions) group.*+"
59
ignoreFiles:
610
# Git
711
- ".git*"

‎.github/workflows/ci.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,18 @@ name: GH Actions CI
33
on:
44
push:
55
branches:
6+
# Pattern order matters: the last matching inclusion/exclusion wins
67
- 'main'
8+
# We don't want to run CI on branches for dependabot, just on the PR.
9+
- '!dependabot/**'
710
pull_request:
811
branches:
912
- 'main'
13+
# Ignore dependabot PRs that are not just about build dependencies or workflows;
14+
# we'll reject such PRs and send one ourselves.
15+
- '!dependabot/**'
16+
- 'dependabot/maven/build-dependencies-**'
17+
- 'dependabot/github_actions/workflow-actions-**'
1018

1119
permissions: { } # none
1220

0 commit comments

Comments
 (0)