Renovate proposal #29

lmilbaum · 2023-03-08T12:05:48Z

Changes introduced with this PR

Please explain your changes here.

By contributing to this repository, I agree to the contribution guidelines.

ghost · 2023-03-08T12:16:12Z

Hi @lmilbaum thank you for the proposal. Maybe you could edit the proposal and highlight that this would replace Dependabot which is included with GitHub and currently in use? Also, it would be worth mentioning why we would pick this over Dependabot, and what the management overhead is (we need to allow an app, someone needs to go register an account with them or self-host, etc).

Thanks!

lmilbaum · 2023-03-08T12:22:37Z

Hi @lmilbaum thank you for the proposal. Maybe you could edit the proposal and highlight that this would replace Dependabot which is included with GitHub and currently in use? Also, it would be worth mentioning why we would pick this over Dependabot, and what the management overhead is (we need to allow an app, someone needs to go register an account with them or self-host, etc).

Thanks!

Thank you for your feedback. I've just noticed that the section which emphasizes the advantages was missing.

sandrobonazzola · 2023-03-08T13:17:55Z

Perhaps also add some link to renovate documentation

lmilbaum · 2023-03-08T17:30:56Z

Perhaps also add some link to renovate documentation

Done.

HonkingGoose · 2023-03-10T15:42:28Z

I help maintain Renovate bot's documentation, so obviously I like Renovate bot. 😉

Why pick Renovate?

Copy/paste from the Renovate docs homepage:

Why use Renovate?

Get pull requests to update your dependencies and lock files

Reduce noise by scheduling when Renovate creates PRs

Renovate finds relevant package files automatically, including in monorepos

You can customize the bot's behavior with configuration files

Share your configuration with ESLint-like config presets

Get replacement PRs to migrate from a deprecated dependency to the community suggested replacement (npm packages only)

Open source

Killer features

Dependency Dashboard to get an overview of all your pending/in-progress updates
¹
Keep noise down by package grouping, and optionally automerging ²
Dependency Dashboard Approval Workflow to only get updates when you select them from the Dashboard ³

Here's the Dependency Dashboard in action:

Dependency Dashboard renovatebot/renovate#2958

Management overhead?

we need to allow an app

someone needs to go register an account with them

or self-host

The overhead depends on how you're going to run Renovate. You can:

use the GitHub-hosted app version of Renovate
use the "Forking Renovate" app version (needs less permissions) ⁴
self-host

Easiest way to get started

The easiest way to run the bot is by installing it as a GitHub-hosted app. ⁵ You can select what repositories you want Renovate to access after installing the app if you don't want Renovate to run on all your repositories.

HonkingGoose

Some comments on the proposal text.

HonkingGoose · 2023-03-10T15:52:54Z

art-decisions/proposals/2023-03-08-automated-dependency-updates.md

+
+While Renovate can be a powerful tool for automating dependency updates, there are a few potential drawbacks to consider:
+
+1. Pull request overload: Renovate can generate a large number of pull requests, especially if you have many repositories or dependencies. This can create a lot of noise in your pull request feed and may require additional effort to manage.


You can reduce the pull request overload by:

setting a schedule for updates (say get foo updates on the first day of the week)

using the Dependency Dashboard Approval Workflow, where you only get updates when you request them from the dashboard. I recommend you only use this to get you back up to date on your terms, once you're nearly/fully up to date, let Renovate create PRs again!

using automerge to merge after tests pass, can be helpful for things like Prettier/ESLint/Standard

setting a custom prConcurrentLimit ¹, the default is max 10 open PRs at once

edit: Renovate also rate-limits creating PRs, the default is 2 PRs created per hour

Footnotes

https://docs.renovatebot.com/configuration-options/#prconcurrentlimit ↩

HonkingGoose · 2023-03-10T15:58:42Z

art-decisions/proposals/2023-03-08-automated-dependency-updates.md

+
+2. False positives: Renovate may sometimes generate pull requests for updates that don't actually improve your dependencies or may introduce new issues. This can create additional work and may require manual intervention to resolve.
+
+3. Configurability complexity: While Renovate offers a lot of configuration options, this can also make it more complex to set up and manage than other dependency update tools.


I recommend you start with config:base ¹ and tune things after getting some experience with the default behavior.

Footnotes

https://docs.renovatebot.com/presets-config/#configbase ↩

HonkingGoose · 2023-03-10T15:59:35Z

art-decisions/proposals/2023-03-08-automated-dependency-updates.md

+
+3. Configurability complexity: While Renovate offers a lot of configuration options, this can also make it more complex to set up and manage than other dependency update tools.
+
+4. Limited control over updates: Renovate automates the update process, but you may not have full control over which updates are applied to your dependencies. This can be a concern if you need to ensure strict compatibility or stability with certain packages or versions.


Use the Dependency Dashboard, and use packageRules to group "must update together packages" to get more control.

HonkingGoose · 2023-03-10T16:02:09Z

art-decisions/proposals/2023-03-08-automated-dependency-updates.md

+
+4. Limited control over updates: Renovate automates the update process, but you may not have full control over which updates are applied to your dependencies. This can be a concern if you need to ensure strict compatibility or stability with certain packages or versions.
+
+5. Potential conflicts with other automation: If you have other automation tools or processes in place that also manage dependency updates, Renovate may conflict with them and create additional work or confusion.


Do not run Dependabot and Renovate together, you'll end up with a mess of open PRs.

If you want to get vulnerabilityAlerts ¹ then you'll need to enable the "Dependency Graph" and "Dependabot Alerts". You still keep the "normal Dependabot" disabled though!

Footnotes

https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts ↩

ghost · 2023-03-20T15:56:38Z

@lmilbaum thank you very much again for your presentation. As discussed, let's keep this proposal as a draft until we have a demo of running Renovate as a GitHub Actions periodic job.

ghost · 2023-03-20T15:57:23Z

@HonkingGoose thank you very much for your input, we'll hopefully move forward with this proposal in 2-3 weeks.

ghost · 2023-06-01T09:08:48Z

Hey folks, can you please remove my review request from this PR? It seems I don't have the ability to.

jaredoconnell

For the currently maintained projects, this seems to me to be extra work.

I think this would make sense as an option for projects, but not the default. But that could lead to more fragmentation.

This would make more sense if we switched off of GitHub.

lmilbaum · 2023-06-13T06:02:54Z

For the currently maintained projects, this seems to me to be extra work.

I think this would make sense as an option for projects, but not the default. But that could lead to more fragmentation.

This would make more sense if we switched off of GitHub.

I understand your concern. If that may help, my team (platform engineering) will own the on-boarding process and maintenance.

dustinblack · 2023-06-26T15:54:39Z

Per today's discussion, we are going to have a look at this functionality as a prototype using a repo or two from the Arcalot org. Seeing directly how this change affects our maintenance workflows and helps us will be useful to better inform the decision here.

dustinblack · 2023-07-04T18:26:55Z

We have implemented a prototype of this implementation with one plugin repo that has open dependabot PRs so that we can see a live comparison against Renovate. I invite the Round Table members to please have a look at the open PRs for this repo to see what Renovate offers us:

https://github.com/arcalot/arcaflow-plugin-aws-ec2-control/pulls

Implementing this required allowing the platform-engineering-bot write access to the repo, and a Renovate configuration file to be added:

https://github.com/arcalot/arcaflow-plugin-aws-ec2-control/blob/main/renovate.json

So the impact for implementation across the org is low, and we can do it in a phased way if this proposal is approved. I believe we would grant the platform-engineering-bot write access at the org level, and then add this config to each repo for which we want to enable Renovate.

Based on the conversations and this update, I am resetting the votes on this proposal and adjusting the voting period to 14 days, targeted to end on Wednesday, July 19, or when quorum is reached, whichever comes first.

jdowni000 · 2023-07-05T19:17:48Z

I would def like to see this with all the build issues fixed manually before dependabot gives this a go. It seems we have had different breaks within the last week or so.

dustinblack · 2023-07-06T11:56:00Z

I would def like to see this with all the build issues fixed manually before dependabot gives this a go. It seems we have had different breaks within the last week or so.

I had the same thought. I'll try to fix the builds and then let the dependabot and renovate PRs rebase.

dustinblack · 2023-07-12T13:58:29Z

Merging as approved with a quorum of votes from the ART

lmilbaum marked this pull request as draft March 8, 2023 12:05

lmilbaum force-pushed the renovate branch from 220d492 to eb62bcb Compare March 8, 2023 12:20

lmilbaum force-pushed the renovate branch from eb62bcb to 5c1469f Compare March 8, 2023 12:30

lmilbaum self-assigned this Mar 8, 2023

lmilbaum force-pushed the renovate branch from 5c1469f to e5d9d0d Compare March 8, 2023 17:30

lmilbaum force-pushed the renovate branch 2 times, most recently from a0313aa to 1ea78c7 Compare March 8, 2023 17:34

HonkingGoose reviewed Mar 10, 2023

View reviewed changes

Renovate proposal

84ffee0

lmilbaum force-pushed the renovate branch from 1ea78c7 to 84ffee0 Compare April 3, 2023 15:52

lmilbaum marked this pull request as ready for review April 3, 2023 15:53

lmilbaum requested review from dustinblack, sandrobonazzola and a user April 3, 2023 15:54

ghost requested review from portante, tsebastiani, AvlWx2014, engelmi, hubeadmin, Harshith-umesh, jaredoconnell, jdowni000 and mfleader April 3, 2023 16:46

lmilbaum requested review from HonkingGoose, a user and AvlWx2014 May 31, 2023 17:26

sandrobonazzola requested review from HonkingGoose and removed request for HonkingGoose and a user June 1, 2023 09:38

lmilbaum removed the request for review from HonkingGoose June 1, 2023 12:33

Harshith-umesh approved these changes Jun 12, 2023

View reviewed changes

jaredoconnell reviewed Jun 12, 2023

View reviewed changes

mfleader approved these changes Jun 12, 2023

View reviewed changes

dustinblack requested review from jaredoconnell, Harshith-umesh, mfleader and jdowni000 July 4, 2023 18:27

mfleader approved these changes Jul 5, 2023

View reviewed changes

jaredoconnell approved these changes Jul 10, 2023

View reviewed changes

Harshith-umesh approved these changes Jul 10, 2023

View reviewed changes

jdowni000 approved these changes Jul 10, 2023

View reviewed changes

dustinblack approved these changes Jul 10, 2023

View reviewed changes

tsebastiani approved these changes Jul 11, 2023

View reviewed changes

ozanunsal approved these changes Jul 11, 2023

View reviewed changes

sandrobonazzola approved these changes Jul 11, 2023

View reviewed changes

dustinblack merged commit ce94437 into arcalot:main Jul 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Renovate proposal #29

Renovate proposal #29

lmilbaum commented Mar 8, 2023

ghost commented Mar 8, 2023

lmilbaum commented Mar 8, 2023

sandrobonazzola commented Mar 8, 2023

lmilbaum commented Mar 8, 2023

HonkingGoose commented Mar 10, 2023

Why use Renovate?

HonkingGoose left a comment

HonkingGoose Mar 10, 2023 •

edited

Loading

HonkingGoose Mar 10, 2023

HonkingGoose Mar 10, 2023

HonkingGoose Mar 10, 2023

ghost commented Mar 20, 2023

ghost commented Mar 20, 2023

ghost commented Jun 1, 2023

jaredoconnell left a comment

lmilbaum commented Jun 13, 2023

dustinblack commented Jun 26, 2023

dustinblack commented Jul 4, 2023

jdowni000 commented Jul 5, 2023

dustinblack commented Jul 6, 2023

dustinblack commented Jul 12, 2023


		While Renovate can be a powerful tool for automating dependency updates, there are a few potential drawbacks to consider:

		1. Pull request overload: Renovate can generate a large number of pull requests, especially if you have many repositories or dependencies. This can create a lot of noise in your pull request feed and may require additional effort to manage.


		2. False positives: Renovate may sometimes generate pull requests for updates that don't actually improve your dependencies or may introduce new issues. This can create additional work and may require manual intervention to resolve.

		3. Configurability complexity: While Renovate offers a lot of configuration options, this can also make it more complex to set up and manage than other dependency update tools.


		3. Configurability complexity: While Renovate offers a lot of configuration options, this can also make it more complex to set up and manage than other dependency update tools.

		4. Limited control over updates: Renovate automates the update process, but you may not have full control over which updates are applied to your dependencies. This can be a concern if you need to ensure strict compatibility or stability with certain packages or versions.


		4. Limited control over updates: Renovate automates the update process, but you may not have full control over which updates are applied to your dependencies. This can be a concern if you need to ensure strict compatibility or stability with certain packages or versions.

		5. Potential conflicts with other automation: If you have other automation tools or processes in place that also manage dependency updates, Renovate may conflict with them and create additional work or confusion.

Renovate proposal #29

Renovate proposal #29

Conversation

lmilbaum commented Mar 8, 2023

Changes introduced with this PR

ghost commented Mar 8, 2023

lmilbaum commented Mar 8, 2023

sandrobonazzola commented Mar 8, 2023

lmilbaum commented Mar 8, 2023

HonkingGoose commented Mar 10, 2023

Why pick Renovate?

Why use Renovate?

Killer features

Management overhead?

Easiest way to get started

Footnotes

HonkingGoose left a comment

Choose a reason for hiding this comment

HonkingGoose Mar 10, 2023 • edited Loading

Choose a reason for hiding this comment

Footnotes

HonkingGoose Mar 10, 2023

Choose a reason for hiding this comment

Footnotes

HonkingGoose Mar 10, 2023

Choose a reason for hiding this comment

HonkingGoose Mar 10, 2023

Choose a reason for hiding this comment

Footnotes

ghost commented Mar 20, 2023

ghost commented Mar 20, 2023

ghost commented Jun 1, 2023

jaredoconnell left a comment

Choose a reason for hiding this comment

lmilbaum commented Jun 13, 2023

dustinblack commented Jun 26, 2023

dustinblack commented Jul 4, 2023

jdowni000 commented Jul 5, 2023

dustinblack commented Jul 6, 2023

dustinblack commented Jul 12, 2023

HonkingGoose Mar 10, 2023 •

edited

Loading