Update documentation for GitHub Actions #1461

smorimoto · 2019-10-23T07:06:44Z

This page seems to be missing information about github_actions.

The text was updated successfully, but these errors were encountered:

feelepxyz · 2019-10-23T09:24:48Z

@imbsky thanks for raising this, we've currently disabled actions support due to a bug that prevented Apps from modifying the workflow file, but might be able to re-enable now that it's fixed.

smorimoto · 2019-10-23T09:35:38Z

Oh, I see!

smorimoto · 2019-10-28T13:15:00Z

@feelepxyz When re-enable actions support, could you please update documentation and close this issue?

feelepxyz · 2019-10-29T10:48:37Z

@imbsky it's still a work in progress so not won't create any PRs yet. Hopefully we'll get this wrapped up in the next month or so.

smorimoto · 2019-10-29T22:52:35Z

Great!

smorimoto · 2019-12-24T05:00:23Z

Is this still disabled?

feelepxyz · 2020-01-06T12:22:13Z

@imbsky yeah sadly! There's new app permission that needs to be added which hasn't been prioritised yet. Waiting for an update on it.

smorimoto · 2020-01-07T07:53:20Z

Okay, I'll wait.

smorimoto · 2020-03-08T15:03:29Z

Any updates?

feelepxyz · 2020-03-09T12:04:52Z

@imbsky I'm chasing internally. Still need the new app permission to be deployed.

smorimoto · 2020-03-09T12:09:12Z

@feelepxyz I'm both an Actions user and an outside contributor who has made some improvements, if Actions is supported by Dependabot, I don't have to manually create a lot of PR, so could you to enable it as soon as possible? I don't want to bother you, but please.

feelepxyz · 2020-03-09T12:13:34Z

We're waiting on an internal change to actions allowing any app to edit workflow files. It's not specific to Dependabot.

smorimoto · 2020-03-09T12:37:22Z

Oh, I see. That sounds to take some time.

LeoColomb · 2020-04-07T10:41:37Z

🎉 https://github.blog/changelog/2020-04-07-github-apps-workflow-permission/

peaceiris · 2020-04-07T14:23:56Z

The correct URL is https://github.blog/changelog/2020-04-07-github-apps-workflow-permission/ 🎉

staticdev · 2020-05-06T23:10:50Z

It seems like something is still wrong. I have github_actions enabled, but it is not creating pull requests yet. I see in dependabot logs that it finds newer versions for actions though.

smorimoto · 2020-05-06T23:14:47Z

This is not yet enabled. So nothing is wrong, but I hope it will be enabled asap.

feelepxyz · 2020-06-03T12:39:38Z

We've just launched a beta of Dependabot natively integrated into GitHub that supports updating Actiosn workflow files: https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/

Config file docs: https://help.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates

FYI - the new version currently doesn't support private git dependencies. We're working on adding this over the next few months.

peaceiris · 2020-06-03T13:01:19Z

It works! Great 🎉

peaceiris/actions-gh-pages#334

I will leave my feedback. (I do not know whether here is the right place for feedback or not.)

Please detect pre-release and do not bump it

The actions/setup-node@v2.0.0 is a beta version (pre-release). We need a useful filter for not bumping it.

`open-pull-requests-limit` does not work

I set open-pull-requests-limit: 1 like the following but the dependabot has opened the two pull-requests at the same time.

ci: bump actions/setup-node from v1.4.1 to v2.0.0 peaceiris/actions-gh-pages#334
ci: bump codecov/codecov-action from v1 to v1.0.7 peaceiris/actions-gh-pages#333

- package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: "daily"
  open-pull-requests-limit: 1
  labels:
  - "dependencies:ci"
  commit-message:
    prefix: ci

https://github.com/peaceiris/actions-gh-pages/blob/65dc7af0847a52d3e8dfa56f3f64dcb0acf6032f/.github/dependabot.yml#L28

staticdev · 2020-06-03T13:12:33Z

@feelepxyz I don't see Security & analysis tab on Settings from repositories I own and have dependabot-preview (as mentioned in @infin8x post https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/):

feelepxyz · 2020-06-03T15:15:07Z

@peaceiris nice one, will take a look at the open pull request limit not being honoured.

Please detect pre-release and do not bump it

Yep, it's on our list of improvements. Will see what metadata we can get from tags.

@staticdev ah yes this page hasn't been fully rolled out yet. You can enable it from the Security tab on the repository under Dependabot alerts > Dependabot Security Updates.

staticdev · 2020-06-03T17:17:48Z

@feelepxyz I've enabled Security Updates in 3 public repos of mine, then I entered dependabot.com and selected Update config file and it didn't work. When I click it again I see the message: Something went wrong when creating your Pull Request. Try again or contact support.. None of them worked.

feelepxyz · 2020-06-03T17:21:52Z

@staticdev thanks for reporting, looks like we've tried to generate an invalid config file. Will take a look at fixing this tomorrow 👌

staticdev · 2020-06-03T17:26:51Z

@feelepxyz if you want the repos to check:

I also saw in the post that the file location (.github/dependabot.yml) is different from the path I've been using with dependabot-preview (.dependabot/config.yml).

jurre · 2020-06-04T13:53:41Z

Thanks for reporting this @staticdev, we've fixed some issues and I think you should be able to upgrade now, could you try again?

staticdev · 2020-06-04T14:31:56Z

@jurre Good news! Dependabot could now create the pull requests, and changed the name/path of dependabot config file.

One strange thing I noticed is that, all of the repositories I tested gave me this warning:
"You're using unsupported features

The new version does not yet support private git dependencies. If you use these we recommend leaving Dependabot Preview active."

I am curious to know what unsupported features since I am not using private repositories...

jurre · 2020-06-04T14:50:07Z

You should be all good in that case 👍 we can't detect if the git dependencies you're using are private or not, so if you're using any git dependencies we show that warning. I'll think about the wording if we can make that more clear

staticdev · 2020-06-21T19:00:23Z

@feelepxyz I have 3 other questions regarding this new config, maybe you could help me out:

Can the open-pull-requests-limit setting be omitted, to go with the default?
Any way to avoid hardcoding schedule.time? What is this based on, anyway? I got different times when upgrading projects.
Do you know why dependabot badge now shows inactive on upgraded projects? Eg. here. Is this a bug?

Thanks again.

feelepxyz · 2020-06-22T15:56:45Z

Can the open-pull-requests-limit setting be omitted, to go with the default?

Yup, the default is 5

Any way to avoid hardcoding schedule.time? What is this based on, anyway? I got different times when upgrading projects.

This should be set from your account settings in your dependabot dashboard. You can omit it and the default 5am UTC will be used.

Do you know why dependabot badge now shows inactive on upgraded projects? Eg. here. Is this a bug?

Yup, this is broken with the updated and we're tracking this here: https://github.com/dependabot/feedback/issues/968

staticdev · 2020-06-22T16:33:16Z

Can the open-pull-requests-limit setting be omitted, to go with the default?

Yup, the default is 5

Any way to avoid hardcoding schedule.time? What is this based on, anyway? I got different times when upgrading projects.

This should be set from your account settings in your dependabot dashboard. You can omit it and the default 5am UTC will be used.

Do you know why dependabot badge now shows inactive on upgraded projects? Eg. here. Is this a bug?

Yup, this is broken with the updated and we're tracking this here: dependabot/feedback#968

Thanks again!!

infin8x · 2020-07-20T15:36:52Z

Closing this as the original issue (lack of github_actions documentation) is fixed: https://help.github.com/en/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot

smorimoto closed this as completed Oct 23, 2019

smorimoto reopened this Oct 28, 2019

feelepxyz added the T: feature-request Requests for new features label Oct 29, 2019

bendavies mentioned this issue Nov 7, 2019

Fix: Configuration for dependabot ergebnis/php-package-template#139

Merged

1 task

smorimoto changed the title ~~Update config file docs~~ Update documentation for GitHub Actions Dec 24, 2019

thewilkybarkid mentioned this issue Jan 28, 2020

Update GitHub Actions with Dependabot libero/article-store#212

Draft

OmgImAlexis mentioned this issue Jun 8, 2020

Add support for fetching from private git(hub) repos #1902

Closed

staticdev mentioned this issue Jun 21, 2020

Upgrade to GitHub Dependabot cjolowicz/cookiecutter-hypermodern-python#402

Merged

evgeni mentioned this issue Jul 9, 2020

Bumps GH actions to pre-releases #2303

Open

infin8x closed this as completed Jul 20, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update documentation for GitHub Actions #1461

Update documentation for GitHub Actions #1461

smorimoto commented Oct 23, 2019

feelepxyz commented Oct 23, 2019

smorimoto commented Oct 23, 2019

smorimoto commented Oct 28, 2019

feelepxyz commented Oct 29, 2019

smorimoto commented Oct 29, 2019

smorimoto commented Dec 24, 2019

feelepxyz commented Jan 6, 2020

smorimoto commented Jan 7, 2020

smorimoto commented Mar 8, 2020

feelepxyz commented Mar 9, 2020

smorimoto commented Mar 9, 2020

feelepxyz commented Mar 9, 2020

smorimoto commented Mar 9, 2020

LeoColomb commented Apr 7, 2020 •

edited

Loading

peaceiris commented Apr 7, 2020 •

edited

Loading

staticdev commented May 6, 2020

smorimoto commented May 6, 2020

feelepxyz commented Jun 3, 2020

peaceiris commented Jun 3, 2020 •

edited

Loading

staticdev commented Jun 3, 2020 •

edited

Loading

feelepxyz commented Jun 3, 2020

staticdev commented Jun 3, 2020 •

edited

Loading

feelepxyz commented Jun 3, 2020

staticdev commented Jun 3, 2020 •

edited

Loading

jurre commented Jun 4, 2020

staticdev commented Jun 4, 2020

jurre commented Jun 4, 2020

staticdev commented Jun 21, 2020 •

edited

Loading

feelepxyz commented Jun 22, 2020

staticdev commented Jun 22, 2020

infin8x commented Jul 20, 2020

Update documentation for GitHub Actions #1461

Update documentation for GitHub Actions #1461

Comments

smorimoto commented Oct 23, 2019

feelepxyz commented Oct 23, 2019

smorimoto commented Oct 23, 2019

smorimoto commented Oct 28, 2019

feelepxyz commented Oct 29, 2019

smorimoto commented Oct 29, 2019

smorimoto commented Dec 24, 2019

feelepxyz commented Jan 6, 2020

smorimoto commented Jan 7, 2020

smorimoto commented Mar 8, 2020

feelepxyz commented Mar 9, 2020

smorimoto commented Mar 9, 2020

feelepxyz commented Mar 9, 2020

smorimoto commented Mar 9, 2020

LeoColomb commented Apr 7, 2020 • edited Loading

peaceiris commented Apr 7, 2020 • edited Loading

staticdev commented May 6, 2020

smorimoto commented May 6, 2020

feelepxyz commented Jun 3, 2020

peaceiris commented Jun 3, 2020 • edited Loading

Please detect pre-release and do not bump it

open-pull-requests-limit does not work

staticdev commented Jun 3, 2020 • edited Loading

feelepxyz commented Jun 3, 2020

staticdev commented Jun 3, 2020 • edited Loading

feelepxyz commented Jun 3, 2020

staticdev commented Jun 3, 2020 • edited Loading

jurre commented Jun 4, 2020

staticdev commented Jun 4, 2020

jurre commented Jun 4, 2020

staticdev commented Jun 21, 2020 • edited Loading

feelepxyz commented Jun 22, 2020

staticdev commented Jun 22, 2020

infin8x commented Jul 20, 2020

LeoColomb commented Apr 7, 2020 •

edited

Loading

peaceiris commented Apr 7, 2020 •

edited

Loading

peaceiris commented Jun 3, 2020 •

edited

Loading

`open-pull-requests-limit` does not work

staticdev commented Jun 3, 2020 •

edited

Loading

staticdev commented Jun 3, 2020 •

edited

Loading

staticdev commented Jun 3, 2020 •

edited

Loading

staticdev commented Jun 21, 2020 •

edited

Loading