Dependabot

• Dependabot is enabled for ignite-3 repo: https://github.com/apache/ignite-3/blob/main/.github/dependabot.yml
• For Java (Gradle) and .NET (NuGet)
• Runs daily
• Creates PRs for dependency updates (label=dependencies): https://github.com/apache/ignite-3/pulls?q=is%3Apr+is%3Aopen+label%3Adependencies
• Limited to 5 open PRs at the given moment

How To Manage Dependabot PRs

Committers check for Dependabot PRs periodically, the process is:

• Open the PR page and check CI status
  • CI is Green
    • Review the code (normally one line with a version bump)
    • Add your name and merge the PR:
      • Click "Squash and Merge"
      • Leave commit title as is

      • Scroll to the bottom of the commit message body, replace the dependabot name/email with YOUR name/email

        Signed-off-by: dependabot[bot] <support@github.com>
        Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

      • Commit the changes. Example: https://github.com/apache/ignite-3/commit/b11564ca22e91a293130b4ee6d167487072692db
  • CI is Red
    • Check CI issues
      • Build failed (code does not compile due to dependency update) - decide:
        • Create a ticket to update the dependency manually and fix all the issues
        • OR close the PR if the dependency update is not possible, not important, etc
        • Uncertain? Discuss on the dev list.
      • Tests failed (flaky) - re-run CI, then start over
      • Tests failed because of the updated dependency - decide:
        • Create a ticket to update the dependency manually and fix all the issues
        • OR close the PR if the dependency update is not possible, not important, etc
        • Uncertain? Discuss on the dev list.