kaslo/synapse
1
0
Fork 0
Code Packages Releases 124 Wiki Activity

Create dependabot changelogs at release time (#15481)

Browse Source 
* Ditch dependabot changelog workflow

* Summarise dependabot commits in release script

* Changelog

* Update scripts-dev/release.py
This commit is contained in:
David Robertson
2023-05-30 13:54:50 +01:00
committed by GitHub
parent 626bd75f48
commit 42786d8a47
4 changed files with 57 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/development/dependencies.md
View File

@@ -260,15 +260,17 @@ doesn't require poetry. (It's what we use in CI too). However, you could try
## ...handle a Dependabot pull request?
Synapse uses Dependabot to keep the `poetry.lock` file up-to-date. When it
creates a pull request a GitHub Action will run to automatically create a changelog
file. Ensure that:
Synapse uses Dependabot to keep the `poetry.lock` and `Cargo.lock` file
up-to-date with the latest releases of our dependencies. The changelog check is
omitted for Dependabot PRs; the release script will include them in the
changelog.
When reviewing a dependabot PR, ensure that:
* the lockfile changes look reasonable;
* the upstream changelog file (linked in the description) doesn't include any
breaking changes;
* continuous integration passes (due to permissions, the GitHub Actions run on
the changelog commit will fail, look at the initial commit of the pull request);
* continuous integration passes.
In particular, any updates to the type hints (usually packages which start with `types-`)
should be safe to merge if linting passes.