Summary
The dependency-update.yml creates a PR that looks like: #790
We should augment the description provided so that contributors know which steps they need to take to:
- trigger the CI
- finalize the PR, e.g. what manual steps need to be done
We'd like this to be similar in nature to what project-keeper produces:
exasol/kafka-connector-extension#171
As #683 (worked on in #779), first adds the dependency-update.yml, it would be ideal if this is done before a new PTB release.
To Dos
Modify the documentation
Modify https://exasol.github.io/python-toolbox/main/user_guide/features/github_workflows/index.html#dependency-update:
Notes:
- It runs once weekly or on demand. If the criteria (has vulnerability, were changes) are met, then a PR is created & a slack notification sent.
- Users need to open the PR and perform some manual steps which are described in the PR description.
- See if PK has more in their documentation.
Modify the PR description
Modify exasol/toolbox/templates/github/workflows/dependency-update.yml
Modify the pull_request_template.md
⚠️ Note that effort is already being made to automate adding the table of resolved vulnerabilities when the nox session release:prepare is used. Thus, depending on the timing, this step may not be needed.
Modify https://github.com/exasol/python-toolbox/blob/main/.github/pull_request_template.md:
Summary
The
dependency-update.ymlcreates a PR that looks like: #790We should augment the description provided so that contributors know which steps they need to take to:
We'd like this to be similar in nature to what project-keeper produces:
exasol/kafka-connector-extension#171
As #683 (worked on in #779), first adds the
dependency-update.yml, it would be ideal if this is done before a new PTB release.To Dos
Modify the documentation
Modify https://exasol.github.io/python-toolbox/main/user_guide/features/github_workflows/index.html#dependency-update:
Notes:
Modify the PR description
Modify
exasol/toolbox/templates/github/workflows/dependency-update.ymlpoetry run -- nox -s workflow:generate -- all-> bot cannot dopoetry run -- nox -s dependency:auditand try to fix if there's a fix version. If it's not easy and there is a known fix, create an issue to look into later.poetry.lockwas updated to resolve vulnerabilities. Maybe note that therelease:preparewill write out the specifics later 😉.github/workflows/dependency-update.ymlModify the
pull_request_template.mdrelease:prepareis used. Thus, depending on the timing, this step may not be needed.Modify https://github.com/exasol/python-toolbox/blob/main/.github/pull_request_template.md:
When Preparing a Release, add a point to usepoetry run -- nox -s vulnerabilities:resolvedto get the table of resolved vulnerabilities & add it into the summary