Skip to content

Rip out dependabot - its worse than useless - its annoying #1615

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

TheBlueMatt
Copy link
Collaborator

Dependabot has a ton of issues with its rust integration that makes
it wholly useless, and very annoying:

  • It has no concept of MSRV, opening PRs that are not going to pass
    CI.
  • It has no concept of patch-level - if we depend on tokio 1.X,
    that means any version of tokio > 1.X, but dependabot insists on
    opening a PR to "update us" to tokio 1.X + 1, even though it
    doesn't impact what version of our users use (and often violates
    MSRV).
  • It has no concept of dependencies that rely on each other,
    causing it to open a PR to update us to bitcoin_hashes X + 1,
    even though we're still depending on rust-bitcoin Y which
    depends on bitcoin_hashes X, causing build failure.
  • It hogs CI resources, getting CI run twice, once for the branch
    once for the PR.
  • It creates branches directly on the rust-lightning repo, making
    it look like the work is somehow connected to the
    lightningdevkit project, even though it isn't, and spamming the
    local clones of project contributors.

At the end of the day, dependabot has never meaningfully
contributed to notifying us of an important dependency, and,
really, we don't have enough dependencies for it to matter.

wpaulino
wpaulino previously approved these changes Jul 13, 2022
@codecov-commenter
Copy link

codecov-commenter commented Jul 13, 2022

Codecov Report

Merging #1615 (0a8bfde) into main (f3d5b94) will decrease coverage by 0.04%.
The diff coverage is n/a.

❗ Current head 0a8bfde differs from pull request most recent head a911ca8. Consider uploading reports for the commit a911ca8 to get more accurate results

@@            Coverage Diff             @@
##             main    #1615      +/-   ##
==========================================
- Coverage   91.07%   91.03%   -0.05%     
==========================================
  Files          80       80              
  Lines       44128    44128              
  Branches    44128    44128              
==========================================
- Hits        40190    40171      -19     
- Misses       3938     3957      +19     
Impacted Files Coverage Δ
lightning/src/ln/payment_tests.rs 98.88% <0.00%> (-0.38%) ⬇️
lightning-net-tokio/src/lib.rs 76.85% <0.00%> (-0.31%) ⬇️
lightning/src/ln/functional_tests.rs 96.87% <0.00%> (-0.24%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f3d5b94...a911ca8. Read the comment docs.

@TheBlueMatt TheBlueMatt changed the title Rip out dependable - its worse than useless - its annoying Rip out dependabot - its worse than useless - its annoying Jul 13, 2022
Dependabot has a ton of issues with its rust integration that makes
it wholly useless, and very annoying:
 * It has no concept of MSRV, opening PRs that are not going to pass
   CI.
 * It has no concept of patch-level - if we depend on tokio 1.X,
   that means any version of tokio > 1.X, but dependabot insists on
   opening a PR to "update us" to tokio 1.X + 1, even though it
   doesn't impact what version of our users use (and often violates
   MSRV).
 * It has no concept of dependencies that rely on each other,
   causing it to open a PR to update us to bitcoin_hashes X + 1,
   even though we're still depending on rust-bitcoin Y which
   depends on bitcoin_hashes X, causing build failure.
 * It hogs CI resources, getting CI run twice, once for the branch
   once for the PR.
 * It creates branches directly on the rust-lightning repo, making
   it look like the work is somehow connected to the
   lightningdevkit project, even though it isn't, and spamming the
   local clones of project contributors.

At the end of the day, dependabot has never meaningfully
contributed to notifying us of an important dependency, and,
really, we don't have enough dependencies for it to matter.
@TheBlueMatt
Copy link
Collaborator Author

Lol, fixed git commit to say "dependabot", not "dependable".

@TheBlueMatt TheBlueMatt merged commit 2eb93f4 into lightningdevkit:main Jul 14, 2022
@tnull
Copy link
Contributor

tnull commented Jul 14, 2022

RIP

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants