i.e. A standard .github/dependabot.yml file can now look like this to keep both github actions and julia deps up to date:
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "julia"
directory: "/"
schedule:
interval: "weekly"
# groups: # uncomment to group all julia package updates into a single PR
# all-julia-packages:
# patterns:
# - "*"
Dependabot has some benefits over CompatHelper:
PRs will have their CI run automatically without manual interaction
Any checked-in manifests will be updated, or if that fails the resolver errors will be shown directly in the PR body
Workspaces are supported. Just set the directory: field like normal to the root where the main Project.toml is, and the sub-projects will be handled automatically. An example PR can be seen here
Dependabot can tie into security/CVE reporting
Keeping test/, docs/ etc. updated
If you have test, docs or other subdirectories setup with environments, it’s recommended to use the new workspaces feature (1.12+) to tie them together, which will work with the simple single directory: "/" configuration that the main example above gives. See the [workspaces] docs for more information on workspaces.
If you would rather not use workspaces, you can specify a list of directories, but note that the update for a single dependency will be opened in individual PRs, and thus may not fully test the change due to resolver conflicts between the environments. (workspaces make coordinating all that a lot easier).
Dependabot doesn’t yet support custom julia package registries, but there is work in progress to fix that.
Dependabot runs on 1.12, so any manifest changes will be done from 1.12, irrespective of which version they were resolved with. Work is active in Pkg & juliaup to make it easier for the julia version of the manifest to be respected, which dependabot will then use.
Just to be clear, from the Dependant doc you linked:
Dependabot consists of three different features that help you manage your dependencies:
- Dependabot alerts: Inform you about vulnerabilities in the dependencies that you use in your repository.
- Dependabot security updates: Automatically raise pull requests to update the dependencies you use that have known security vulnerabilities.
- Dependabot version updates: Automatically raise pull requests to keep your dependencies up-to-date.
The function that is implemented for Julia, and that replace CompactHelper, is the 3rd one (up-to-date dependencies), right?
Congrats on the hard work!
Can I suggest showing how test and docs dependencies can be taken into account by dependabot? This may be the most important missing piece in the provided example.
My perspective was shaped by DifferentiationInterface.jl, where I absolutely cannot use workspaces unless I want to instantiate an environment containing every AD backend at once, including outdated ones which would severely restrict compatibility of other packages. More generally, workspaces are not ideal whenever there are subprojects with (a) wildly different or (b) very numerous dependencies.
How to configure it if I want dependabot to only manage the root Project.toml and ignore the docs/Project.toml and test/Project.toml?
I am getting tons of little PRs for docs/ and test/ and I don’t want to bother with compat for those subdirectories: https://github.com/JuliaArrays/LazyGrids.jl/pulls
I asked copilot for help and it strongly suggested using exclude-paths which I tried but gave an dependabot error. And I tried to find documentation on the allowable syntax but all I could find was the general dependabot stuff, not the Julia-specific aspects.
After trials, and dependabot exclude-paths errors, and discussions with AI, we found a possible solution - or rather a workaround - which is being tried right now. Here ist the link to the article, and this is now in my dependabot.toml:
Dependabot recently updated a lot of my repositories with nonsensical compat bounds for standard libraries, as in
LinearAlgebra = "< 0.0.1, 1"
then it notifies me that
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.
Then it keeps pestering me about these on a regular basis. Is this a recent bug? Can I do anything to avoid it?
We got these for something like test/Project.toml and docs/Project.toml as well, but not for the main Project.toml. For us, it helped to set a Julia [compat] entry like julia = "1.10" in the other project files as well, mimicking what we had in the main Project.toml.
According to a discussion on Slack (Helpdesk, about 1.5 weeks ago) that might also have been a bug, and for the workspace case, the compat for Julia in the main Project file should be enough.
Updates the requirements on Dates, Unicode, Random and Printf to permit the latest version.
Updates Dates to
Updates Unicode to
Updates Random to
Updates Printf to
Nothing is given as the to version in the PR text but:
