feat: adds proper structure to automatic bumping PRs #3469
Conversation
… off the commit Signed-off-by: Simeon Nakov <[email protected]>
|
|
@quiet-node I noticed you add your details when signing off the commit message of Snyk's PR's so I included them to the YAML file. We can further discuss if that's appropriate and think of alternatives if necessary |
Test Results 19 files - 8 274 suites - 116 37m 29s ⏱️ - 38m 53s For more details on these failures, see this check. Results for commit 51cbf7b. ± Comparison against base commit 3e057b5. This pull request removes 8 tests.♻️ This comment has been updated with latest results. |
simzzz
added
the
internal
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #3469 +/- ##
==========================================
- Coverage 86.42% 85.62% -0.80%
==========================================
Files 65 69 +4
Lines 4552 4731 +179
Branches 979 998 +19
==========================================
+ Hits 3934 4051 +117
- Misses 316 396 +80
+ Partials 302 284 -18
Flags with carried forward coverage won't be shown. Click here to find out more. |
| if (!hasValidPrefix) { | ||
| title = `build(dep): ${title}`; | ||
| console.log(`Updating PR title to: ${title}`); | ||
| const url = `https://api.github.com/repos/${owner}/${repo}/pulls/${pr.number}`; | ||
| await axios.patch( | ||
| url, | ||
| { title }, | ||
| { | ||
| headers: { | ||
| Authorization: `token ${githubToken}`, | ||
| }, | ||
| }, | ||
| ); | ||
| } |
There was a problem hiding this comment.
Ha this's a clever way to update the PRs.
I might be mistaken, but this isn’t quite what I initially envisioned. I thought Snyk is like a tool integrated into the repo, allowing us to reconfigure the Snyk PRs through their API rather than having to make patch requests to GitHub like this.
Have you confirmed that we can’t reconfigure Snyk through its API? Or maybe we should check with the CI team to ensure this is the only option?
Sorry, this approach feels a bit like a hack to me and I’d expect there to be a more streamlined way to configure the Snyk tool.
There was a problem hiding this comment.
I took a look initially but it seems very limited. It doesn't accept labels and we can pass only static strings with limited variables.
It can work for the title but we won't be able to detect if it's an Upgrade or a Security upgrade which Snyk currently does.
For the labels - we would still need to keep the hack or do them manually.
There was a problem hiding this comment.
Ah, I see.
On a different note, how about we remove Snyk entirely and rely only on dependabot? I haven’t seen Snyk PRs in Mirror Node or Mirror Node Explorer anymore but only by dependa bots.
Would it be worth removing it altogether?
@beeradb @andrewb1269hg @rbarker-dev, what do you think?
Description:
Snyk PR titles now automatically add proper conventional type prefixes and appropriate labels.
Related issue(s):
Fixes #3319
Notes for reviewer:
Judging from the closed PR's by Snyk, I have made the assumption that they would always start with [Snyk] in their title and that they would all be a version upgrade or a security upgrade.
Checklist