Repository navigation
Test pull requests in CI, and add Dependabot - #14
Merged
Merged
Conversation
Nothing checked a pull request before it was merged: release.yml runs only on a tag. test.yml runs gofmt, go vet, go test and govulncheck on every pull request and push to main, against the two Go releases that still get security fixes, and once a week with no change, because a vulnerability can be published against a dependency nobody touched. Dependabot proposes newer direct Go dependencies and GitHub Actions weekly, with the k8s.io modules grouped, since they have to move together, and the charmbracelet modules grouped. Indirect modules are left to the weekly govulncheck run: bumping one alone can break the k8s.io set. The DCO check skips Dependabot's bot-authored commits. Signed-off-by: Adao Oliveira Jr <junior@users.noreply.github.com>
This was referenced Oct 25, 2026
pierreneter
approved these changes
Oct 30, 2026
Member
|
Hi @junior, The two Maintainer edits aren't enabled on this PR, so I can't update the branch from here. If you can, please merge The push re-triggers CI. Thanks!! 🙏 |
The required checks need this branch to be up to date with main, and govulncheck here passes once p10node#13's x/net fixes are in. Signed-off-by: Adao Oliveira Jr <junior@users.noreply.github.com>
Collaborator
Author
|
Done, main is merged in and all checks are green. |
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nothing checks a pull request before it is merged today:
release.ymlonly runs on a tag, so every review has meant testing locally..github/workflows/test.ymlruns gofmt,go vet ./...,go test ./...and govulncheck (pinned to v1.9.0) on every pull request and every push to main, against the two Go releases that still get security fixes (1.26.x and 1.27.x, the newest patch of each). It also runs once a week with no change at all, because a vulnerability can be published against a dependency nobody touched: that is how the x/net issues fixed in #13 would have shown up. It uses a read-only token and keeps no credentials in the checkout..github/dependabot.ymlproposes newer direct Go dependencies and GitHub Actions once a week, with the k8s.io modules grouped (they are released together and have to move together) and the charmbracelet modules grouped. Indirect modules are left alone on purpose: they follow what the direct ones require, and bumping one by itself can break the k8s.io set. A plaingo get -u ./...does exactly that today: it moves an indirect structured-merge-diff past what k8s.io/apimachinery v0.37.1 supports and the build fails. The weekly govulncheck run covers the indirect modules instead.Dependabot's commits are authored by a bot, which the DCO app skips (dcoapp/app,
lib/dco.js: a commit whose author is a Bot is not checked), so its pull requests need no Signed-off-by.Checked with actionlint and with the Dependabot and GitHub workflow JSON schemas. The workflow should run on this pull request itself.