From dev-return-18130-archive-asf-public=cust-asf.ponee.io@syncope.apache.org Tue Dec 17 13:00:41 2019 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id AB462180607 for ; Tue, 17 Dec 2019 14:00:40 +0100 (CET) Received: (qmail 6711 invoked by uid 500); 17 Dec 2019 13:00:40 -0000 Mailing-List: contact dev-help@syncope.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@syncope.apache.org Delivered-To: mailing list dev@syncope.apache.org Received: (qmail 6699 invoked by uid 99); 17 Dec 2019 13:00:40 -0000 Received: from Unknown (HELO mailrelay1-lw-us.apache.org) (10.10.3.159) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 17 Dec 2019 13:00:39 +0000 Received: from [192.168.1.175] (93-41-107-184.ip81.fastwebnet.it [93.41.107.184]) by mailrelay1-lw-us.apache.org (ASF Mail Server at mailrelay1-lw-us.apache.org) with ESMTPSA id 848DD4FBC for ; Tue, 17 Dec 2019 13:00:39 +0000 (UTC) Subject: Re: Automating Syncope's dependency updates To: dev@syncope.apache.org References: <167473592.11151.1576072825402.JavaMail.zimbra@tirasa.net> <5791f410-1ac8-428a-fdb1-cdd6bd88c0e3@apache.org> <1615767175.62.1576557526123.JavaMail.zimbra@tirasa.net> From: =?UTF-8?Q?Francesco_Chicchiricc=c3=b2?= Autocrypt: addr=ilgrosso@apache.org; prefer-encrypt=mutual; keydata= xsBNBE9EncsBCAC02uAixULU/lI6u7y2a4hPLZ+J9eb1ZNVrg4iockEktP39C8zsve4rxltc 9SnT5wa2XwVTwiSl8HjxFGmc/CyMP4l+JLYLqAxvN25BXzoC7pvIpH5VcXMnTKP2bqIcIQ3H bR2gLxjxlEzRBgmzsnrtNWhlCi4DNuUcarMrzaWbQkW5DiieW/V7BNEKw7L/WESXWbXTC9zj vyf9JQ/Ql3ys7n7y+/C7nnnnRys9kJahJkYbiLasJTxRMm/ENjzwamE1s2khxNDhYXmeXyUf PYDv46rVP39TNNbecG9EuHbZZ1pRRSkGZJZnpWBu0O6VWOfn0aF2rR5mfbGHsQA8CQWlABEB AAHNOEZyYW5jZXNjbyBDaGljY2hpcmljY8OyIChpbGdyb3NzbykgPGlsZ3Jvc3NvQGFwYWNo ZS5vcmc+wsB4BBMBAgAiBQJPRJ3LAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRBr QxPtJz3yh5j3B/46VEpC62uq3wiwDaUYI2fl6DYjlAuSGbI9Q7Avxpz+yDieaPE7Q3C19Xx+ wTFrHyPOswbltmT5KDNqEpe5C9IpqoSyu7UIkqHtlXTxhsu+rFWpfABnI4sfQ0ui1VOLN3JB xG7G8PHCmIdYThSCRoM14u4KSU1ytd3SFtOpNLVU5TVBGm+aJWOu++XPSICn97101ndn8AJm JDTlHQwqMzpQTejLQnv020SouLq5cB2O6HSuSmSDpctFCdYkYLzHA6p3WzKgVXt9c3CV7Zhf w/XufaqXQQIkr1VLN/l13PlbPPnLluzPO+agDuCsJReFzF2JwxJYBLUIu0T8A+yrfTIzzsBN BE9EncsBCADQrFXb7lIhSSaTIkNnE987DGgLn9QRUEvSa+132lWcZYx+knLehdH0++F/cqUc 2KT17anzbOidGo0rvxwj5s42NV3lOUWIFBM7pUCwN2ef2CM3TVwA+/WrKGRFq/+cwAhSfDoc jtN4+vYd4NbIgzSA7ZuoaT4vKRpBex0fAN2J8tLOzXSbXdsoWRj4pVBnJ0N6WHRlaqLQnQ7o F1E6ZrNREMWasjxRuZ38mlpfbArnqw+lAbHL6T/BsKXOEjASe5iOPN9r95HW6dH1vmef1mOk /Pu6wr+eIcqwPIBUQRvHw5UnOrMugUf1ohgnx2NvggLOSlvgGBnZo47MphpOd5DVABEBAAHC wF8EGAECAAkFAk9EncsCGwwACgkQa0MT7Sc98oeFHggAro4b3tGyKCV7tMz8q9drqigl/6n+ /2riaumndUcPFZOsewDmg/75jszjc6hoe7wreBkJi0u8kvm6F0RpIlGk5WpCa7bljEc6Erm9 GLON/DoYn1MSpdMZdwucairqvMK1YWg/7wI/xjgq6br5FBoLegVE8bd3Iy4SVWKUIRURBF7q Ft3rVRUJdcmqHvCWpxDJ1VKPRDHf5szVkWXFJI0xiU6KuICWidZ9Hg3WXUsm3SePD7FtokiK 0Y9SBzHpd9EZe8KRIHekl5gVS2Xe83GC5GvPHEXE0usYUNRDArOXqIkGUCWHZ7gzueMBcWqW x+uxeS7bQfZZO/7ew7lIDf4gYA== Message-ID: Date: Tue, 17 Dec 2019 14:00:37 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.2.2 MIME-Version: 1.0 In-Reply-To: <1615767175.62.1576557526123.JavaMail.zimbra@tirasa.net> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US FYI: https://issues.apache.org/jira/browse/INFRA-19586 Regards. On 17/12/19 05:38, Misagh Moayyed wrote: > Sure, will do. Thanks everyone. > > --Misagh > > ----- Original Message ----- >> From: "Francesco Chicchiriccò" >> To: "dev" >> Sent: Monday, December 16, 2019 12:22:45 PM >> Subject: Re: Automating Syncope's dependency updates >> Hi Misagh, >> it seems we have some consensus here, please go ahead and open an issue on >> >> https://issues.apache.org/jira/browse/INFRA >> >> about this topic, thanks. >> >> Regards. >> >> On 11/12/19 15:13, Francesco Chicchiriccò wrote: >>> Hi Misagh, >>> renovatebot looks interesting and worth at least to explore the possibility to >>> add it at project's (rather than committer's level). >>> >>> +1 to go ahead and ask Infra team about it. >>> Regards. >>> >>> On 11/12/19 15:00, Misagh Moayyed wrote: >>>> Hey Team, >>>> >>>> I suspect most know about this sort of thing, but I thought to share this with >>>> you: >>>> https://github.com/renovatebot/renovate >>>> >>>> I think this is a useful tool to allow a Github project such as Syncope to >>>> automatically receive dependency updates and become self sufficient. It will >>>> attempt to parse the project's dependencies/pom and will then begin to issue >>>> pull requests with relevant updates. Its schedule, update policy and >>>> inclusion/exclusion rules can all be controlled via a .renovate JSON file. >>>> >>>> It can run in two ways: >>>> >>>> 1- As a GitHub app, which would be installed for the Apache org on Github and >>>> enabled for select repositories, such as Syncope. This option requires >>>> coordination/permission from Apache infra, and updates are then automatic. >>>> >>>> 2- As a CLI tool, where a committer's personal access token is passed as a >>>> command-line argument, and the tool can run as part of CI. This option probably >>>> does not require anything from Apache infra [?], and updates can be cancelled >>>> as part of the CI job that runs the tool. >>>> >>>> I am not sure what the CLA policy would be for bots; the second option probably >>>> [?] covers this, as PRs are issued on behalf of the committer whose AT is used. >>>> Either way, it seems like we need clarification from Apache infra. >>>> >>>> This is an example of a pull request by the bot: >>>> https://github.com/Jasig/uPortal/pull/1849 >>>> >>>> This is an example of the bot's JSON configuration file: >>>> https://github.com/Jasig/uPortal/blob/master/renovate.json >>>> >>>> How do you feel about this? Is this a good option to pursue and follow up? >>>> >>>> The bot also has the ability to rebase PRs, and can also take over the merging >>>> process automatically if CI passes or other rules allow. (At some point in the >>>> future, I think it will also gain the ability to travel back in time and kill >>>> Sarah Connor [1], but that has yet to be fully verified.) >>>> >>>> --Misagh >>>> >>>> [1] https://www.wikiwand.com/en/Sarah_Connor_(Terminator) >> -- >> Francesco Chicchiriccò >> >> Tirasa - Open Source Excellence >> http://www.tirasa.net/ >> >> Member at The Apache Software Foundation >> Syncope, Cocoon, Olingo, CXF, OpenJPA, PonyMail >> http://home.apache.org/~ilgrosso/ -- Francesco Chicchiriccò Tirasa - Open Source Excellence http://www.tirasa.net/ Member at The Apache Software Foundation Syncope, Cocoon, Olingo, CXF, OpenJPA, PonyMail http://home.apache.org/~ilgrosso/