[MISC] UV configuration for renovate - #38
Conversation
| // Exclude Renovate PRs from auto-generated release notes | ||
| "labels": ["not bug or enhancement"], | ||
| "enabledManagers": ["poetry", "github-actions", "regex"], | ||
| "enabledManagers": ["poetry", "pep621", "github-actions", "regex"], |
There was a problem hiding this comment.
The manager is pep621, lockFileMaintenance from line 11 will make renovate updated the uv.lock as well.
| { | ||
| "matchManagers": ["pep621"], | ||
| "matchDepNames": ["python"], | ||
| "matchDatasources": ["python-version"], |
There was a problem hiding this comment.
I think we can merge with the poetry rule above based on datasource.
| "matchManagers": ["pep621"], | ||
| "rangeStrategy": "in-range-only", | ||
| "matchJsonata": [ | ||
| "depType = 'dependency-groups' and managerData.depGroup = 'charm-libs'" |
There was a problem hiding this comment.
Question. Will this mean that only the charm-libs dependency group gets updated? We're using more groups. Unclear to me if specific charms can extend or expand this Renovate config.
carlcsaposs-canonical
left a comment
carlcsaposs-canonical
left a comment
There was a problem hiding this comment.
Dependabot vulnerability alerts—which Renovate uses to segment security updates from normal PRs (and to open security update PRs immediately, instead of waiting for the weekly schedule)—do not currently support uv.lock
|
|
discussed in backlog grooming: waiting here for 26.04 *craft tools changes to test all of them and valuate complete migration to uv for all repos. There are several blockers right now here (c) @carlcsaposs-canonical . |
|
I see several charms migrating to the uv plugin already, for example:
The last remaining blocker I was tracking (@carlcsaposs-canonical correct me if I'm wrong) is canonical/charmcraft#2461, which is addressed by canonical/craft-providers#900 and canonical/craft-parts#1452. That issue blocks canonical/charmcraftlocal#10, so effectively many of the DP charms cannot use the uv plugin as long as they're using the wrapper. Given that dependabot now has full-fledged support for uv, maybe we can revisit this PR and add the configuration so that teams can adopt uv when it's ready? |
yes, exactly. technically it's not a blocker, but migrating to uv right now would mean slow builds or (for <26.04) not building from source, which I believe goes against Canonical's supply-chain vision/security concerns |
|
also canonical/charmcraft#2788 might be relevant, but haven't looked into it |
|
Merged main. |
4 participants
UV presets, in case we switch permanently.
Tested on https://github.com/dragomirp/pgbouncer-operator/pull/9