chore(deps): cover fixture workspace and add 7-day cooldown in dependabot - #306
Open
simongdavies wants to merge 1 commit into
Open
simongdavies wants to merge 1 commit into
simongdavies wants to merge 1 commit into
Conversation
…abot Add src/hyperlight-js-runtime/tests/fixtures/extended_runtime to the cargo update config. It is a standalone workspace with its own Cargo.lock that CI validates via `just check-fixture-lock`, so it drifts out of sync when Dependabot bumps a hyperlight-js-runtime dependency in the root workspace. Also set a 7-day cooldown on all three update configs to reduce PR churn. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
simongdavies
added
kind/dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
src/hyperlight-js-runtime/tests/fixtures/extended_runtimeto the cargo update config.cooldown.default-days: 7) on all three update configs.Why
extended_runtimeis a standalone cargo workspace with its ownCargo.lock, and CI validates it withjust check-fixture-lock(cargo metadata --locked). Dependabot only tracked/, so when it bumped ahyperlight-js-runtimedependency the fixture lock went stale and CI failed — see #276, wherebase640.22 → 0.23 insrc/hyperlight-js-runtime/Cargo.tomlleft the fixture lock pinned at 0.22.1:The cooldown (up from the 3-day default) reduces daily PR churn and lets releases settle before we pick them up.
Caveat
Dependabot raises a separate PR per directory, so a root bump and the matching fixture-lock bump won't land in the same PR. This keeps the fixture lock from going permanently stale, but a version bump may still need a manual
cargo update --manifest-path src/hyperlight-js-runtime/tests/fixtures/extended_runtime/Cargo.toml -p <crate>on the root PR to get it green. If that turns out to be frequent, agroupsentry spanning both directories would combine them.src/hyperlight-js-runtime/tests/fixtures/native_mathalso has its own lock, but nothing in the root workspace can invalidate it, so it's left out here.