I'd like to propose we move to a lower touch system for processing dependabot updates.
Currently when dependabot files a PR, wildfly-bot tags various component leads to request a review, and then often I or others tag others. (I typically do this based on quick git grepping of module.xml to find uses.)
And then things often block with no feedback, leading to repeated checking on the PR.
So my proposal is if you are tagged for a review on one of these, you have two weeks to either approve or raise an objection via the GH PR review UI, or put a 'hold' label on the PR and leave a comment explaining why. The latter is basically a way of saying 'give me more time'. Then remove the hold when done.
After 10 calendar days, PRs without objections or 'hold' statements are free to merge.
If your component is the sole user of a particularly dependency and you don't want dependabot managing it, send a PR updating dependabot.yaml.[1]
Thoughts?
-- Brian Stansberry
Principal Architect, Red Hat JBoss EAP
WildFly Project Lead
He/Him/His