[wildfly-dev] Re: Enabling dependabot on https://github.com/wildfly/wildfly-archetypes and other changes

On 16 Aug 2023, at 22:28, Wolfgang Knauf <wolfgang.knauf(a)gmx.de&gt; wrote: Hi Jeff, just a short feedback - your commit looks good to me, but I don't have any knowledge about Github workflows, so I cannot comment about the details ;-). Keep on working on it! Best regards Wolfgang Am 16.08.23 um 14:40 schrieb Jeff Mesnil: > Hi Wolfgang, > > Starting with your comment at the bottom: > >> My current opinion is that the dependabot or automated don't not help >> me, just make my life harder ;-) > That’s definitely not my goal, quite the opposite :) > > I want to streamline and delegate to CI the maintenance cost of the archetypes (keeping up with dependencies, testing that nothing is broken, etc.). > > I think we can achieve that and make your life (or any contributor) easier :) > > As an example, I’ve opened a PR that runs your tests for all 3 archetypes in managed and remote setup: > > https://github.com/wildfly/wildfly-archetypes/pull/36 > > With this CI in place, any changes to the archetypes would be checked as you are doing now manually afaict. You can see a summary of all testing at https://github.com/wildfly/wildfly-archetypes/actions/runs/5878713295 > > On 10 Aug 2023, at 22:29, Wolfgang Knauf <wolfgang.knauf(a)gmx.de&gt; wrote: >> I did the last few updates of the archetypes, so I am used to the >> process to check all plugins for new versions ;-). I am also willing to >> continue doing this. Most of the time, the hard stuff was to find >> someone who could do a release of the archetype ;-). > I would definitely be happy to help on that front if I’m confident about the code quality whenever we need a release. > >> The dependabot pull requests won't not help me, because I don't have the >> privileges to merge them. In order to test whether they work (when >> preparing for a new WildFly version), I would have to apply them to my >> local project (in combination with the next WildFly update), do my test >> script and then revert them again - or tell the guy who updates my pull >> request that my change also contains the plugin updates and that the >> dependabot changes can be discarded. > With the CI above, we could update dependencies for the subsystem and war whenever their dependencies are updated. > >> If the Ear archetype does not receive those update notifications, this >> is dangerous - here they would have to applied by a human - that's >> dangerous to forget them. > That’s the only part that I’ve not been able to automate. > Someone would have to check the deps at https://github.com/wildfly/wildfly-archetypes/blob/554c1aa785c2ffd1054f7d... and make sure they are aligned with the web app archetype at https://github.com/wildfly/wildfly-archetypes/blob/554c1aa785c2ffd1054f7d... (+ the ear and ejb plugin) > > >> An automated test for each archetype would be nice, but as far as I >> understand you, this would only work for managed servers. I also have >> test scripts for remote servers, as the archetypes contain a profile for >> them. The subsystem archetype cannot be tested as managed server as far >> as I know. So it seems automated tests would not provide the same >> coverage that my manual tests do. > I think they do. Did I miss a coverage from them? Could you please review https://github.com/wildfly/wildfly-archetypes/pull/36? > > Best regards, > Jeff >