Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a check for dependabot PR updating guest or common lib dependencies #154

Closed

Conversation

simongdavies
Copy link
Contributor

We have a check in the PR workflow to ensure that Cargo.lock files are up to date as a part of any PR. This works fine for most scenarios but when dependabot updates depdendencies in either hyperlight_common or hyperlight_guest this may make the Cargo.lock file out of date for the simpleguest and callbackguest test guest binaries.

See #148 for an example of this.

This PR updates the PR workflow to update those files if there are dependabot changes to the dependencies in either of those crates.

@simongdavies simongdavies added the area/dependencies Pull requests that update a dependency file label Jan 21, 2025
@ludfjig
Copy link
Contributor

ludfjig commented Jan 22, 2025

I suspect if we add the directory of simpleguest to dependabot.yml, it would update those cargo.toml as well, and we should be fine. It might be an easier solution that this. I'm thinking replace

  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "daily"

with

  - package-ecosystem: "cargo"
    directory: ["/", "src/tests/rust_guests/simpleguest"]
    schedule:
      interval: "daily"

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#directories-or-directory--

It might be worth a try anyway?

@simongdavies
Copy link
Contributor Author

It might be worth a try anyway?

Yes , definitely, I will close this one and open a new one with your suggestion, if it doesnt work we can aways re-open this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants