Skip to content

chore(ci): add Dependabot to track published hotdata SDK #146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zfarrell merged 1 commit into from
Jun 5, 2026
Merged

chore(ci): add Dependabot to track published hotdata SDK #146

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Keeps the CLI current with published Hotdata SDK releases. Scoped to the
# `hotdata` crate so unrelated transitive deps don't churn; when a new version
# is published to crates.io, Dependabot opens a `chore(deps)` PR (gated by CI).
version: 2
updates:
- package-ecosystem: cargo
directory: "/"
schedule:
interval: daily
allow:
- dependency-name: "hotdata"
Comment on lines +10 to +11

@claude claude Bot Jun 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This config won't track crates.io releases of the SDK as intended. In Cargo.toml:20, hotdata is a git dependency pinned to a rev:

hotdata = { git = "https://github.com/hotdata-dev/sdk-rust", rev = "1687ba2...", features = ["arrow"] }

Dependabot resolves updates from a dependency's declared source, not crates.io. Since the manifest sources hotdata from git, a crates.io publish is invisible to this config — the premise in the PR description and the header comment ("when a new version is published to crates.io") doesn't hold here.

For a git dependency, Dependabot's cargo updater only advances deps that track a branch (to the latest commit) or a tag; it does not reliably bump a dependency pinned to an explicit rev. So as written this is likely to open no PRs at all. And if it did advance the rev, it would bump to arbitrary default-branch commits — which directly conflicts with the deliberately pinned rev documented in Cargo.toml (the comment there explains this exact rev is the first to carry content_length on upload_stream).

To achieve the stated goal you'd need to either (a) switch the SDK to a crates.io dependency (hotdata = "x.y"), then this config works as described, or (b) track the git source explicitly (e.g. point the dep at a branch/tag and accept that Dependabot follows git, not crates.io). Please reconcile the config with how the dependency is actually sourced.

commit-message:
prefix: "chore(deps)"
labels:
- dependencies
Loading