Pillow Updated codecov action to v3

May 07 '22 13:05 radarhere

I think these sort of updates are ideal candidates for GitHub's Dependabot.

But there's one big downside to Dependabot: it also opens PRs on forks, just check the thousands of spam PRs linking to https://github.com/dependabot/dependabot-core/issues/2804.

Not a friendly thing to do on a repo such as this with 1.9k forks!

On another project I've just started trying out an alternative called Renovate, it's free and also open source:

https://www.whitesourcesoftware.com/free-developer-tools/renovate/ > GitHub App.

Shall we give it a try?

Ping also @aclark4life

May 19 '22 15:05 hugovk

It does indeed perform this task - https://docs.renovatebot.com/modules/manager/github-actions/

I'm seeing good reviews on Google, so if you're also giving it a good review so far, I'm game.

May 20 '22 14:05 radarhere

@aclark4life Please could you enable Renovate for us?

See https://github.com/python-pillow/Pillow/pull/6281#issuecomment-1131867172

Jun 10 '22 16:06 hugovk

Adding Renovate should also improve our OpenSSF scorecard.

Aug 27 '22 01:08 radarhere

Let's hold off on pinning these for now, there's some discussion and pushback on whether this is worthwhile:

https://tideliftlifters.slack.com/archives/C03NR6M8ELQ/p1661336955651269?thread_ts=1661336955.651269&cid=C03NR6M8ELQ

Aug 27 '22 06:08 hugovk

Main has started failing in both Test and Test MinGW. This PR would resolve those issues, by replacing the bash uploader with the GitHub action.

Sep 24 '22 03:09 radarhere

Okay, let's get this merged!

First, I'll check the box at https://github.com/python-pillow/Pillow/issues/6604 to trigger Renovate so we can see it in action.

Edit: --> https://github.com/python-pillow/Pillow/pull/6616

Sep 24 '22 09:09 hugovk