starred/koel-koel

Fork 0

mirror of https://github.com/koel/koel.git synced 2026-04-26 09:15:59 +03:00

[GH-ISSUE #807] Suggestion / request: Use Dependabot to update dependencies #569

New issue

Closed

opened 2026-02-26 02:33:35 +03:00 by kerem · 5 comments

kerem commented

2026-02-26 02:33:35 +03:00

Owner

Originally created by @greysteil on GitHub (Sep 24, 2018).
Original GitHub issue: https://github.com/koel/koel/issues/807

First of all, thanks for koel!

I've got a suggestion / request: would you be up for using Dependabot to automatically create dependency update PRs for this repo? I ran it against my fork and it generated these PRs. I'll port the laravel/framework one across to this repo now.

I built Dependabot and give it away for free to open source projects (partly for the exposure, but mainly because it feels good to give back and because the feedback is incredibly useful). I'm honestly only suggesting it because I hope it can save you some time doing work that is otherwise monotonous.

If you do decide to give Dependabot a go the easiest URL to add it from is https://github.com/apps/dependabot (alternatively you can go through the GitHub Marketplace, but the flow there can be a little confusing for open-source repos on an organisation account).

:octocat:

Originally created by @greysteil on GitHub (Sep 24, 2018). Original GitHub issue: https://github.com/koel/koel/issues/807 First of all, thanks for koel! I've got a suggestion / request: would you be up for using [Dependabot](https://dependabot.com) to automatically create dependency update PRs for this repo? I ran it against my fork and it generated [these PRs](https://github.com/greysteil/koel/pulls). I'll port the `laravel/framework` one across to this repo now. I built Dependabot and give it away for free to open source projects (partly for the exposure, but mainly because it feels good to give back and because the feedback is incredibly useful). I'm honestly only suggesting it because I hope it can save you some time doing work that is otherwise monotonous. If you do decide to give Dependabot a go the easiest URL to add it from is https://github.com/apps/dependabot (alternatively you can go through the [GitHub Marketplace](https://github.com/marketplace/dependabot), but the flow there can be a little confusing for open-source repos on an organisation account). :octocat:

kerem closed this issue

2026-02-26 02:33:35 +03:00

kerem commented

2026-02-26 02:33:35 +03:00

Author

Owner

@phanan commented on GitHub (Sep 26, 2018):

@greysteil Dependabot looks great! I'll definitely give it a try, thanks!

@phanan commented on GitHub (Sep 26, 2018): @greysteil Dependabot looks great! I'll definitely give it a try, thanks!

kerem commented

2026-02-26 02:33:35 +03:00

Author

Owner

@phanan commented on GitHub (Sep 26, 2018):

Why does it need WRITE access though?

@phanan commented on GitHub (Sep 26, 2018): Why does it need WRITE access though?

kerem commented

2026-02-26 02:33:35 +03:00

Author

Owner

@greysteil commented on GitHub (Sep 26, 2018):

Thanks @phanan!

Ack, the permissions are annoying. Dependabot creates branches on this repo - it doesn't fork it. That's the right behaviour for private repos, but ideally it would use a forking flow for public ones (although there are some advantages to not, too - it means CI runs using your setup, for example). Sadly, GitHub doesn't offer the ability for me to ask for different permission types for different kinds of repos, so the write permission is required for all repos :-(

I am trying to work with GitHub to get that fixed - the thread to chime in on suggesting you'd like this is here. In the meantime, if your master branch is protected then Dependabot will never be able to push to it, and we specify in our terms of service that we won't push to branches that aren't namespaced under dependabot.

@greysteil commented on GitHub (Sep 26, 2018): Thanks @phanan! Ack, the permissions are annoying. Dependabot creates branches on *this* repo - it doesn't fork it. That's the right behaviour for private repos, but ideally it would use a forking flow for public ones (although there are some advantages to not, too - it means CI runs using your setup, for example). Sadly, GitHub doesn't offer the ability for me to ask for different permission types for different kinds of repos, so the write permission is required for all repos :-( I am trying to work with GitHub to get that fixed - the thread to chime in on suggesting you'd like this is [here](https://platform.github.community/t/feature-request-optional-permissions/5422). In the meantime, if your master branch is protected then Dependabot will never be able to push to it, and we specify in our terms of service that we won't push to branches that aren't namespaced under `dependabot`.

kerem commented

2026-02-26 02:33:35 +03:00

Author

Owner

@phanan commented on GitHub (Sep 26, 2018):

👍 Thanks for the explanation. It shouldn't be a deal-breaker – after all, it's all OSS! I'm giving Dependabot a try right now. Thanks again!

@phanan commented on GitHub (Sep 26, 2018): 👍 Thanks for the explanation. It shouldn't be a deal-breaker – after all, it's all OSS! I'm giving Dependabot a try right now. Thanks again!

kerem commented

2026-02-26 02:33:35 +03:00

Author

Owner

@greysteil commented on GitHub (Sep 26, 2018):

Awesome - I'm watching from my side to make sure those first PRs are all as good as they should be 🙂

@greysteil commented on GitHub (Sep 26, 2018): Awesome - I'm watching from my side to make sure those first PRs are all as good as they should be 🙂

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/koel-koel#569

No description provided.

Rows
Columns