https://gradle.com/ logo
Join Slack
Powered by
can settings plugins like develocity be locked? tr...
# community-support
c
can settings plugins like develocity be locked? tried, but no lockfile
Copy code
buildscript { dependencyLocking { lockAllConfigurations() } }

plugins {
  id("com.gradle.develocity") version "3.+"
}
t
given/assuming its the only settings plugin why not just set it to the exact version you want and call it good? 
3.18.1
etc...
c
then I have to keep track of whether it's been updated by hand. Also there's another plugin that I might move to settings if I can get that working
All of my other plugins are updated via automation
!dynamically 😕 that means something different 😛 I have a build job that updates my deps every week
t
gotcha. well watching to see if anyone knows better. I suspect the answer is no though just because settings vs build is such a smaller scoped thing
c
yeah, it's 99% a problem of having no good way to monitor for updates, turns out dependabot doesn't see it either
t
have you tried renovate? it hits all my settings plugins
c
never heard of it
t
its like dependabot but more
c
(ain't no one got time to manually google and look for updates of all their dependencies 😉 )
link?
t
we have one self hosted for github EMU that can see all our internal repo's so it gets everything
yeah one sec
c
since the google doesn't love googling real words 😛
cool, I'll check it out
don't know if it'll solve my problem but, we'll see
v
Quite possible, it is like Dependabot, just in better 😄
Besdies that I personally don't like either 😄
🤣 1
c
I mean, dependabot is truly awful when it comes to gradle
vampire likes spending all day once a week googling every dependency for updates and security patches 😛
v
... no I just dislike such bot-approaches greatly polluting PR space and also making projects that do not merge 50 PRs each week look unmaintained.
c
yeah, I don't love that either, which is why my build creates and auto-merges one PR for most deps
v
If I use something, then usually a combination of Ben Manes' dependency updates plugin and the refresh versions plugin.
c
I only want notices for major versions
v
I can easily set up a job that tells me something new is available and conveniently update libs to newer version without googling, but then when I want to do it
But to each his own process
c
my goal is only to every do something if something breaks
which ideally is only on major version updates
v
In an ideal world where everyone follows semver maybe. Unfortunately not so in JVM reality. 🤷‍♂️
👍 1
t
yeah thats where having good testing really comes in to save the day.
👍 1
c
most dependencies I pull seem to do ok... most... I'm not going to give checker framework a stink eye in front of other 😛 😉
the real problem is when they break stuff and then refuse to fix stuff in a patch version...
not checker framework, libraries in general
calver is semi acceptable in some cases... I think it works for apps and data only things
the jdk itself, though, I have no idea what they're doing. They moved onto madness 😕
he who does not write tests deserves what he gets
maybe doesn't do any better with updating lockfiles, docs are really confusing on how to hand it credentials from environment variables
we do security! immediately gives examples of how to commit files with credentials
😂 1
well, it's only slightly less problematic than dependabot
no idea how I'm actually supposed to tell it how to use githubs built in secrets though
meh
t
that part I can't much help with. one of our infra teams set it up to run on a schedule for any of our repo's with a config file in it so I've never actually stood it up myself
c
FE
I think it might be viable on a job if you don't use the github app
which I haven't tried yet
but also seems confusing ...
I think the confusion stems from mixing something like 3 ways to do things
s
Just chiming in, but OpenRewrite is pretty awesome as well. https://docs.openrewrite.org/ Recipes can modify the build descriptor, but also any of the other files using the LST model (think compiler AST, but more data retained). For Gradle scripts, Kotlin DSL support is still a work in progress specifically.
❤️ 1
Moderne is the paid offering, but free for open source. The platform adds precomputed LSTs and running recipes over many repositories at once.
🙌 1
2 Views
Open in Slack
PreviousNext
Powered by