[GitHub] [druid] jihoonson commented on pull request #11079: enable dependabot for dependency updates

[GitBox <gi...@apache.org>]

jihoonson commented on pull request #11079:
URL: https://github.com/apache/druid/pull/11079#issuecomment-856232406


   > @jihoonson if we don't have a good way of catching these things today as part of our CI builds, I'm not sure there is a difference between automation or humans submitting PRs. We still need to approve these changes before they get merged, so I would hope that we don't approve upgrades if we are aware that it might affect some of those tests.
   > 
   > We can of course exclude any dependencies that we know lack good integration test coverage to be safe.
   
   The difference will be that the PR author will be responsible for testing in human-oriented way (that is, the testing burden is more distributed), while it will be reviewers in the automatic way until we will have some automatic testing. This will increase the burden of the reviewers, especially given that we don't have many active reviewers today. But I agree that having more tests running on Travis solves the root cause.
   
   I'm wondering if we can have an allow list for dependencies that we are confident to upgrade automatically instead of using a deny list. Assuming the allow list will contain only the dependencies we know their testing scope, I would be more confident to merge the PRs that this bot will create without actually testing them by myself.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org