chore(deps): watch all three graphs from one dependabot entry - #927
Merged
Conversation
The three cargo entries here covered the right graphs and produced PRs that could not land. A version declared in the root manifest spans all three lockfiles, but each entry regenerates only its own, so every PR left the other two stale against the manifest they resolve from and failed this repo's drift gates. The smoltcp 0.14 bump arrived as #923, #924 and #925 -- three PRs, none mergeable alone, consolidated by hand into #926. `directories` (plural) watches the same three graphs from a single entry and groups them into one PR. Verified against aletheia, which already uses this form: its #6897 is titled "bump the patch-updates group across 2 directories" and carries both Cargo.lock and fuzz/Cargo.lock in one diff. The coverage rationale the previous comment recorded is preserved, because it was right and was learned expensively: watching only `/` is how fuzz/Cargo.lock drifted nine releases with two path-dependencies missing (#768). This changes how the coverage is expressed, not how much there is.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three
package-ecosystem: cargoentries in this repo's dependabot config are why the smoltcp 0.14 bump arrived as three PRs that could not land.The mechanism
thumos carries three independent dependency graphs with their own lockfiles —
/,/crates/thumos(excluded from the workspace so it cross-compiles bare-metal toarmv7a-none-eabi), and/fuzz(own empty[workspace], cargo-fuzz needs nightly).A version bump declared in the root manifest spans all three. But three separate entries each regenerate only their own lockfile:
Cargo.lockcrates/thumospin + lock,fuzz/Cargo.lockcrates/thumos/Cargo.lockCargo.lock,fuzz/Cargo.lockfuzz/Cargo.lockCargo.lock,crates/thumospinEach failed this repo's own drift gates —
PIN DRIFTfromrustfmt, anderror: cannot update the lock file ... because --locked was passedfrom the workspace and kernel jobs. None could pass alone, and merging any one would have left the others' graphs disagreeing with the manifest they resolve from. They were consolidated by hand into #926.This will recur on the next bump that touches a shared dependency. It is a config property, not bad luck.
The fix, and why I trust it
directories(plural) watches the same three graphs from a single entry, and groups span them.Verified empirically rather than from documentation — aletheia already uses this form, and its dependabot PR #6897 is titled "bump the patch-updates group across 2 directories" with
Cargo.lockandfuzz/Cargo.lockin one diff. That is exactly the shape thumos could not produce.What is preserved
The previous comment's coverage rationale, verbatim in substance. It was right, and it was learned expensively: watching only
/is howfuzz/Cargo.lockdrifted nine releases with two path-dependencies missing entirely, invisible tocargo auditandcargo denythe whole time (#768).That fix was correct about which graphs to watch. This changes how that coverage is expressed, not how much of it there is — same three directories, one entry instead of three.
Scope
Config only. No dependency versions change here.