Skip to content

Commit c1c9d05

Browse files
committed
Dependabot: remove composer ecosystem
Dependabot has basically _never_ submitted any useful PRs updating the dependencies managed via Composer. In most cases, it wouldn't be able to anyway as the "widen" strategy only really causes update PRs when a new major of a dependency is released and with a new major of a dependency, we'll generally need to do a managed update, so wouldn't be able to use the Dependabot PR anyhow. On top of that, it appears to be completely impossible to set any environment variables for the running of Dependabot via GH Actions. This is problematic as we have a circular dependency via the `phpcsstandards/phpcsdevcs` package since the update to PHPCSDevCS 1.2.0 and the only way to get round that is to set a `COMPOSER_ROOT_VERSION` environment variable. In practice, this means that since the update to PHPCSDevCS 1.2.0, the action runs for Dependabot are failing, which is not useful. All in all, I see no upside to continue to have Dependabot enabled for the Composer packages.
1 parent 0af7f81 commit c1c9d05

File tree

1 file changed

+0
-12
lines changed

1 file changed

+0
-12
lines changed

.github/dependabot.yml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,6 @@
55

66
version: 2
77
updates:
8-
- package-ecosystem: "composer"
9-
directory: "/"
10-
schedule:
11-
interval: "weekly"
12-
open-pull-requests-limit: 5 # Set to 0 to (temporarily) disable.
13-
versioning-strategy: widen
14-
commit-message:
15-
prefix: "Composer:"
16-
include: "scope"
17-
labels:
18-
- "Type: chores/QA"
19-
208
- package-ecosystem: "github-actions"
219
directory: "/"
2210
schedule:

0 commit comments

Comments
 (0)