Mellanox / network-operator / 28155318860
63%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 64
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 63.106% (+0.04%) from 63.068%
28155318860

push

github

web-flow 
ci: sync Dependabot config to release branches for owned components (#2666)

## What

Make the Release workflow keep Dependabot working on LTS release
branches
(`network-operator-<MAJOR.MINOR>.x`) of the component repos.

## Why

Dependabot only acts on a repo's **default branch** unless a config
entry
explicitly sets `target-branch`. So once we cut a release branch in a
component repo, that branch got **zero** dependency updates — security
and
patch bumps never reached our LTS lines.

## How

When `create-tags-for-components` cuts a release branch in a component
repo, it now also opens a PR on that repo's **default branch** adding a
`target-branch` Dependabot entry for the new branch. The entry is a
clone
of each existing default-branch update entry, retargeted and restricted
to
**patch-only** bumps (major/minor ignored) to keep stable branches
quiet.

Opt-in is **per component**, via a new `dependabotSyncManaged` flag in
`hack/release.yaml`. Only repos whose Dependabot config we own are
touched
— forks whose config is synced from upstream, and repos with no config,
are excluded. Classification (derived by inspecting each source repo):

| Category | Repos |
|---|---|
| **Ours (flagged)** | network-operator-init-container,
k8s-rdma-shared-dev-plugin, ib-kubernetes, ipoib-cni, nvidia-k8s-ipam,
nic-feature-discovery, nic-configuration-operator, maintenance-operator,
spectrum-x-operator, doca-driver-build, k8snetworkplumbingwg-plugins\* |
| **Upstream-managed (skip)** | sriov-network-operator, sriov-cni,
ib-sriov-cni, sriov-network-device-plugin, ovs-cni, rdma-cni,
node-feature-discovery, dra-driver-sriov |
| **No dependabot (skip)** | multus-cni |

\* `k8snetworkplumbingwg-plugins` is a fork, but upstream ships no
dependabot config and we added our own — so it's ours. A blanket
"skip all forks" rule would wrongly exclude it; the per-component marker
is authoritative.

### Workflow changes

- `determine-versions`: new `sync_dependabot` output — `true` fo... (continued)

5010 of 7939 relevant lines covered (63.11%)

47.16 hits per line

Coverage Regressions

Lines Coverage ∆ File
4
75.24
 -3.81% pkg/state/state_ipoib_network.go
2
83.33
 -2.38% controllers/ipoibnetwork_controller.go
1
84.19
 0.43% controllers/nicclusterpolicy_controller.go
Jobs
ID Job ID Ran Files Coverage
1 28155318860.1 64
63.11
 GitHub Action Run
Source Files on build 28155318860