Joker 2019: Tame your dependencies with Dependabot!

What is common between Maven, NPM or RPM? It is dependency hell. Continuously updating dependencies is a significant overhead. If you do not do that, any next major update might be a problem for you. It is exactly what we hit while adding Java 11 support to Jenkins. What if we delegate such routine work to a bot? In our project we chose Dependabot, and in this talk I would like to do a brief introduction to the tool.

Transcript

1. © 2019 CloudBees, Inc. All Rights Reserved.
   Tame your dependencies!
   Dependabot
   Oleg Nenashev (@oleg_nenashev)
   CloudBees, Inc.
   St. Petersburg, Oct 25, 2019
   

   View Slide

2. © 2019 CloudBees, Inc. All Rights Reserved.
   > whoami
   @oleg_nenashev
   oleg-nenashev
   • Based in Neuchatel, Switzerland
   • Principal SW Engineer, CloudBees
   • Jenkins core maintainer
   2
   

   View Slide

3. © 2019 CloudBees, Inc. All Rights Reserved.
   3
   https://jokerconf.com/en/2019/talks/rjhhmugp5tzqbmlmg3mcm/
   

   View Slide

4. © 2019 CloudBees, Inc. All Rights Reserved.
   What’s common between Maven,
   NPM, и RPM?
   4
   

   View Slide

5. © 2019 CloudBees, Inc. All Rights Reserved.
   Dependency
   Hell
   5
   

   View Slide

6. © 2019 CloudBees, Inc. All Rights Reserved.
   Lib 1 Lib 2 Lib 3
   Plugin 1 Plugin 2 Plugin 3
   Lib 4
   Lib 5
   Plugin 4
   6
   + Tool dependencies
   

   View Slide

7. © 2019 CloudBees, Inc. All Rights Reserved.
   7
   > mvn versions:display-updates
   ...
   ? ? ?
   

   View Slide

8. © 2019 CloudBees, Inc. All Rights Reserved.
   What if we automate updates?
   8
   

   View Slide

9. 9
   Dependabot, Renovate, Greenkeeper, etc.
   

   View Slide

10. © 2019 CloudBees, Inc. All Rights Reserved.
    Dependabot
    10
    dependabot.com, acquired by GitHub
    

    View Slide

11. © 2019 CloudBees, Inc. All Rights Reserved.
    Dependabot
    ● CLI tool
    ● SaaS and GitHub App
    11
    dependabot.com, acquired by GitHub
    

    View Slide

12. © 2019 CloudBees, Inc. All Rights Reserved.
    Automatic scans and updates
    12
    

    View Slide

13. View Slide

14. View Slide

15. © 2019 CloudBees, Inc. All Rights Reserved.
    Step 1. Enable Dependabot
    15
    

    View Slide

16. © 2019 CloudBees, Inc. All Rights Reserved.
    Step 2. Setup permissions
    16
    

    View Slide

17. © 2019 CloudBees, Inc. All Rights Reserved.
    Step 3. Configure Dependabot
    17
    

    View Slide

18. © 2019 CloudBees, Inc. All Rights Reserved.
    Step 4. Just wait a bit…
    18
    

    View Slide

19. © 2019 CloudBees, Inc. All Rights Reserved.
    Not just pull requests!
    19
    

    View Slide

20. © 2019 CloudBees, Inc. All Rights Reserved.
    Release notes
    20
    

    View Slide

21. © 2019 CloudBees, Inc. All Rights Reserved.
    CommentOps
    21
    

    View Slide

22. © 2019 CloudBees, Inc. All Rights Reserved.
    Configuration-as-Code
    22
    

    View Slide

23. © 2019 CloudBees, Inc. All Rights Reserved.
    Advanced options
    ● Filtering of versions
    and artifacts
    ● Validated merge
    ● Integration wit GitHub
    security engines
    23
    

    View Slide

24. © 2019 CloudBees, Inc. All Rights Reserved.
    Dependabot in Jenkins
    • Evaluation started in June 2019
    • Enabled in 60+ repositories
    • 1750+ pull requests
    • Saves time!
    24
    

    View Slide

25. © 2019 CloudBees, Inc. All Rights Reserved.
    Contacts:
    E-mail: onenashev@cloudbees.com
    GitHub: oleg-nenashev
    Twitter: @oleg_nenashev
    QUESTIONS?
    25
    

    View Slide