Skip to content

Commit 8cdf2d8

Browse files
committed
Dependabot: remove composer ecosystem
Dependabot has basically _never_ submitted any useful PRs updating the dependencies managed via Composer. In most cases, it wouldn't be able to anyway as the "widen" strategy only really causes update PRs when a new major of a dependency is released and with a new major of a dependency, we'll generally need to do a managed update, so wouldn't be able to use the Dependabot PR anyhow. On top of that, it appears to be completely impossible to set any environment variables for the running of Dependabot via GH Actions. This is problematic as we have a circular dependency via the `phpcsstandards/phpcsdevcs` package since the update to PHPCSDevCS 1.2.0 and the only way to get round that is to set a `COMPOSER_ROOT_VERSION` environment variable. In practice, this means that since the update to PHPCSDevCS 1.2.0, the action runs for Dependabot are failing, which is not useful. All in all, I see no upside to continue to have Dependabot enabled for the Composer packages.
1 parent e4fe01a commit 8cdf2d8

1 file changed

Lines changed: 0 additions & 11 deletions

File tree

.github/dependabot.yml

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,6 @@
55

66
version: 2
77
updates:
8-
- package-ecosystem: "composer"
9-
directory: "/"
10-
schedule:
11-
interval: "weekly"
12-
open-pull-requests-limit: 5 # Set to 0 to (temporarily) disable.
13-
versioning-strategy: widen
14-
commit-message:
15-
prefix: "Composer:"
16-
labels:
17-
- "Type: chores/QA"
18-
198
- package-ecosystem: "github-actions"
209
directory: "/"
2110
schedule:

0 commit comments

Comments
 (0)