Dependabot and Renovate shows wrong changelog info

未关闭

#1,048 创建于 2021年12月24日 3 条评论 1 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 25/100

Issue 类型: 缺陷
描述清晰度: 基本清楚
活跃度: 停滞
技术栈: java
领域: build-system

调研方向

首先检查 spotless-maven-plugin 如何发布其变更日志和元数据，尤其是 CHANGES.md，并将其与 pull request 8480 中的 Dependabot 示例进行比较。当 Dependabot 和 Renovate 的更新 pull request 显示该插件自己的变更日志、提交以及正确的变更日志来源，而不是根项目的信息时，工作就完成了。

由索引模型根据 Issue 内容生成。

描述

bug

Many projects use dependabot to manage version updates of dependencies. It helps them to keep up to date with new versions, but also to understand what changed between versions. When a new version is available, a pull request with the related change is created. It's body (i.e. description) contains a changelog and list of commits between the different versions. For spotless-maven-plugin this does not work correctly, because it uses the changelog and commits of the root project.

For example https://github.com/camunda-cloud/zeebe/pull/8480 shows that it updates spotless-maven-plugin from 2.17.7 to 2.18.0, but the changelog shows the changes of the root project up to version 2.18.0, instead of the changes of the maven-plugin. In addition, its shows the wrong changelog as source:

Sourced from spotless-maven-plugin's changelog

Looking at the dependabot issues about changelog, this seems to be a common problem. However, it also looks like the dependabot team does not intend to change anything for it. So, I think spotless should improve its setup to correct dependabot's failure to deal with this, because it would help existing users of spotless, to learn about the changes in new versions.

主要语言: Java
星标: 5.7k
派生: 560
平均合并: 1 天 13 小时
30 天内合并 PR: 43