Define `dependencies` practices

[cjyetman]

I strongly encourage enabling Dependabot on repos that you maintain, if for nothing else to monitor GH actions that have been updated.

[jdhoffa]

I don't know much about how to use Dependabot/ what it can or can't do (beyond the action monitoring which I have seen before).

May I assign this issue to you, and can you elaborate on what other functionalities you think are useful from Dependabot?

[cjyetman]

This is the best starting point (for using Dependabot for version updates):
https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates

[cjyetman]

Dependabot can periodically check the versions of packages used in various languages in your repo and warn you when something has an update. In our repos, I've used it primarily to monitor GitHub actions and JavaScript/NPM modules. When it notices something has an update, like a version bump on an external GitHub action you are using, it automatically opens a PR in your repo with the appropriate change to target the new version.

@jdhoffa I'm not sure what it means to have this "assigned" to me. What is the task?

[jdhoffa]

Yup fair enough, mainly I just wanted more context here and thought you were the person to give it! Un-assigning you.

In any case, reading the additional context here, I believe this is too prescriptive to live as a practice (although agree that we may want to incentivize people to use this):
https://github.com/RMI-PACTA/practices/blob/fd6129122c8724c16faa0f0444ad9b981046f85d/README.md?plain=1#L5

In this repository, the goal is to cover the WHAT (e.g. ensure dependencies in your repositories are up to date) and WHY (e.g. to stay current with security issues, bug-fixes, new features, etc.)

without being prescriptive on the HOW (e.g. use dependabot).

@AlexAxthelm do you think having a default dependabot.yml would be something that could appropriately live in the https://github.com/RMI-PACTA/Actions repo? I guess it isn't technically a GitHub action, although it feels "action adjacent". If you agree, I would transfer this issue to that repo. Otherwise I will tag it as wontfix and keep it open for conversation.

[AlexAxthelm]

Seems close enough that it should probably be included here.

[cjyetman]

does this repo allow non-prescriptive suggestions on the HOW? maybe that's the best in-between?

[AlexAxthelm]

Maybe something like

> **SUGGESTION:_**  The note content.

So we could do

SUGGESTION: The default R actions (example) in RMI-PACTA/actions implements a check for this practice.

[jdhoffa]

Lol, well you both clearly didn't take the time to read the 2 sentences of the README that I linked XD

we... recommend optional resources about how to do it.

And also clearly haven't looked at our documented git practices:

[jdhoffa]

So I think this could live in a documented practice regarding dependencies overall.

@cjyetman are you comfortable if I change the name of this issue to:
"Define dependencies practices"?

[cjyetman]

The README says...

only recommend optional resources about how to do it

so, I don't see how this does not fit here, but also don't really care

[jdhoffa]

I agree with you that it fits in here.

You were asking "is it reasonable to recommend optional resources", and I think it's totally reasonable, and it's already even in the README. That's all I was getting at lol