Add workflow that automatically updates target dependencies

[laeubi]

Currently we need to keep track of new versions manually what can become quite cumbersome.

This creates an (experimental) automatic job that is triggered each day and check if there are updates available and suggests a PR to update them.

[mickaelistria]

That seems very interesting, and can probably save some time to @merks , so I'd be in favor or merging ASAP (and revert it if we find it not profitable yet).
One question: how does it identify new versions? Does it work only for Maven content or also with p2 content? Can it even already suggest to use a newer p2 repo?

[mickaelistria]

Let's merge and see what happens.

[mickaelistria]

See #2209 . This bot isn't providing such helpful input at the moment. I'm going to revert it.

[laeubi]

@mickaelistria sorry I was away from the computer last week.

how does it identify new versions?

It is using the metadata (for example P2 or configured maven repositories) to simply search for the latest version and updates the version string.

Does it work only for Maven content or also with p2 content?

Currently it support Maven + P2 but can technically enhanced to support any type of location that provides suitable information

Can it even already suggest to use a newer p2 repo?

Not in the current state but that is something I'm planning to support

Let's merge and see what happens.

• Dependency Updates #2209

This bot isn't providing such helpful input at the moment. I'm going to revert it.

That a bit unfortunate as the goal is to get some experience, find bugs and improvements and this won't work if we do this back-and-forth when some issues arises (that don't really affect any production builds), at least we can now see that it produces a PR as desired so we can review / improve and possibly pick whats useful and identify things that need improvements.

[mickaelistria]

this won't work if we do this back-and-forth when some issues arises

I think the bot "only" calls a Tycho mojo. And with #2209 we identified some concrete issues with the proposal of this Tycho mojo. Improving the mojo can be done locally, running it can easily be done locally without creating "noise" on the Eclipse project tracker. There is enough feedback here and on #2209 to trigger some development. When all the provided feedback is addressed, then we can reconsider enabling the bot and see what the next version produces. But at the moment, I think there is clearly enough input to drive development and pause the experiment on Platform tracker.

[laeubi]

But at the moment, I think there is clearly enough input to drive development and pause the experiment on Platform tracker.

I don't agree here, the workflow is for the automation of the process and gather feedback from others, nothing of those can be accomplished with local testing and one open PR is negligible compared to having noise in the git history bu adding / removing the same code over and over again on each iteration.

Beside that, workflows can be temporarily being disabled in github, there is no need to delete the file itself.