David Lord discusses the challenges he faces while maintaining multiple libraries on GitHub, particularly regarding the overwhelming number of scheduled dependency updates. He actively manages around 20 libraries and has access to another 20, most of which are stable and experience low activity. The introduction of scheduled dependency updates has disrupted the calmness of these projects, leading him to disable these updates in favor of a local update command. To maintain a consistent development environment, Lord pins development dependencies across three ecosystems: Python requirements files using pip-compile, pre-commit hooks, and GitHub Actions in CI workflows. Each of these ecosystems can generate monthly pull requests (PRs) for updates, resulting in a significant influx of notifications—approximately 60 PR notifications at the start of each month. This flood of notifications not only overwhelms him but also makes it difficult for occasional contributors to identify relevant updates. The process of addressing each PR is cumbersome, requiring multiple steps that disrupt his workflow. When test failures occur, he must switch contexts to troubleshoot issues in projects he hasn't engaged with for months. This busy work detracts from meaningful contributions and makes it challenging to differentiate between actual fixes or features and routine updates. While scheduled updates may be beneficial for applications with continuous deployment, Lord argues that for libraries, which primarily serve as development environments, constant attention to updates is unnecessary. He prefers to manage updates manually, running tools like pip-compile and pre-commit locally. However, he found that there was no straightforward way to update GitHub Actions locally, prompting him to create a tool called gha-update. This tool automates the process of finding and updating action versions in workflow files, allowing him to maintain control over updates. With this new approach, Lord can update dependencies only when actively working on a project, ensuring that he has a stable environment upon returning to a project after a hiatus. He successfully updated all his projects without the usual barrage of notifications, marking a significant improvement in his workflow. To facilitate these updates, he utilizes specific tox environments for each tool, enabling him to run updates individually or collectively. He can also leverage all-repos to apply these updates across all his projects, run tests, and create pull requests or push changes to the main branch, all on his own schedule. This method allows him to regain control over his development process, reducing noise and enhancing productivity.
Thursday, September 26, 2024