Let the bots do the releases for you while you sleep
Tags: bots, github, dependabot, continuousdeployment
Published: 2021-04-08 14:45:05

When you have a high test coverage or... a high confidence in your code (in my case the former) you can setup fully automatic releases on GitHub. All driven by bots.

In this post I will show you how I set it up using my own project.

migrator is a DB migration/evolution tool written in Go. It's super fast and lightweight. It is released as a docker image on docker hub: [lukasz/migrator](https://hub.docker.com/r/lukasz/migrator). 

migrator has a code coverage of 94% and I decided to release a new docker image every time there is a new dependency available: either a new base docker image or a new version of Go dependencies.

{% github lukaszbudnik/migrator %}

# dependabot

First, you need to enable dependabot for your project. It's super easy. Just follow the instructions detailed here: [Managing vulnerabilities in your project's dependencies](https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies) and [Keeping your dependencies updated automatically](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically).

dependabot can create a pull request for you whenever there is a known security vulnerability in your 3rd party dependency and there is a fix version available. You can go even further and tell dependabot to create a pull request whenever there is a new version available. I like to live on the edge and I went ahead and enabled both options.

For reference here is the link to my dependabot config file: https://github.com/lukaszbudnik/migrator/blob/master/.github/dependabot.yml.

> Protip: Every time pull request is merged to target branch dependabot is rebasing all created pull requests (followed by re-running all checks). I provide different times for every check so that the number of rebases is kept to a minimum.

# merge-pull-requests action

The bit missing was automated merging to target branch when all tests were passing. There is an auto-merge feature available in GitHub but dependabot doesn't support it (yet).

I decided to use GitHub Action that was available on the marketplace: [GitHub Actions - Merge pull requests](https://github.com/marketplace/actions/merge-pull-requests).

I used the default configuration file provided by authors. However, the default config was quite permissive and I needed to tweak it a little bit. I wanted to auto-merge pull requests with `dependencies` label (all pull requests created by dependabot have it) and (to make sure other people would not abuse the auto-merge functionality) I wanted to auto-merge pulls created by the `dependabot[bot]` user only.

For reference here is the link to my configuration file: https://github.com/lukaszbudnik/migrator/blob/master/.github/workflows/automerge.yml 

> Protip: Make sure you have "Automatically delete head branches" enabled in your repository settings. GitHub will delete merged branches automatically. To keep things nice and tidy.

# project-bot app

Optional step. My CI/CD pipeline instructs docker hub to build new `latest` tag on every merge to main branch. However, I also wanted to roll up all small changes into official releases. I use GitHub projects (rather than milestones) to organise my work. Every time I release a new version I create a new project which acts as a placeholder for all new work. To help me organise release notes better I wanted to automatically add dependabot pull requests to an open GitHub project.

I decided to use GitHub App that was available here: [GitHub Apps - project-bot](https://github.com/apps/project-bot). In order to include a new pull request in your project just add a new card with the correct markup in one of the columns. 
For reference here is my project that uses project-bot integration: https://github.com/lukaszbudnik/migrator/projects/9.

> Protip: If you create your projects using "Automated kanban" template GitHub will automatically move merged pull request to Done column. So there is even less configuration required.

# bots in action

Below is a link to a sample pull request which was:

1. created by `dependabot`
2. added to v2021.0.1 project by `project-bot`
3. merged by `merge-pull-requests`
4. built and published by `dockerhub`

And it all happened at 4 AM CEST while I was in a well deserved deep sleep phase :)

{% github https://github.com/lukaszbudnik/migrator/pull/178 %}