diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 08b6362978..cf5b9777bf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,7 +22,7 @@ updates: - package-ecosystem: "uv" directory: "/" schedule: - interval: "weekly" + interval: "monthly" open-pull-requests-limit: 50 ignore: - dependency-name: "datafusion" @@ -31,7 +31,7 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" + interval: "monthly" cooldown: default-days: 7 groups: diff --git a/mkdocs/docs/how-to-release.md b/mkdocs/docs/how-to-release.md index b6fd545311..982447d259 100644 --- a/mkdocs/docs/how-to-release.md +++ b/mkdocs/docs/how-to-release.md @@ -34,6 +34,8 @@ This guide outlines the process for releasing PyIceberg in accordance with the [ * SVN Access * Permission to upload artifacts to the [Apache development distribution](https://dist.apache.org/repos/dist/dev/iceberg/) (requires Apache Committer access). * Permission to upload artifacts to the [Apache release distribution](https://dist.apache.org/repos/dist/release/iceberg/) (requires Apache PMC access). +* GitHub Access + * Write access to the [apache/iceberg-python](https://github.com/apache/iceberg-python) repository for triggering Dependabot (requires Apache Committer access). * PyPI Access * The `twine` package must be installed for uploading releases to PyPi. * A PyPI account with publishing permissions for the [pyiceberg project](https://pypi.org/project/pyiceberg/). @@ -65,6 +67,18 @@ deprecation_message( ) ``` +### Update Dependencies + + +Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, go to the [Dependabot page](https://github.com/apache/iceberg-python/network/updates) in the repository's Insights tab and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies. + + + +!!! note + Only a committer with write access to the repository can trigger Dependabot manually. Please work with a committer if you do not have write access. + + + ### Update Library Version Update the release version by running `uv version `, which updates both `pyproject.toml` and `uv.lock`. Then update the version in `pyiceberg/__init__.py` to match.