Skip to content
Other CI: the depdelta command

Other CI: the depdelta command

The same review from a pipeline on Gerrit, GitLab, Forgejo, Gitea, Bitbucket or Azure DevOps.

Setup for each CIMake an API key
  1. Make an API key in Settings and store it in your CI as DEPDELTA_API_KEY.
  2. Add one job that runs depdelta on each change. Other CI has a ready file for Jenkins with Gerrit, GitLab CI, Forgejo Actions, Woodpecker, Bitbucket Pipelines and Azure Pipelines.
  3. DepDelta posts its review: a Gerrit message, or one merge or pull request comment kept up to date.
Install
docker pull ghcr.io/mbobiosio/depdelta-cli:latest
# or
pip install depdelta-cli

It needs Python 3.11 or later and git, or the Docker image. A shallow clone is fine. Changes that touch no manifest or lockfile finish at once.

What it posts

On GitLab, Forgejo, Gitea, Bitbucket and Azure DevOps: one comment, kept up to date. It is the same review the GitHub app posts.

DepDelta Bot @depdelta-bot commentedEdited

DepDelta review: 🔴 Breaking

org.jetbrains.exposed:exposed-kotlin-datetime 0.40.1 → 0.61.0

2 breaking changes.

This repo appears to use

  • src/main/kotlin/db/Tables.kt:25 · CurrentDateTime (changed: check this use)

Must act

  • Breaking · 0.42.0 · Remove unnecessary parentheses for functions.
  • Deprecated · 0.42.0 · Raise deprecation levels of API elements.

API changes (from published JVM bytecode)

  • removed method CurrentDateTime.invoke(): CurrentDateTime
  • removed ctor CurrentTimestamp()
  • changed final class CurrentDateTime extends Function → final class CurrentDateTime extends CurrentTimestampBase
  • changed method KotlinInstantColumnType.notNullValueToDB(Object): Object → method KotlinInstantColumnType.notNullValueToDB(Instant): Object
  • and 12 more

Every change in the range on DepDelta

depdeltaJob exited 1: --fail-on breaking met a Breaking updateFailed
A real review, posted by the depdelta command on an example merge request. Forgejo, Gitea, Bitbucket and Azure DevOps show the same comment. The job fails only with --fail-on.

On Gerrit: a plain-text message on the patch set, with no vote.

DepDelta Bot Patch Set 2:autogenerated
DepDelta review: 🔴 Breaking

Lockfile: 412 → 412 packages · 9 updated · no new install scripts

eslint 8.57.0 → 9.0.0 · 🔴 Breaking

37 breaking changes and a platform requirement change.

This repo appears to use:
- tools/lint.js:12 · CLIEngine (removed: will break)

Supply chain: dev dependency

Must act:
- Breaking · 9.0.0 · Moves AST traversal into SourceCode.
- Breaking · 9.0.0 · Changes no-unused-vars default caughtErrors to 'all'.
- Breaking · 9.0.0 · Adds stricter rule test validations.
- and 34 more

Migration guide: Migrate to ESLint 9 https://eslint.org/docs/latest/use/migrate-to-9.0.0

Every change in the range: https://depdelta.com/npm/eslint/compare/8.57.0...9.0.0
A real review on an example change. On the other hosts the same review is a Markdown comment, like the GitHub app's.

Options

OptionWhat it does
--fail-on breakingExit 1 when an update is that risky or riskier, to fail the job. Riskiest first: breaking, unknown, review, safe. The default, never, never fails it.
--wait 300Seconds to wait for release notes DepDelta hasn't read yet. After that the review posts as it stands.
--printPrint the review instead of posting it.
--base REV --head REVReview any two commits, outside CI. The review is printed.
--format texttext, markdown or commonmark. Each host gets the right one by default.

Exit codes: 0 posted, or nothing to review; 1 the --fail-on verdict was met, or .depdelta.yml blocks new install-time code; 2 it couldn't review or post.

Try it on your machine

Run it in a checkout. Outside CI it prints the review instead of posting it:

Terminal
DEPDELTA_API_KEY=dd_… depdelta --base origin/main --head HEAD

Add --format text for plain text, and --fail-on to see the exit code your CI would get:

depdelta --base origin/main --head HEAD --format text --fail-on breakingdepdelta: Usage check: 1 use found.depdelta: 🔴 Breaking (1 update).DepDelta review: 🔴 Breaking

Lockfile: 412 → 412 packages · 9 updated · no new install scripts

eslint 8.57.0 → 9.0.0 · 🔴 Breaking

37 breaking changes and a platform requirement change.

This repo appears to use:
- tools/lint.js:12 · CLIEngine (removed: will break)

Supply chain: dev dependency

Must act:
- Breaking · 9.0.0 · Moves AST traversal into SourceCode.
- Breaking · 9.0.0 · Changes no-unused-vars default caughtErrors to 'all'.
- Breaking · 9.0.0 · Adds stricter rule test validations.
- and 34 more

Migration guide: Migrate to ESLint 9 https://eslint.org/docs/latest/use/migrate-to-9.0.0

Every change in the range: https://depdelta.com/npm/eslint/compare/8.57.0...9.0.0echo $?1
The review prints to the terminal and the log lines go to stderr. With --fail-on breaking, a Breaking update exits 1.

What leaves your CI

DepDelta gets only the manifests and lockfiles that changed, and the file, line and name of each place your code uses a changed API. Your source code stays in CI, and your git host's token is only sent to your git host. Each key can run 240 reviews an hour.

Still stuck?

Ask us. A person reads every message and replies by email.

Ask a question