Dependabot-core: Limit concurrency of updates for Dependabot

[StephanBijzitter]

Hello!

When merging a pull request from dependabot, it automatically rebases all other open pull requests (at least if pull requests must be up to date).

This is awesome! But... we use Codeship and we have a plan with limited concurrency where we can only have so many builds active at one time. When Dependabot updates it could very well rebase 20 to 30 pull requests, most of which end up in a queue.

Now, the queuing is also not really bad: they will eventually run. The problem is when we are also working on other things and need to deploy changes to our testing environments and our own changes are queued behind the builds triggered by Dependabot.

I'd like to propose an optional setting for Dependabot where the concurrency can be configured. For example, when set to 3, Dependabot should not rebase (or create new) branches until there's less than 3 existing Dependabot pull requests with pending status checks.

It's a minor inconvenience, but if it's a simple feature... who knows :-)

[sgerrand]

👍 for this, as we're also hit by this back pressure issue a lot.

[DeividasK]

This is also affecting us (in a slightly different way). Our use case is that all of our deploys are asynchronous, which means that, if dependabot PRs are merged close to each other, this creates a race condition for deploy.

Limited concurrency would allow us to effectively throttle how many dependency updates are being merged in to master at the same time.

[DeividasK]

@greysteil do you reckon this is possible and is there a way we could help with that? It's a real issue for us as multiple simultaneous deploys have already caused a couple of race conditions where an earlier code version was live as well as downtime (we are using GAE and it doesn't like multiple things happening at the same time).

[greysteil]

It's definitely possible, but unfortunately the logic for it will need to live in the dependabot-backend repo, which is private.

I'd love to get to this, but we don't have a team at GitHub for proactive work on Dependabot Preview at the moment. We're focussed on integrating into GitHub for the next few months; hopefully after that we'll be able to prioritise work like that.

[casmith]

+1 would be great to throttle the number of concurrent PRs from dependabot as it creates a lot of pressure on our CI environments with all the redundant builds.

[atmcarmo]

+1 for this feature request. This would really be helpful for us as well as sometimes we have a burst of dependabot builds.