Ensuring plugin dependencies reproducibility

In the pipeline we need to add dependabot to automatically check the versions of dependencies on a regular basis.

We can run it in the CI or make a dependabot repo to check all plugins. We need to brainstorm it ...

We need to find out a story for this, then we would be able to set a due time for adding this feature

assigned to @k202187

As a suggestion of use dependabot in the pipeline we can find out the first commit and set the scheduler just in the first commit via Gitlab API:

  script:
    - if [ $(git rev-list --count HEAD) -eq 1 ]; then curl --request POST --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
     --data "description=Nightly build" \
     --data "ref=master" \
     --data "cron=0 0 * * *" \
     --data "cron_timezone=UTC" \
     --data "active=true" \
     "https://gitlab.dkrz.de/api/v4/projects/<project_id>/pipeline_schedules"; fi

Need to be investigated in the pipeline ....

Following our recent discussion with @k204230, we've concluded that integrating dependabot for this specific purpose may not align well with our goal of enhancing plugin reproducibility, as outlined in the Freva deployment guide on reproducibility. Therefore, rather than incorporating the dependabot image into our CI process, we should focus our efforts on adhering to the principles of reproducibility. This approach will ensure our project remains consistent and reliable for future developments.

changed title from adding dependabot image for version checking the dependencies in the plugins to Ensuring plugin dependencies reproducibility

changed the description

added Priority | High Feature Sprint Backlog labels

changed milestone to %Plugin-Template development

removed Priority | High label

added Priority | Medium label

added User Story label

changed the description

i has been fixed via defining the dedicated env of each plugin

closed