Add a GitHub App to allow marking pull request dependant on another

[Herve Le Meur]

Hello!

I've stumbled upon this GitHub App: https://github.com/marketplace/dpulls

> Dpulls allows you to specify dependencies between pull requests [by adding a comment] and creates a status check to make sure the PRs are merged in the right order

See it in action in this gif: https://marketplace-screenshots.githubusercontent.com/7171/4746c300-c629-11ea-85b9-44c0c5ecfe83

Features (from https://www.dpulls.com/):

- Nested dependencies: Dpulls allows dependency chain with more than one level (deep dependency)

- Cross-repository support: A PR can depend on PRs from other repositories.

- Cross-organization support: A PR can depend on PRs from other repositories even though they belong to a different organization.

They have a free tier for public repositories.

I think it could be useful on the jenkinsci and jenkins-infra GitHub organizations, WDYT?

Let me know if you're interested, regards,

Hervé Le Meur

Jenkins Infrastructure Team

[Jesse Glick]

On Wed, Sep 7, 2022 at 6:42 AM 'Herve Le Meur' via Jenkins Developers <jenkin...@googlegroups.com> wrote:

I think it could be useful on the jenkinsci and jenkins-infra GitHub organizations, WDYT?

Sure, assuming it passes some sort of security review. As someone who frequently creates sets of interrelated PRs in @jenkinsci, I would at least try it. (Really I think it should be something built into GitHub with first-class presentation.)

Note that its model is a bit simplistic—as soon as the upstream PR is merged, the downstream is unblocked. That suffices for PRs within a repository, but when using Maven dependencies across repositories what we actually want is for the upstream PR to be released and for the downstream PR to encode that release version in a dependency. Typically I have encoded this by leaving the downstream PRs in draft status and keeping a TODO comment visible in the diff noting the upstream PR, which works but is clumsy.

[Herve Le Meur]

Daniel Beck, Wadeck Follonier, do you think it could be possible for the security team to do a security review of this app?