asdf-vm / asdf-vm/asdf

Dependabot support

Open
#1,193 4 comments 9 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
25.6k
Forks
941
Avg merge
9h 24m
Merged PRs (30d)
3

Description

### Is your feature request related to a problem? Please describe

I want to automate keeping my .tool-versions at the newest releases.

### Describe the proposed solution

A new package-ecosystem for dependabot. This would be in https://github.com/dependabot/dependabot-core , not this repo.

Dependabot's [`CONTRIBUTING.md`](https://github.com/dependabot/dependabot-core/blob/main/CONTRIBUTING.md) says
> We are not currently accepting new ecosystems into dependabot-core. We want to focus more of our resources on merging improvements to the ecosystems we already support.
> If you are an ecosystem maintainer and are interested in integrating with Dependabot, and are willing to help provide the expertise necessary to build and support it, please open an issue and let us know.
> We hope to be able to accept community contributions for ecosystem support again soon.

So this would require a significant amount of effort to coordinate with dependabot, and a commitment of maintenance effort for the future. And that would have to come from the asdf team, rather than a community contribution. It may not be possible or worthwhile for the asdf team right now.

### Describe similar `asdf` features and why they are not sufficient

The status quo is manually updating .tool-versions when I happen to hear about new releases.

### Describe other workarounds you've considered

* A GitHub actions cron job to run and parse `asdf list all ${plugin}` and compare it to `.tool-versions`. for each of the plugins a repository uses. But this is a lot of work and duplication and will not be as good as real dependabot.
* > In dependabot-core, each ecosystem implementation is in its own gem so you can use Dependabot for a language we have not merged by creating a [script](https://github.com/dependabot/dependabot-script) to run your own gem or fork of core, e.g. [dependabot-lein-runner](https://github.com/CGA1123/dependabot-lein-runner) ([dependabot-core/CONTRIBUTING.md](https://github.com/dependabot/dependabot-core/blob/main/CONTRIBUTING.md#whats-next))

Contributor guide

Open the contributing guide

Research direction

Start by reading Dependabot's CONTRIBUTING.md and the dependabot-core references linked in the issue; the requested package ecosystem would be implemented there, not in this repository. Done would require Dependabot accepting the ecosystem and the asdf team committing to its long-term maintenance, which this issue does not establish.

Written by the indexing model from the issue text.

Assessment

Tech stack
github
Domain
cli, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.