dependabot / dependabot/dependabot-core
Differentiate between public and private registries
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 151
Description
Is there an existing issue for this?
- I have searched the existing issues
Feature description
I want to differentiate between package updates that comes from the public registry and my own private registry.
I found not a single way to do this. Except whitelisting every package name.
I have configured a private nuget feed. The dependabot searches everytime in my private and in the public feed. There is no option available to configure this. Even the dependabot metadata fetch action does not provide information about the source of the package.
I would like to create different tags and commit messages for different sources of packages.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how private NuGet feeds are handled during dependency lookup and how the Dependabot metadata fetch action represents package sources. Define the required source information and its effect on tags and commit messages before identifying the relevant implementation and tests.
Written by the indexing model from the issue text.
Assessment
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100