dependabot / dependabot/dependabot-core

Trigger update jobs via API

Open
#2,201 19 comments 29 reactions 0 assignees View on GitHub
E: api-support service 💁 T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 14h
Merged PRs (30d)
156

Description

My desire is to have something I can add to a CI build script that tells dependabot a release has occurred in that repo. This would then cause dependabot to examine the repo, and raise PRs immediately on all the dependent projects in my organization. Effectively an API version of the "Bump now" button. Note that the trigger can't be a commit or tag on GitHub, because the release happens on CI after the commit/tag, so I don't think dependabot/feedback#301 applies.

When I first saw the API had `/release_notifications/private`, I thought that was the perfect solution and gave it a try, but it did nothing. I then noticed the reference to "live":

> Notifes Dependabot of a private dependency release. In response, Dependabot will check all of the repos that belong to an organisation your access token has access to. If any use an outdated version of the dependency and have their update schedule set to live Dependabot will create update PRs for them.

Of course Maven does not support "live" today, so I assume that is why calling the API had no effect.

Moreover, its unclear why the API needs to know the version number, as dependabot can already parse that. All I want it to tell dependabot to bump the repo now via the API.

(The API docs are also unclear as to the meaning of "name". I'm assuming it is the repo name, as it wouldn't be much use to have to call the API once for every project in a Maven multi-module build).

I think I just want a "bump now" API endpoint specifying repo and package manager, but perhaps I'm missing something?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.