dependabot / dependabot/dependabot-core

Ignores not being applied for Gradle

Open
#6,532 5 comments 0 reactions 0 assignees View on GitHub
F: dependency-ignores L: java:gradle T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

gradle

### Package manager version

Gradle 7.6

### Language version

Java 17

### Manifest location and content before the Dependabot update

Reposistory at relevant commit: https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/

I have a few separate independent projects inside a single repo: plugin, internal plugin, demo for AGP 7 and java demo.

Repository: https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/

* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/settings.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/internal/settings.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//demo/java/settings.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//demo/android/agp7/settings.gradle.kts

plugin contains a few modules, depending on libraries with conflicting API by design, and it working well:

* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//plugin-gradle/compat/agp34/build.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//plugin-gradle/compat/agp7/build.gradle.kts

### dependabot.yml content

```yaml
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

version: 2
updates:
- package-ecosystem: gradle
directory: "plugin-gradle/compat/agp7"
schedule:
interval: "daily"
ignore:
- dependency-name: com.android.tools.build:gradle
update-types: [ "version-update:semver-major" ]
- package-ecosystem: gradle
directory: "/plugin-gradle/compat/agp34"
schedule:
interval: "daily"
ignore:
- dependency-name: com.android.tools.build:gradle
update-types: [ "version-update:semver-major" ]
- package-ecosystem: gradle
directory: "demo/java"
schedule:
interval: "daily"
- package-ecosystem: gradle
directory: "demo/android/agp7"
schedule:
interval: "daily"
ignore:
- dependency-name: com.android.tools.build:gradle
update-types: [ "version-update:semver-major" ]
- package-ecosystem: "github-actions"
directory: ""
schedule:
interval: "daily"
- package-ecosystem: gradle
directory: ""
schedule:
interval: "daily"
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

1) Despite on rules created to skip major updates for certain modules, dependabot stubbornly updates the PR for it. example: https://github.com/jsonschema2dataclass/js2d-gradle/pull/620 and there's serveral such PR
2) Despite I remove `includeBuild` from the `settings.build.kts` for a subproject, it still has an attachment to the root project which is incorrect as well
3) Changes in `settings.gradle.kts` are ignored while this file defines a gradle project, not `build.gradle.kts`

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

https://github.com/jsonschema2dataclass/js2d-gradle/pull/620
and few recently closed from dependabot. I ususally merge, not close as in most cases it makes more sence

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reading the referenced dependabot.yml and the listed settings.gradle.kts files, then compare the behavior with Dependabot PR #620. Trace how the Gradle manifests and ignore rules are recognized; done means the affected modules honor the configured major-update ignores and settings changes no longer produce incorrect root-project attachments.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kotlin, yaml
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.