dependabot / dependabot/dependabot-core
Ignores not being applied for Gradle
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
gradle
### Package manager version
Gradle 7.6
### Language version
Java 17
### Manifest location and content before the Dependabot update
Reposistory at relevant commit: https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/
I have a few separate independent projects inside a single repo: plugin, internal plugin, demo for AGP 7 and java demo.
Repository: https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/settings.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1/internal/settings.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//demo/java/settings.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//demo/android/agp7/settings.gradle.kts
plugin contains a few modules, depending on libraries with conflicting API by design, and it working well:
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//plugin-gradle/compat/agp34/build.gradle.kts
* https://github.com/jsonschema2dataclass/js2d-gradle/blob/69cf5b5c1b3290301508e98d581f70764771a3f1//plugin-gradle/compat/agp7/build.gradle.kts
### dependabot.yml content
```yaml
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
version: 2
updates:
- package-ecosystem: gradle
directory: "plugin-gradle/compat/agp7"
schedule:
interval: "daily"
ignore:
- dependency-name: com.android.tools.build:gradle
update-types: [ "version-update:semver-major" ]
- package-ecosystem: gradle
directory: "/plugin-gradle/compat/agp34"
schedule:
interval: "daily"
ignore:
- dependency-name: com.android.tools.build:gradle
update-types: [ "version-update:semver-major" ]
- package-ecosystem: gradle
directory: "demo/java"
schedule:
interval: "daily"
- package-ecosystem: gradle
directory: "demo/android/agp7"
schedule:
interval: "daily"
ignore:
- dependency-name: com.android.tools.build:gradle
update-types: [ "version-update:semver-major" ]
- package-ecosystem: "github-actions"
directory: ""
schedule:
interval: "daily"
- package-ecosystem: gradle
directory: ""
schedule:
interval: "daily"
```
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
1) Despite on rules created to skip major updates for certain modules, dependabot stubbornly updates the PR for it. example: https://github.com/jsonschema2dataclass/js2d-gradle/pull/620 and there's serveral such PR
2) Despite I remove `includeBuild` from the `settings.build.kts` for a subproject, it still has an attachment to the root project which is incorrect as well
3) Changes in `settings.gradle.kts` are ignored while this file defines a gradle project, not `build.gradle.kts`
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
https://github.com/jsonschema2dataclass/js2d-gradle/pull/620
and few recently closed from dependabot. I ususally merge, not close as in most cases it makes more sence
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start by reading the referenced dependabot.yml and the listed settings.gradle.kts files, then compare the behavior with Dependabot PR #620. Trace how the Gradle manifests and ignore rules are recognized; done means the affected modules honor the configured major-update ignores and settings changes no longer produce incorrect root-project attachments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kotlin, yaml
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100