dependabot / dependabot/dependabot-core

Add possibility to skip automatically consider included builds for Gradle

Open
#7,972 8 comments 0 reactions 0 assignees View on GitHub
T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

As far as I can see [here](https://github.com/dependabot/dependabot-core/commit/0cdebde199ca930a2367747fead799a76e38b5a6) it is intended behaviour that the Gradle scanner automatically considers all included builds for a project.

Having a mono-repo like setup, where multiple projects include same projects as included builds (e.g. for convention plugins) it is quite unpleasant that dependabot then scans the same included build for _all_ projects that include that build and therefore will open duplicates for every dependency update in the shared build.

Pointing to https://github.com/dependabot/dependabot-core/issues/4364 when (or if) this gets implemented one might be able to explicitly ignore the specific files, but I think it would be better to have an option like `ignore_included_builds` or something like that for the Gradle package-ecosystem so you can just turn that feature off.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the linked commit and the Gradle scanner behavior that causes included builds to be considered. The issue is done when the Gradle package-ecosystem can opt out of included-build scanning and shared dependency updates no longer produce duplicate pull requests across projects.

Written by the indexing model from the issue text.

Assessment

Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.