dependabot / dependabot/dependabot-core
Add possibility to skip automatically consider included builds for Gradle
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
As far as I can see [here](https://github.com/dependabot/dependabot-core/commit/0cdebde199ca930a2367747fead799a76e38b5a6) it is intended behaviour that the Gradle scanner automatically considers all included builds for a project.
Having a mono-repo like setup, where multiple projects include same projects as included builds (e.g. for convention plugins) it is quite unpleasant that dependabot then scans the same included build for _all_ projects that include that build and therefore will open duplicates for every dependency update in the shared build.
Pointing to https://github.com/dependabot/dependabot-core/issues/4364 when (or if) this gets implemented one might be able to explicitly ignore the specific files, but I think it would be better to have an option like `ignore_included_builds` or something like that for the Gradle package-ecosystem so you can just turn that feature off.
Contributor guide
Research direction
Start by reviewing the linked commit and the Gradle scanner behavior that causes included builds to be considered. The issue is done when the Gradle package-ecosystem can opt out of included-build scanning and shared dependency updates no longer produce duplicate pull requests across projects.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100