dependabot / dependabot/dependabot-core
Support non-standard Gradle library catalog locations
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Hello!
The current documentation states that Dependabot will look at one and only one specific file when trying to update TOML-based library catalogs:
https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#gradle
Specifically, it'll look at `gradle/libs.versions.toml`.
We put our dependency catalog file in a separate repository and share it between multiple repositories using a `git submodule`. We realistically can't put the catalog file where Dependabot expects to find it.
Any chance you could add a file parameter so that we could specify a custom location for our catalog file?
Contributor guide
Research direction
Start with the Gradle configuration documentation linked in the issue and the current handling of gradle/libs.versions.toml. Trace how Dependabot discovers TOML-based library catalogs and how dependabot.yml options are parsed. Done means a repository can specify a non-standard catalog location, including the submodule arrangement described here, with documentation and coverage for the new option.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100