dependabot / dependabot/dependabot-core
Support get changelog from Self-Managed Gitlab
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Under the npm ecosystem, there are some private dependencies configured `repository` filed on `package.json`
```json
{
"name": "@private/package",
"version": "14.5.0",
"repository": {
"type": "git",
"url": "https://self-managed-gitlab-URL.com/group-name/repo-name.git",
}
}
```
https://github.com/dependabot/dependabot-core/blob/63977df77903e646c52f88eef803b29c4f805fd2/npm_and_yarn/lib/dependabot/npm_and_yarn/metadata_finder.rb#L71-L81
So dependabot can get `url` correctly.
https://github.com/dependabot/dependabot-core/blob/63977df77903e646c52f88eef803b29c4f805fd2/common/lib/dependabot/source.rb#L67-L70
But `self-managed-gitlab-URL` can't be matched
https://github.com/dependabot/dependabot-core/blob/63977df77903e646c52f88eef803b29c4f805fd2/common/lib/dependabot/metadata_finders/base/changelog_finder.rb#L162-L176
As the result, dependabot can't add changelog at pr description

Contributor guide
Research direction
Start with common/lib/dependabot/source.rb and common/lib/dependabot/metadata_finders/base/changelog_finder.rb, then compare how npm_and_yarn/lib/dependabot/npm_and_yarn/metadata_finder.rb obtains the repository URL. Confirm the self-managed GitLab URL is recognized and that the generated update PR description includes the dependency changelog.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab, ruby
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100