github-community-projects / github-community-projects/evergreen

Dependency ecosystems not correctly detected

Open
#29 5 comments 1 reaction 0 assignees View on GitHub
bug keep ready-for-work
Dominant language
Python
Stars
226
Forks
25
Avg merge
2h 16m
Merged PRs (30d)
14

Description

The logic to detect whether to configure package updates for most ecosystems, except for GitHub Actions and Terraform only appears to consider files in the root of the repository.

I found this after testing the action out on a .NET repository where the `.csproj` files are in subdirectories within the repository. The action generated a `dependabot.yml` file that only specified GitHub Actions updates.

Each file tested for should recurse through the repository to try and files (maybe within a configurable depth limit to reduce impact on rate limits) so that the generated file is a more accurate reflection of what should be configured.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.