4 ms·
> This plus the fact that Dependabot is not able to update Docker Compose files at this time. https://github.com/dependabot/dependabot-core/issues/390 https://
by asciimike 4y ago
> This plus the fact that Dependabot is not able to update Docker Compose files at this time.
https://github.com/dependabot/dependabot-core/issues/390 https://github.com/dependabot/dependabot-core/issues/390 upvote and/or implement it as a fork and run it in an Action.
> The other problem that I have is there is no easy way (probably for good reason due to potential abuse) to manually trigger Dependabot. So Dependabot might run once a day or not do so for quite a while.
There is, it's just hidden in https://github.com/:org/:repo/network/updates https://github.com/:org/:repo/network/updates > click "last updated ..." and then click "Check for Updates" and it'll start a manual run.
- janejeon 4y agoBoth are just such a horrible DX/hacky solutions that you have to go out of your way to implement/do... dependabot is filled with stuff like this, of stuff that should be simple but simply isn't (or isn't implemented at all, so you need to hack it to do so). Both are simply non-solutions when you can simply just drop in a renovatebot, have a config telling it exactly what to do, and it "just works".
- asciimike 4y agoTotally agree on all points, I'm just letting folks know the recommended solution if they choose to use Dependabot. As a side note, automerge is... complicated. I've always felt that having it means that people will be mad when it does something bad (e.g. automerges the inevetible npm credential theft update), and they'll be mad if it doesn't exist because they're so sick of the unending stream of PRs, so you're kind of damned either way. At this point, I fall on the side of "let people do the unsafe thing so they shut up about not being able to do so" but that's not the side the security team generally falls on. Disclosure: one time PM on Dependabot