2 ms·
I am not disagreeing with you but by your own admission it does not read your code; only the project's manifest. THEN why on Earth do they ask for so much more
by rany_ 3y ago
I am not disagreeing with you but by your own admission it does not read your code; only the project's manifest. THEN why on Earth do they ask for so much more when all they need to do is bump some dependency version in the manifest.
As for this aggregate stats, why not limit the scope to access to the build status instead? They don't need anything more to provide this service...
- ysavir 3y agoI doubt there's any legal way to say "we'll only read your manifests". Programmers may know what that means (and still debate it, honestly), but I'm skeptical the law has the ability to distinguish between the designated utilities of specific files.
- Shrezzing 3y agoAs far as I can see from all of their documentation, they exclusively open a predefined list of common manifest files. They explicitly mention that they won't be able to do dependabot analysis if your deps are listed in a `setup.py` file for example. You'd need readonly access to the entire repository to actually find those manifest files though, as most of the time they're not going to be in the top-level directory. For companies & people not willing or able to surrender that level of access, it's still possible to use the dependabot API, dissociated from any github repository (for example if you have an Atlassian git repository). You just send it a list of dependencies and an enum indicating its current build status, and they'll reply with a list of suggestions.