4 ms·
As far as I can see from all of their documentation, they exclusively open a predefined list of common manifest files. They explicitly mention that they won't b
by Shrezzing 3y ago
As far as I can see from all of their documentation, they exclusively open a predefined list of common manifest files. They explicitly mention that they won't be able to do dependabot analysis if your deps are listed in a `setup.py` file for example. You'd need readonly access to the entire repository to actually find those manifest files though, as most of the time they're not going to be in the top-level directory.
For companies & people not willing or able to surrender that level of access, it's still possible to use the dependabot API, dissociated from any github repository (for example if you have an Atlassian git repository). You just send it a list of dependencies and an enum indicating its current build status, and they'll reply with a list of suggestions.