search

bazeltools / bazel-deps

Generate bazel dependencies for maven artifacts
MIT License
249 stars 121 forks source link

Add command to generate a pom.xml to support Dependabot #307

Closed leanne-stripe closed 2 years ago

leanne-stripe commented 2 years ago

Apologies for the previously closed PR. First open source PR here 😄 . I thought I was opening a PR in my forked repo and wasn't ready for reviews yet. But, thanks for the quick suggestion!

The reason for this PR is to allow for Dependabot scanning on JVM repositories that use Bazel. Dependabot is used to scan repositories for vulnerable dependencies. However, the tool only checks dependencies listed in pom.xml files. I have leveraged the existing custom Decoders to parse the dependencies.yaml file and added new methods to the DepModel to return dependencies in xml format.

Example:

bazel run //:parse -- generate-pom -d "$(pwd)"/dependencies.yaml -p "$(pwd)"/pom.xml --group-id com.mycompany.app --artifact-id my-app --version 1
johnynek commented 2 years ago

closed in favor of #308