search

bazeltools / bazel-deps

Generate bazel dependencies for maven artifacts
MIT License
249 stars 121 forks source link

Update Generate command with optional param to create a pom xml file #308

Closed leanne-stripe closed 2 years ago

leanne-stripe commented 2 years ago

The reason for this PR is to allow for Dependabot scanning on JVM repositories that use Bazel. Dependabot is used to scan repositories for vulnerable dependencies. However, the tool only checks dependencies listed in pom.xml files.

An initial design was to add this functionality as its own command. Since the Generate command already parses the dependencies.yaml and resolves versions for transitive dependencies, the Generate command was extended. When a pomFile option is passed to Generate, apom.xml file will be created alongside bazel targets.

Example

bazel run //:parse -- generate -r `pwd` -s 3rdparty/workspace.bzl -d dependencies.yaml --pom-file "$pwd"/pom.xml
leanne-stripe commented 2 years ago

Thank you! ✋