Open MaximilianWenzel opened 1 month ago
MaximilianWenzel
commented
1 month ago I created a separate repository with a pom.xml file in the root directory in order to try to reproduce the error, but the dependabot security updates apparently work (link):
MaximilianWenzel
commented
1 month ago I compared the job configuration of
neo2rdf repositoryneo2rdf repositorypom.xml file in root directoryThis is probably the relevant difference:
Excerpt of security update job config (job not successful, autoconfigured by GitHub)
"source": {
"provider": "github",
"repo": "derivo-company/neo2rdf",
"branch": null,
"api-endpoint": "https://api.github.com/",
"hostname": "github.com",
"directories": [
"/home/runner/work/neo2rdf/neo2rdf"
]
}Excerpt of version update job (job successful, manually configured in .github/dependabot.yml)
"source": {
"provider": "github",
"repo": "derivo-company/neo2rdf",
"branch": null,
"directory": "/.",
"api-endpoint": "https://api.github.com/",
"hostname": "github.com"
}Security update of minimum working Java Maven project repository (job successful, autoconfigured by GitHub)
"source": {
"provider": "github",
"repo": "MaximilianWenzel/java-security-update-root",
"branch": null,
"api-endpoint": "https://api.github.com/",
"hostname": "github.com",
"directories": [
"/"
]
}Apparently, somehow the auto configuration in the "neo2rdf" repository went wrong.
kessiler
commented
1 month ago I'm encountering the same issue in one of my repositories. It seems like the root directory isn't being properly set up, but I haven't been able to find a way to fix it.
MaximilianWenzel
commented
1 month ago Thanks! It already helps to know that others encounter this issue as well sometimes.
Is there an existing issue for this?
Package ecosystem
maven
Package manager version
No response
Language version
Java 17
Manifest location and content before the Dependabot update
repository root, i.e., "/pom.xml"
dependabot.yml content
https://github.com/derivo-company/neo2rdf/blob/fc6c77386d11f49a1042adadba9e5c72915a3a0f/.github/dependabot.yml
Updated dependency
No response
What you expected to see, versus what you actually saw
First, I need to say that the "Dependabot version updates" work without any issues on my repository - really helpful. I now activated the "Dependabot security updates" for the repository and encounter errors. I hope this is the right place to post this because it is probably rather an issue of the default configuration on the platform GitHub and not an issue of the underlying dependabot code. Apparently, it searches in
/home/runner/work/neo2rdf/neo2rdffor thepom.xmlfile. I suppose, this is the path of the action runner. The link in the text next to the green "open" button of the provided screenshot should probably point to the actual repository file, which it does not. I did not found a way to configure the "Dependabot security updates" separately from "Dependabot version updates".Probably it is connected to the fact that the
pom.xmlis in the repository root directory because I tried it in another project where it is in a subedirectory and there it works perfectly fine (repository link).Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
Repository: https://github.com/derivo-company/neo2rdf Action run: https://github.com/derivo-company/neo2rdf/actions/runs/11056534431/job/30718297282
Smallest manifest that reproduces the issue
No response