dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.74k stars 1.03k forks source link

project discovery reports its own imported and additional files #10994

Closed brettfo closed 6 days ago

brettfo commented 1 week ago

Project dependency discovery already tracked its own ImportedFiles property, but that was suppressed during serialization and lifted to the workspace discovery result.

This PR is the first step in a larger refactoring. The ImportedFiles property is removed from the workspace discovery and instead reported on the project discovery. The data was already there, we're just writing it now.

Also report a new field AdditionalFiles on project discovery. This contains files not directly evaluated by MSBuild, but still used in the package update process, e.g., packages.config, app.config, web.config, and packages.lock.json. Currently these files aren't used anywhere, but they will be soon.

The tests were updated to always require the ImportedFiles and AddtionalFiles properties just so we don't accidentally avoid testing something.