search

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.63k stars 992 forks source link

Update badges to be compatible with the new native GitHub Dependabot #1912

Open CasperWA opened 4 years ago

CasperWA commented 4 years ago

The otherwise excellent badge (or shield) is currently "failing", writing inactive when moving to the new native GitHub Dependabot system. This sends the wrong message, hence it should be updated to the new system as well.

EDIT by @jeffwidman: Whenever we re-implement this, we should also look at making it easy to create these badges as described in https://github.com/dependabot/dependabot-core/issues/2070.

feelepxyz commented 4 years ago

@CasperWA thanks for reporting this! Adding to our backlog.

staticdev commented 4 years ago

@feelepxyz do you have a timeframe for a fix?

genebean commented 4 years ago

I just started migrating repos over to the version of dependabot and ran into this too...

barrelful commented 4 years ago

@feelepxyz any updates?

paolocattani commented 3 years ago

@feelepxyz any updates?

staticdev commented 3 years ago

@feelepxyz maybe a good idea to prioritise this in the backlog? As you can see, many projects are dropping dependabot badge which is a great marketing for your work.

domdfcoding commented 3 years ago

Friendly ping 👈

mgagliardo91 commented 3 years ago

any updates on this?

staticdev commented 3 years ago

@mgagliardo91 I consider this abandoned.

domdfcoding commented 3 years ago

This is of greater importance now that there is a date set for Dependabot Preview to shut down.

fharper commented 3 years ago

It's not shutdown, you cannot install it anymore. Any news on the badge now? :)

mwaddell commented 2 years ago

We really need the ability to show a dependabot badge in the README of our private repos because there is otherwise no way to know if Dependabot has been failing or not. If dependabot fails to run (i.e. it lost access to a private repo), it doesn't send any emails or notifications, it just suddenly stops creating new PRs which gives the organization a false sense of security that "everything is fine". I can see why you don't want dependabot sending out warning emails on every check-in that it fails to complete (i.e. you set a limit to the max number of PRs or you've manually edited a PR, etc), but it also seems like a HUGE failure that dependabot can just silently fail for days/weeks and never notify anyone. I don't even get any indication in the daily/weekly summary emails that it's been silently failing because those only summarize active alerts/PRs.

mwaddell commented 2 years ago

Maybe this could be finally addressed using a custom workflow (see task #4680)?

agneszitte commented 2 years ago

@feelepxyz any updates for this issue please ?

gagansuie commented 2 years ago

@feelepxyz its been many moons. any updates on this?

jeffwidman commented 2 years ago

Let me look into this one and get back to you. We need to make a decision either way on what the plan is, whether to support these going forward or not. I'd personally like to support them, but that would require some engineering work + ongoing maintenance of it, so no promises that we'll be able to do that. And might take me a little time to connect with everyone to figure out a decision. But we need to make a decision so we don't keep you all hanging.

jeffwidman commented 1 year ago

I haven't circled back on this because there's been some internal debate on this.

At this point, the general consensus seems to be that we will support these at some point, but that it's not the highest priority so may take a bit longer to get to it.

SamuelMarks commented 8 months ago

Any updates to this feature request?