search

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.7k stars 1.02k forks source link

how to target multiple composer.json in the same folder #2184

Open tobybellwood opened 5 years ago

tobybellwood commented 5 years ago

Hi - we've got two composer.json files in the same folder (named differently obvs)

I know you can target multiple folders per project, but can you specify individual files to target (given that one of them is called composer-somethingelse.json)?

greysteil commented 5 years ago

Ah, interesting. We can't do that at the moment! I'm going to leave this open as it would be good to support it - can you say a little more about the use case?

tobybellwood commented 5 years ago

sorry - slow on the response there!

the repo is https://github.com/govcms/govcms8

we're using the same repo to act as a normal composer project to push to packagist and drupal.org, but also be consumable with docker-compose, and we create a secondary composer (composer-lagoon.json) to act as a drupal "create-project" repo - it's a bit unorthadox...

greysteil commented 5 years ago

Got you - thanks for the link, will use that as the reference case when I look into implementing.

benoitchantre commented 3 years ago

@greysteil Any progress on this?

Another use case is to have a different configuration / reduced list of packages to speed up some CI jobs.

The desired Composer file can be selected for these jobs using a COMPOSER environment variable.

greysteil commented 3 years ago

None I'm afraid. I don't work on Dependabot directly anymore (I'm a PM now, responsible for all GitHub's security products) so I can't speak for the Dependabot team directly. I do think that this is a use case we'd eventually like to support, I just don't know where it will sit in their priority list.

Is placing the composer.json files in separate folders not an option, or just inconvenient?