search

dependabot / dependabot-core

🀖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.61k stars 981 forks source link

Support sbt projects #352

Open albuch opened 6 years ago

albuch commented 6 years ago

Hey, it would be awesome to support sbt dependencies and plugin dependencies as well.

https://www.scala-sbt.org/1.x/docs/Library-Dependencies.html https://www.scala-sbt.org/1.x/docs/Using-Plugins.html

Multi-projects are supported in sbt as well and is a common use case so that should be considered as well: https://www.scala-sbt.org/1.x/docs/Multi-Project.html

greysteil commented 6 years ago

Totally up for this. I've got some work to do getting Maven support out of beta first, but once that's done sbt support would be a great addition.

tyrcho commented 5 years ago

My company is working with scala, once support for Gitlab and sbt is there I'd be happy to become a paying customer of dependabot.

greysteil commented 5 years ago

Thanks @tyrcho. I'm still really keen on adding both - will keep you posted.

tyrcho commented 5 years ago

I ran into this sbt plugin which should help a lot ! https://github.com/rtimush/sbt-updates

You can append addSbtPlugin("com.timushev.sbt" % "sbt-updates" % "0.3.4") to the end of project/plugins.sbt (creating it if not present) and then run sbt dependencyUpdates and parse the output in stdout. It looks like that:

[info] Found 10 dependency updates for notification-impl
[info]   com.datadoghq:dd-java-agent:dd-java-agent            : 0.10.0           -> 0.16.0
[info]   com.lightbend.lagom:lagom-logback                    : 1.4.6  -> 1.4.8           
[info]   com.lightbend.lagom:lagom-reloadable-server:dev-mode : 1.4.6  -> 1.4.8           
[info]   com.lightbend.lagom:lagom-scaladsl-dev-mode          : 1.4.6  -> 1.4.8           
[info]   com.lightbend.lagom:lagom-scaladsl-server            : 1.4.6  -> 1.4.8

Note that in multi-project build you will have duplicated lines.

Even partial support for sbt in dependabot would be great (ie creating the PR to notify the library has been updated). It will probably be impossible to cover all ways in which versions are defined in sbt since you can code in your build files.

ghost commented 5 years ago

A project by @fthomas already does this. Hope you could maybe setup some sort of collaboration !

https://github.com/fthomas/scala-steward

ghost commented 4 years ago

We are already using dependabot for python and ruby, but the biggest part of our codebase is scala. Are there any updates on scala/sbt-support?

greysteil commented 4 years ago

Not yet. We'd still love to add sbt support, but we're a small team and are currently focussed on scaling Dependabot so it can create automated security fixes for all GitHub repos.

ewolfe commented 4 years ago

I was linked here from https://dependabot.com/java/ - I would like to help beta test Java Maven support

Grundlefleck commented 4 years ago

The PR I raised as a starting point for sbt support (#1589) was closed without comment due to staleness. Not sure whether to interpret as a bad PR that I can improve, or lack of team capacity, or something else. I'm still willing to continue on the functionality, but would prefer to see some indication of whether I'm likely to see it ever getting merged before spending more time on it.

hmarr commented 4 years ago

@Grundlefleck sorry about that - I've reopened the pull request and added the "enhancement" label, which should prevent stalebot rudely closing it again.

Right now the Dependabot team is working pretty flat out on some scaling challenges and bringing more of Dependabot's features to GitHub natively, which means we've (regrettably) been neglecting dependabot-core a bit. I can't promise a timeline, but I'm hopeful we'll be able to spend more time on dependabot-core soon. When we can give it some proper attention, your SBT pull request will be top of the list.

albuch commented 4 years ago

There is another alternative that supports scala/sbt (among many others) in a rudimentary version: https://github.com/apps/renovate See https://docs.renovatebot.com/modules/manager/sbt/ for docs.

ihostage commented 4 years ago

@albuch Renovate has a constraint for sbt projects. 😞 As @mark-dhl said, Scala Steward is a really best choice for Scala/Sbt.

coding-bunny commented 3 years ago

Anything I can do to make our Scala project rely on dependabot? We have a multi-tier project that combines 4 projects into a one repo with multiple SBT build files.

youholemy commented 3 years ago

![Uploading 5-720p.jpg
]()

dciborow commented 3 years ago

This thread makes me feel like dependabot is prebeta test for SBT.... image

francisdb commented 3 years ago

@dciborow got a link for that?

fernandomora commented 3 years ago

@francisdb It is said here: https://dependabot.com/java/ with a link to this issue to a betatester

I would like to test it if possible

jucke commented 3 years ago

Me, too! 🙋‍♀

rtsisyk commented 3 years ago

+

JonDegn commented 3 years ago

I would like to be a beta tester for sbt support

drochow commented 3 years ago

Hey, a whole org with ~100 scala repos here that would be happy to beta test sbt support :)

florianmutter commented 3 years ago

We did end up setting up scala steward as a github action running every night. This can be done without the need to deploy anything manually. See https://github.com/scala-steward-org/scala-steward-action

jongyu commented 2 years ago

How to join Java's Maven test

MPV commented 2 years ago

Looking at the GitHub roadmap for issues related to Dependabot, it doesn't look too bright: https://github.com/github/roadmap/projects/1?card_filter_query=dependabot

There used to be "Ecosystem updates" in Q1 and Q2 2021, but I don't see anything for Q3/Q4 or 2022.

At least, this issue is top-7 at the moment in terms of 👍 votes: https://github.com/dependabot/dependabot-core/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

In summary: 🀞

abdulapopoola commented 1 year ago

This isn't on our near-term roadmap, but we'd happily accept a PR if anyone in the community wants to take a stab at it.

dorranh commented 8 months ago

@abdulapopoola, I noticed this note in the contributors guide regarding adding support for new ecosystems. Could you confirm whether there would be interest in adding support for sbt specifically? If so I would be interesting in tackling this :slightly_smiling_face:

abdulapopoola commented 7 months ago

Hi @dorranh ; yeah; this is something we would be willing to explore in collaboration and we'd love it if you can help get this started.

dorranh commented 5 months ago

Hi @abdulapopoola! I just wanted to follow up and let you / everyone know that this is still on my radar. I just haven't had the bandwidth to work on this the past few months. I still aim to take a stab at it in the near future though 🙂.

turb commented 5 months ago

FYI, we currently achieve the alerting part with https://github.com/scalacenter/sbt-dependency-submission