-
Notifications
You must be signed in to change notification settings - Fork 969
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Search for Dockerfiles recursively #1015
Comments
Not at the moment. Because Dependabot never clones your repo it's not easy for us to do this without hitting GitHub a lot of times. We're looking into changing that (the git tree API might give us what we need), and serving a list of possible projects for a given repository, but it's a way off for now. |
(Although if you're using dependabot-core with a script, rather than dependabot.com, hopefully there's nothing stopping you implementing this on your side?) |
Yeah, we will most likely implement that search within our probot app then. just wanted to make sure i don't miss a feature thats already there |
Cool, makes sense! I imagine we will add this, and the logic for it will live in this repo (rather than in the app backend) in the next 3 months or so, but wouldn't want to keep you waiting! |
Hello! |
Agreed, re-opening as recursive file search is relevant to the K8s files as well: I realize this issue originally encompassed all ecosystems, but since we have similar requests for other ecosystems and the implementation may vary (or may be shared, not sure until we actually build it), I re-scoped this to only Dockerfiles since that's what the OP is actually affected by. |
What I'm confused by, is that Dependabot security updates seem to happen on all dependency files in a repository, but version updates only check the top-level dependency files. Why would they have different capabilities? (Note to self: This is needed for aiohttp_demos). |
@Dreamsorcerer Exactly. I get it few folks might require the dependabot version updates to be running only in specific places in the repository, but when the requirement increases it is a hassle to configure everything. |
What I meant is that I'm genuinely confused. Discussion is suggesting that there's a significant piece of work to add this feature (not just a config flag), but the security updates seem to already do it. Are they 2 separate projects without common code or something? |
Sorry for the confusion here.
|
Until recursiveness is supported, is there a way to specify a list of dirs instead of having to create an entire "update" block for each dir? |
Hi, any progress ? |
Unfortunately that's correct, you currently have to specify each entry separately. Also, since i last commented, i realized this one is a little more complicated because some users will want recursive search, some will want only search the root directory, etc... so I think we need to be explicit about The So I'm going to close this as a duplicate. |
@duglin Several workarounds are listed in the comments of this ticket for programmatically generating the list of dirs to specify in |
Apparently recursively finding Dockerfile is not working: dependabot/dependabot-core#1015 Not sure why it stopped working Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>
Hey,
I'm aware that there is a directory setting that could be configured. But we have many repos where we have (in this case Dockerfiles) in several sub directories. Adding them all manually is quite error prone.
Is there a setting that i could use to search recursively through the repo for files matching and check all of these?
The text was updated successfully, but these errors were encountered: