Add support for Azure Pipelines YAML file

[jessehouwing]

Is there an existing issue for this?

• I have searched the existing issues

Feature description

Azure Pipelines YAML files contain references to tasks in the form of:

steps:
  - task: taskidentifier@version

While Azure Pipelines will auto update to the latest minor version of each task, it won't do updates to new major versions and has no signal to the pipeline author to indicate they're behind.

We've already implemented a partial version of this based on the Github-Actions code which is very similar and this turns out to be achievable.

With Dependabot functionality coming to Azure DevOps, this is a must-have addition.

[jessehouwing]

WIP here https://github.com/XpiritBV/dependabot-core

[jessehouwing]

We could potentially look at this as well, since it would be detecting and returning the dependency object:

• Support for bumping docker containers inside azure-pipelines.yml? #2194

[jurre]

Hey, thanks for opening an issue about this! We're currently not accepting new ecosystems natively into Dependabot, there is some background information here. What I would recommend is building the support out as a dedicated gem that builds on top of dependabot-core, then you should be able to run this using a standalone script in your CI provider of choice.

Here's a great example of doing just that: https://github.com/CGA1123/dependabot-lein-runner

[jessehouwing]

With Dependabot coming to Azure DevOps, wouldn't it make sense to actually support its features natively? We'll work on a stand-alone version, but please consider adoprting it. I'm also reaching out to the Azure Pipelines team to see if they can back this project.

[jurre]

If we do decide to support it natively, bringing it in from a standalone gem would be a relatively small lift, so I think that's the best path forward for now, good luck!