dependabot.yml
danielbayley opened this issue · comments
Why the requirement of a .dependabot/ subfolder? Why not also have the option of [.]dependabot.y[a]ml at the project root?
@danielbayley 👋 we're working on a GitHub integrated version and moving the config file to: .github/dependabot.yml
@feelepxyz So does that file work as of now? Also, it still forces a .github/ subfolder…
@feelepxyz So does that file work as of now? Also, it still forces a
.github/subfolder…
Not released yet. Yeah, still a subfolder but already used for a bunch of GitHub specific config, e.g. Actions, so makes sense to keep it all there.
tbh I would just store it where github normally stores the actions, but for projects like mine using the preview it would be nice for dependabot to pull request and merge it in ignoring any CI in this case.
(That is for the repositories that currently use dependabot-preview)
btw any Docs yet on the dependabot.yml?
Does it also allow bundling of all updates to single pr too as well as defining an update chain to check for like what I suggested in #930?
Does it also allow bundling of all updates to single pr too as well as defining an update chain to check for like what I suggested in #930?
Don't yet support bundling, it's on a roadmap but will be few months before until we've completed rolling out the new version.
Oh ok cool, Btw is it possible to also make it where we cal tell dependabot a certain order of repositories where after it checks and merges all of 1, then after a while check higher up in a repository chain (in case updating the base repository triggers a new package deployment) that way everything is truely up-to-date?
Oh ok cool, Btw is it possible to also make it where we cal tell dependabot a certain order of repositories where after it checks and merges all of 1, then after a while check higher up in a repository chain (in case updating the base repository triggers a new package deployment) that way everything is truely up-to-date?
Ah not yet, we're considering bringing back support for live schedules which might be what you're after?
ah that might be it.
Going to close this out as we've now moved the config to .github/dependabot.yml and published docs here: https://help.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates
Ah now I know why it seems why it checks for updates once a day, because it does. Perhaps in the future there would be an valid option for those developers who wants to have it updated more frequently than that (like the .net core framework / runtime projects for example).