makeshift / generate-dependabot-glob-action

Generates a `dependabot.yml` and PRs it against your repo if it needs updating to include a new directory or package-ecosystem, with globs/wildcards

Hi!

I'm Connor and I'm a Devops engineer specialising in Docker, AWS and Node.JS. I also go by Makeshift, because mashing things together to work in ways they were never intended is my thing.

Feel free to explore the endless list of unfinished projects on my GitHub. You'll find projects to do with work, gaming, stuff for friends, and a bunch of other random one-off things. Some of them might even be useful!

---

generate-dependabot-glob-action's Issues

Looking for maintainers?

Hello 👋

It looks like this excellent action could use a little love, even just the basics like approving dependabot updates. I use this pretty frequently and would like to see it just kept up-to-date, even if we don't have much time to get to new features. Are you interested in a helping hand?

Any way to ignore a directory?

First off thanks for this workflow. Really appreciate it. I have a folder structure that looks similar to:

➜ ls
README.md modules   test1     test2     test3

is there any way to transform this so i can ignore the modules directory entirely?:

- package-ecosystem: 'terraform'
  directory: '*/\.terraform.lock.hcl'
  commit-message:
    prefix: 'terraform'
  schedule:
    interval: 'weekly'

I have tried following a pattern as given in the glob docs

// all js files, but don't look in node_modules
const jsfiles = await glob('**/*.js', { ignore: 'node_modules/**' })

However I get errors on the run:

YAMLException: bad indentation of a mapping entry (11:51)


 11 |  ... erraform.lock.hcl, { ignore: 'modules/**' }'
-----------------------------------------^
 12 |  ... 
 13 |  ... rm'
    at generateError (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:6344:10)
    at throwError (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:6348:9)
    at readBlockMapping (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7343:7)
    at composeNode (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7602:12)
    at readBlockSequence (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7169:5)
    at composeNode (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7633:45)
    at readBlockMapping (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7325:11)
    at composeNode (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7602:12)
    at readDocument (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7786:3)
    at loadDocuments (/runner/_work/_actions/Makeshift/generate-dependabot-glob-action/master/dist/index.js:7849:5) {
  reason: 'bad indentation of a mapping entry',
  mark: {
    name: null,
    buffer: 'version: 2\n' +
      '\n' +
      'updates:\n' +
      "- package-ecosystem: 'github-actions'\n" +
      '  # No globs\n' +
      "  directory: '/'\n" +
      '  schedule:\n' +
      "    interval: 'daily'\n" +
      '\n' +
      "- package-ecosystem: 'terraform'\n" +
      "  directory: '**/\\.terraform.lock.hcl, { ignore: 'modules/**' }'\n" +
      '  commit-message:\n' +
      "    prefix: 'terraform'\n" +
      '  schedule:\n' +
      "    interval: 'weekly'\n",
    position: 207,
    line: 10,
    column: 50,
    snippet: "  8 |  ... '\n" +
      '  9 |  ... \n' +
      " 10 |  ...  'terraform'\n" +
      " 11 |  ... erraform.lock.hcl, { ignore: 'modules/**' }'\n" +
      '-----------------------------------------^\n' +
      ' 12 |  ... \n' +
      " 13 |  ... rm'"
  }
}
Error: bad indentation of a mapping entry (11:51)

Any thoughts on if what I'm trying to do is possible?

Inject comment in generated file

A lot of my org is aware of Dependabot, and it's easily "googleable". Dependabot file generation is not yet. It would be really useful to me to allow the generator to inject a (customizable?) header on the generated file that indicates, Do not modify this file directly; modify dependabot.template.yaml. The motivation is that further generations of SRE / DevOps / Engineers / etc. can avoid the mistake of changing the generated file directly, and losing those changes when this action runs at a later time.

I could put such a message in the template file directly, but it feels awkward to put a message there that says "don't change this file, change (the same) file".

In practice, the common case would be that when the generate-dependable-glob-action GHA workflow creates a PR, and that PR shows overwritten changes, but it feels like that could be an avoidable frustration for whomever is managing the PR.