Repository files navigation

This repo is a collection of scripts to use as entrypoints to theDependabot Core library. It is intended as a starting point for advanced users to run a self-hosted version of Dependabot within their own projects.

If you're looking for a hassle-free Dependabot experience, check out the hostedDependabot Service.

This is a community-maintained project. As such, the Dependabot team at GitHub will review PR contributions to update this repo, but is unable to provide further support such as debugging why something doesn't work.

rbenv install# (Install Ruby version from ./.ruby-version)bundle install

Languages that require native helpers to be installed: Terraform, Python, Go, Elixir, PHP, JS

To install the native helpers, export an environment variable that points to thedirectory into which the helpers should be installed and add the relevant binsto your PATH:

export DEPENDABOT_NATIVE_HELPERS_PATH="$(pwd)/native-helpers"mkdir -p$DEPENDABOT_NATIVE_HELPERS_PATH/{terraform,python,dep,go_modules,hex,composer,npm_and_yarn}export PATH="$PATH:$DEPENDABOT_NATIVE_HELPERS_PATH/terraform/bin:$DEPENDABOT_NATIVE_HELPERS_PATH/python/bin:$DEPENDABOT_NATIVE_HELPERS_PATH/go_modules/bin:$DEPENDABOT_NATIVE_HELPERS_PATH/dep/bin"export MIX_HOME="$DEPENDABOT_NATIVE_HELPERS_PATH/hex/mix"

Copy the relevant helpers from the gem source to the new install location

Build the helpers you want to use (you'll also need the corresponding language installed)

The update scripts are configured using environment variables. The availablevariables are listed in the table below. (See./generic-update-script.rb for more context.)

There are other variables that you must pass to your container that will depend on the Git source you use:

Github

Github Enterprise

Gitlab

Azure DevOps

Also note that thePROJECT_PATH variable should be in the format:organization/project/_git/package-name.

Bitbucket

* EitherBITBUCKET_ACCESS_TOKEN must be passed, orBITBUCKET_APP_USERNAME andBITBUCKET_APP_PASSWORD.

There are a few ways of running the script:

• interactively with./update-script.rb,
• non-interactively with./generic-update-script.rb,
• and non-interactively using Docker.

You can also set it up to run as part of your repositories workflows

• GitHub Actions Standalone
• GitLab

1. bundle exec irb
2. Edit the variables at the top of the script you're using, or set the correspondingenvironment variables.
3. Copy and paste the script into the Ruby session to see how Dependabot works.

If you run into any trouble with the above please create an issue!

1. Configure your shell with the correctenvironment variables.
2. Execute the script with Bundler:

   bundleexec ruby ./generic-update-script.rb

If you don't want to setup the machine where the script will be executed, youcould run the script within adependabot/dependabot-script container.

You can build and run theDockerfile in order to do that. You'll also have toset severalenvironment variables to make the scriptwork with your configuration, as specified above. (You can find how to passenvironment variables to your container inDocker runreference.)

Steps:

1. Build the dependabot-script Docker image

git clone https://github.com/dependabot/dependabot-script.gitcd dependabot-scriptdocker build -t"dependabot/dependabot-script" -f Dockerfile.

2. Run dependabot

docker run --rm \  --env"PROJECT_PATH=organization/project" \  --env"PACKAGE_MANAGER=bundler" \"dependabot/dependabot-script"

If everything goes well you should be able to see something like:

/home/dependabot/dependabot-script# ./generic-update-script.rbFetching gradle dependency filesfor myorganisation/projectParsing dependencies information...

The dependabot-coreDockerfile installs dependencies as thedependabot user,so volume mounting won't work unless you build the image by passing in theUSER_UID andUSER_GID arguments. This creates thedependabot user with thesame IDs ensuring it owns the mounted files and can write to them from withinthe container.

Steps:

1. Build dependabot-core image

git clone https://github.com/dependabot/dependabot-core.gitcd dependabot-coredocker build \  --build-arg "USER_UID=$(id -u)" \   --build-arg "USER_GID=$(id -g)" \  -t "dependabot/dependabot-core" .cd ..

2. Install dependencies

git clone https://github.com/dependabot/dependabot-script.gitcd dependabot-scriptdocker run -v "$(pwd):/home/dependabot/dependabot-script" -w /home/dependabot/dependabot-script dependabot/dependabot-core bundle install -j 3 --path vendor

3. Run dependabot

docker run --rm -v "$(pwd):/home/dependabot/dependabot-script" -w /home/dependabot/dependabot-script -e ENV_VARIABLE=value dependabot/dependabot-core bundle exec ruby ./generic-update-script.rb

The easiest and most common way to run Dependabot on GitHub is using the built-inDependabot service as describedhere. This is recommended for most users.

However, sometimes you may need to run Dependabot manually either for testing, or to enable features/plugins that arenot currently available in Dependabot. This is relatively straight-forward to achieve with a shell-based GitHub action.

• In your GitHub repository, create a directory.github/workflows if it doesn't already exist.
• Copymanual-github-actions.yaml into that directory.
• CustomizePACKAGE_MANAGER to suit your needs, see thepossible values above.
• (Optional) CustomizeOPTIONS to suit your needs or delete

By default this action is set to run on workflow dispatch, which means that you need to manually trigger the workflow run.If you would rather run it on a set schedule, you can switch toschedule dispatch.

The easiest configuration is to have a repository dedicated to the script.Many pipeline schedules can be added on that single repo to manage multiple projects.Thushttps://[gitlab.domain/org/dependabot-script-repo]/pipeline_schedules dashboard becomes your own dependabot admin interface.

• Clone or mirror this repository.
• Copy.gitlab-ci.example.yml to.gitlab-ci.yml or seta custom CI config path for direct usage.
• Set the required global variables used in./generic-update-script.rb.
• Createa pipeline schedule for each managed repository.
• Set in the schedule the required variables:
  • PROJECT_PATH:group/repository
  • PACKAGE_MANAGER_SET:bundler,composer,npm_and_yarn
• If you'd like to specify the directory that contains the manifest file in the repository, you can set the following environment variable:
  • DIRECTORY_PATH:/path/to/point
• If you'd like Merge Requests to be assigned to a user, set the following environment variable:
  • PULL_REQUESTS_ASSIGNEE: Integer ID of the user to assign. This can be found athttps://gitlab.com/api/v4/users?username=<your username>

• Single dependency update script
• GitLab/GHE update script