What is a Github Dependabot?
https://dependabot.com/ provides a way to keep your dependencies up to date. Depending on the configuration, it checks your dependency files for outdated dependencies and opens PRs individually. Then based on requirement PRs can be reviewed and merged.
Dependabot with Gradle
Dependabot has a limited https://dependabot.com/blog/gradle-support/ for Gradle. Dependabot looks for a build.gradle or a settings.gradle in your repo, then scans for outdated dependencies and creates a PR based on available updates.
Issue
The issue aries when dependencies are maintained outside of these two files. Dependabot ONLY and ONLY scans build.gradle or settings.gradle. Most of the projects would follow this standard of having versions in these files, but remaining ones wont work at all.
Solution
There is a workaround to this issue. Follow the steps explained below to tackle this issue.
- Create dependencies.gradle file to extract all the dependencies. The file name HAS TO BE dependencies.gradle, otherwise the solution will not work. (`version.gradle` is also not supported!)
2. Modify build.gradle to use dependencies.gradle.
3. Add dependabot support with .github/dependabot.yml file to the project.
Tadaaaa.. On the next run or on a force run of dependency check, if there are updates you should see PRs opened by dependabot.
Conclusion
Dependabot is an amazing tool, to make sure your project gets latest dependencies. But the support of Gradle as compared to Maven is limited when dependencies are not maintained build.gradle or settings.gradle.
If you dont want to maintain the versions in these two files, you can tweak your gradle files in a way that dependabot can scan the project and will find out the issues with the dependencies.
Special Thanks to https://github.com/sumedhdeshpande.
References
https://dependabot.com/blog/gradle-support/
https://github.com/dependabot/dependabot-core
Originally published at https://www.sameerkulkarni.de on October 19, 2021.
