This message was deleted.

What does the task do? Because if it's using a dependency declared in the file, it would rerun (e.g if you run the build with

-t

, continuous mode). If it's not, then it means that the TOML file is an input of your task. Declare it as such and you should be good to go.

Runs a python script that generates a $projectroot/gradle/pom.xml for dependabot to consume 😭

And why do you want to trick dependeabot that way? It would not help much, would it? At least the PRs would be pretty useless, as they would just change the pseudo POM.

you can use Renovatebot which supports the TOML file

Because dependabot doesn't scan libs.versions.toml files, and I don't think I can post OWASP output to the github security page from the CI, and it's a pretty nice place to keep such info.

Ah, I see. 😕

https://github.com/dependabot/dependabot-core/issues/3121 any year now 😞

if you're interested in security, then neither renovate nor dependabot do the job, because they don't care about resolved dependenceis

Unfortunately I don't work for the Due Dilligence company that requested it from me 🙂

There is a dependency check Gradle plugin that works with the resolved dependencies and checks OWASP. But it is of course not integrated with the GitHub UI, unless you parse the result somehow and maybe use the GitHub API to upload it if possible.

Yeah, don't think that API are open as dependabot is explicitly integrated with GH, but I should have another look. Nice to save some build minutes by not having to run owasp though.

right, but it does the job better than dependabot

And it is the one I meant 🙂

It does its job by dumping output in the CI, and at best I can put it in a PR comment, while you are correct, it doesn't fit the goal 😕

there's also https://snyk.io/blog/gradle-plugin-by-snyk-gradle-dependencies-scanning/

Yep, lots of alternatives. Just want to get the security page filled out so that I can do something useful.

Much better than polluting gradle and the git repo. Was too locked into thinking it was due to GH's dependabot partnership.

I think you can even use the CodeQL GitHub Action to do the vulnerabilities scanning and integration into the UI.

I guess it depends on how well it knows how to extract versions for a project that uses libs.versions.toml, but other than that it doesn't support Kotlin yet - which my code base is written in, https://github.com/github/codeql/issues/4699

Well, any project that does need explicit support for things like version catalogs or TOML files is doing it wrong. Because they do own parsing and thus suffer from the exact problem Cédric mentioned, they check your declared versions, not your actually used versions.

which is still better than doing nothing, to be fair 🙂

If a tool does it right and for example uses the tooling api to get the resolved dependencies to be checked, it automatically supports all existing and future ways to declare versions.

Agree. But it's a best effort thing. Would be nice with gradle lock files instead, but got burned by that last time I tried it out wrt how it interacted with IDEA.