Support dependabot

[re-thc]

Dependabot is supported by Gradle and Maven. Would be good if Mill can work with Dependably to get auto updates.

[lefou]

FYI, Scala Steward is an alternative to automatically update dependencies in Mill projects. It seems to have issues with very large projects (at least Mill itself doesn't see PRs from it), but beside that, it works reasonable well for Mill projects.

[re-thc]

Scala Steward requires updating to a list of public repos or to run it yourself. It's close but not the same value. Assuming most projects may not run only. run Mill, Dependabot is an all-in-one solution. It captures docker containers, GitHub action scripts and other languages of course.

[lefou]

What is required to support Dependabot?

To avoid reinventing the wheel, the following options could be reused:

• Mill can report updateable dependencies via the mill.javalib.Dependency/updates / mill.javalib.Dependency/showUpdates
• The Scala Steward plugin also provides a list of updateable dependencies in a structured format.

[re-thc]

The best would be to work with Dependabot team and have it officially supported in their workflow. It's a good way to increase adoption especially of businesses.

It's not just about providing a set of dependencies to update. It's about having the automation that integrations with the GitHub ecosystem out of the box. Your dependencies get checked on a schedule, a PR is created, tests can be run and even auto merged. That's the value.

[lefou]

So there is no specific API or export format we can use to support Dependabot and it needs explicit code contributed to their service? That's sounds like just another vendor lock-in to me. I have pretty bad experience with other Github integrations and how they take external developers work and feedback and don't care at all to give clear answers back. For example, the requests for better Asciidoctor markup support (github/markup#1095) or the Github dependency graph story (#5242).

From a quick glance over their docs, I couldn't spot any docs how to integrate more tools. It only covers what tools are supported and how to enable that support.