-
Notifications
You must be signed in to change notification settings - Fork 1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for docker-compose.yml files #1431
Add support for docker-compose.yml files #1431
Conversation
eaa6500
to
1af89fb
Compare
1af89fb
to
3520c32
Compare
It currently can't SHA-pin the docker-compose.yml `image` keys, so can't help us achieve reproducible builds (dependabot/dependabot-core#390)
3f94bb6
to
d2d3d5b
Compare
Thanks @pombeirp! Would love to see support for docker-compose.yml land ❤️ |
1d4e71d
to
2f787e7
Compare
@feelepxyz Don't know what is happening but the tests show as failing in the PR (due to stuff unrelated to the PR). |
2f787e7
to
2b8f252
Compare
@pombeirp @feelepxyz It looks like the tests are passing again. |
@pombeirp thanks for the contribution! Just a heads up that I won't be able to get to this immediately but hopefully get some time in the next week or so to review it thoroughly to make sure we understand the changes and can maintain it going forward. |
@feelepxyz Sure, totally understand it, thanks for the transparency. |
cf811ee
to
92939a8
Compare
6e2a632
to
9d2938d
Compare
Looking forward to this |
9d2938d
to
fba0088
Compare
Also looking forward to this getting in! |
@pedropombeiro Can you tell us why this PR was closed? Would love to use this. |
@erkannt There was no feedback from reviewers for about 4 months, and because I keep a widget of open PRs in VS Code, I decided to clean that up a bit. |
😭 |
Think we can re-open this? Who do we have to prod to get some review feedback? |
@rebelagentm could you have a look again? |
This PR adds support for
docker-compose.yml
files in thedocker
package. The approach was to add additional handlers alongsidedocker/lib/dependabot/docker
, i.e.docker/lib/dependabot/docker_compose
.To address the duplication of code resulting from identical logic in e.g. parsing Docker image names or computing resulting updates some shared logic was extracted to modules under
docker/lib/dependabot/docker/utils
, which then get pulled in as mixins. For tests, I've added e.g.docker/spec/dependabot/docker/common/shared_examples_for_docker_update_checkers.rb
, since most of the code is exactly the same.Suggestions are welcome, especially on:
docker_compose
folder;docker
anddocker_compose
;docker_compose
is the right way. I see that some languages already support multiple package managers in Dependabot (e.g.go:dep
andgo:modules
), so I'm wondering if this should be nameddocker:compose
in this list. I'm trying to figure out where that is configured, just searching forgo:modules
doesn't yield results.Closes #390