#LOCK ME NOW 2 GITHUB UPDATE#

Imagine we have a large team working on our project. Our frontend directory contains our Next.js app so this is where the package-lock.json file is now located.ĭependabot can now use this configuration to correctly identify the locations of the lock files. Our backend directory contains our Laravel app so this is where the composer.lock file is now located.

#LOCK ME NOW 2 GITHUB UPDATE#

Version : 2 updates : - package-ecosystem : ' composer' # Update the directory directory : ' /backend' schedule : interval : ' weekly' target-branch : ' develop' labels : - ' php dependencies' - ' backend' - package-ecosystem : ' npm' # Update the directory directory : ' /frontend' schedule : interval : ' weekly' target-branch : ' develop' labels : - ' npm dependencies' - ' frontend' We can update the directory setting in each to define the location of each lock file. We only need to make a small modification to the existing configuration to handle this example. This means the lock files are no longer in the root directory, they are also now in separate directories. In this next example we have a monorepo with a frontend directory and a backend directory, where the backend is PHP, such as Laravel, and the frontend is JavaScript based, such as Next.js.

If your repo structure is a bit more complicated then you may need to adjust the configuration to cater for this. The npm configuration is almost identical to the composer configuration, except we define the package-ecosystem as “npm” and the labels have been updated too. Another thing to look out for is that they are case sensitive, so if you have a label for “Frontend” and you define “frontend” in your config file, it won’t be displayed. Make sure that the labels have been created in GitHub before you commit and push up your new dependabot.yml file otherwise they won’t show in the list of Pull Requests. These will appear against the pull request in GitHub and can help you see what the pull requests are for at a glance. Here we have specified our develop branch which will allow us to do some testing on the change before we merge it into our main branch

The target-branch will define where the pull request will target.

Here we have defined weekly, but you might want to check more often, such as daily. This will tell dependabot how often to check for dependency updates.

The composer.lock file is in the root directory, so we set the directory to be “/”.

We start by defining the package-ecosystem as “composer”.Then we specify the different package ecosystems we are using. We start by defining the version, which the current version is 2. Version : 2 updates : - package-ecosystem : ' composer' directory : ' /' schedule : interval : ' weekly' target-branch : ' develop' labels : - ' php dependencies' - ' backend' - package-ecosystem : ' npm' directory : ' /' schedule : interval : ' weekly' target-branch : ' develop' labels : - ' npm dependencies' - ' frontend'

This would be used for a Laravel project. Let’s start by writing a configuration for a basic project that uses both composer and npm for it’s dependencies, where the lock files are both in the root directory. github directory needs to be in the root of your project. To create a custom configuration for dependabot, we need to create a dependabot.yml file in the. This article will guide you through the basics of creating your configuration for dependabot so it can correctly analyse your dependencies and automatically create Pull Requests for you. This works great without any configuration if you have a repo that contains npm, composer or gem dependencies, but you may need additional configuration if your lock files aren’t in the root directory, or in separate directories in the case of a monorepo. GitHub offers a dependabot service that can let you know of any potential security issues with your dependencies and automatically create a Pull Request for you.

Lock me now 2 github