I've been using dependabots with github with some degree of success on typical maven projets, as it sends correct pull requests updating the versions of the dependencies in the pom.xml. On an Eclipse plugin project however, the dependencies and their versions are also listed in 2 other files MANIFEST.MF and in build.properties.
Example build.properties :
bin.includes = META-INF/,\
.,\
plugin.xml,\
lib/,\
plugin.properties,\
lib/nexus-indexer-lucene-model-2.14.20-02.jar,\
lib/jaxb-api-2.3.1.jar,\
lib/activation-1.1.1.jar,\
lib/jaxb-impl-2.3.3.jar,\
lib/jaxb-runtime-2.3.3.jar
Example MANIFEST.MF :
Bundle-ClassPath: lib/cvsclient-20060125.jar,
lib/maven-scm-api-1.9.4.jar,
lib/maven-scm-provider-accurev-1.9.4.jar,
lib/maven-scm-provider-bazaar-1.9.4.jar,
lib/maven-scm-provider-clearcase-1.9.4.jar,
lib/maven-scm-provider-cvs-commons-1.9.4.jar,
lib/maven-scm-provider-cvsexe-1.9.4.jar,
lib/maven-scm-provider-cvsjava-1.9.4.jar,
lib/maven-scm-provider-git-commons-1.9.4.jar,
lib/maven-scm-provider-gitexe-1.9.4.jar,
lib/maven-scm-provider-hg-1.9.4.jar,
lib/maven-scm-provider-integrity-1.9.4.jar,
lib/maven-scm-provider-jazz-1.9.4.jar,
lib/maven-scm-provider-local-1.9.4.jar,
lib/maven-scm-provider-perforce-1.9.4.jar,
lib/maven-scm-provider-starteam-1.9.4.jar,
lib/maven-scm-provider-svn-commons-1.9.4.jar,
lib/maven-scm-provider-svnexe-1.9.4.jar,
lib/maven-scm-provider-synergy-1.9.4.jar,
lib/maven-scm-provider-tfs-1.9.4.jar,
lib/maven-scm-provider-vss-1.9.4.jar,
lib/plexus-utils-3.0.16.jar,
lib/nexus-indexer-lucene-model-2.14.20-02.jar,
lib/nexus-restlet1x-model-2.9.2-01.jar,
lib/maven-scm-provider-jgit-1.9.4.jar,
lib/jaxb-api-2.3.1.jar,
lib/jaxb-impl-2.3.3.jar,
lib/jaxb-runtime-2.3.3.jar,
lib/activation-1.1.1.jar,
.
I use a minimalist dependabots.yml suited for maven :
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
version: 2
updates:
- package-ecosystem: "maven" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "daily"
Dependabots sent a pull request "Bump nexus-indexer-lucene-model from 2.14.20-02 to 2.15.1-02" but the pull request only updates the version in the POM, which makes the build fail, because the other files MANIFEST.MF and build.properties were not updated. How do I get depandabots to update these 2 files MANIFEST.MF and build.properties ?
