Dependabot-core: K8s, Helm, Repos as Code recommendations

[dominikmeyersap]

Dear Dependabot Team
We are starting to use dependabot and are super happy! Thanks for creating this awesome tool!

That said, our Repo will soon be migrated into a GitHub enterprise account.

We can no longer use the hosted application and need to host a dependabot ourselves.

Given:

• Kubernetes landscape
• Helm charts
• Mostly node/java developers

Wanted:

• Helm deployed dependabot using your .Dockerfile
• Reading GH token from side car mounted Vault container
• Checking repos which are defined "as code", like a config file that lists all repos to check

Seen:

I've checked your code .Dockerfile and your dependabot-script repo. I think what we want is somewhere between but we have like not too much clue how to start but should have it if possible on Aug 26th.
Can you point us in the right direction for the wanted-bullets? Happy to provide more information if needed!

Thanks and best regards

[feelepxyz]

@dominikmeyersap hey sorry for missing this one! We currently don't have any good tools for self-hosting Dependabot so won't be able to help with much beyond what we have in dependabot-core and dependabot-script. We have some plans on making it easier to run dependabot-core give a .dependabot/config.yml file but can't promise when we'll get to this.

You'll have to write your own runner that wraps something similar to the example in dependabot-script in a docker container and execute this your credentials and repository to check.

Sorry to not be of more help! 😢

[mambax]

Thanks anyway, our infra-rock ⭐️'s are already setting up the self-hosted approach 👍
Can let you know as soon as we have it how it was done 💯

[genebean]

I’m interested to hear how you set it up too.

[mambax]

It is scheduled for this sprint, let you know more asap! 👍🏼

On Wed, 6 Nov 2019 at 04:56, Gene Liverman [e-mail] wrote:

I’m interested to hear how you set it up too.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/dependabot/feedback/issues/636?email_source=notifications&email_token=ABJX7K7DUB63Z6BPRU33MDLQSI55FA5CNFSM4INDAOIKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEDFFRVQ#issuecomment-550131926,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABJX7K4ZXDHY4352PUYAGG3QSI55FANCNFSM4INDAOIA
.

[jaredscheib]

Any news here @mambax? Interested here as well!

[mambax]

@jaredscheib Sadly not. I postponed to check it as I have been promised that Actions come to GHE in August and with that Dependabot.... Lets see.

[jaredscheib]

right on, all good @mambax :) thanks for the quick response~

[infin8x]

Closing due to age