Generic dependency support (not only NPM)

[clairernovotny]

Is there a way to extract the dependency name and versions from the Dependabot PR? That would enable this action to work for all dependency types instead of just ones with a package.json:

For example:
Humanizr/Humanizer#1099

That shows the dependency name, original and destination version. That seems like it has all the information required for this action to decide if it should be auto merged or not?

[tjenkinson]

Hi,

The approach I took here was to determine the version from the manifest directly so that it doesn’t matter what generates the PR. I.e it’s not coupled to dependabot.

If we wanted to support other languages that sounds good but I think we should parse their manifest files directly, similar to what we do with the package.json now

[clairernovotny]

The trouble is that many things don't have a single obvious manifest file. For .NET projects, they can be in many different files, in different directories, etc. Dependabot has the logic to figure it out and do the right updates. Doesn't seem to make sense to try to duplicate that.

[tjenkinson]

Yeh it would be nice if that dependabot logic was open source. Not sure if it is.

If you want to use the information from the PR description/tags dependabot adds instead I think there are already other actions that do that.