dependabot-core
dependabot-core copied to clipboard
dependabot
Update badges to be compatible with the new native GitHub Dependabot
The otherwise excellent badge (or shield) is currently "failing", writing inactive when moving to the new native GitHub Dependabot system.
This sends the wrong message, hence it should be updated to the new system as well.
I just started migrating repos over to the version of dependabot and ran into this too...
@feelepxyz maybe a good idea to prioritise this in the backlog? As you can see, many projects are dropping dependabot badge which is a great marketing for your work.
This is of greater importance now that there is a date set for Dependabot Preview to shut down.
It's not shutdown, you cannot install it anymore. Any news on the badge now? :)
We really need the ability to show a dependabot badge in the README of our private repos because there is otherwise no way to know if Dependabot has been failing or not. If dependabot fails to run (i.e. it lost access to a private repo), it doesn't send any emails or notifications, it just suddenly stops creating new PRs which gives the organization a false sense of security that "everything is fine". I can see why you don't want dependabot sending out warning emails on every check-in that it fails to complete (i.e. you set a limit to the max number of PRs or you've manually edited a PR, etc), but it also seems like a HUGE failure that dependabot can just silently fail for days/weeks and never notify anyone. I don't even get any indication in the daily/weekly summary emails that it's been silently failing because those only summarize active alerts/PRs.
Maybe this could be finally addressed using a custom workflow (see task #4680)?
Let me look into this one and get back to you. We need to make a decision either way on what the plan is, whether to support these going forward or not. I'd personally like to support them, but that would require some engineering work + ongoing maintenance of it, so no promises that we'll be able to do that. And might take me a little time to connect with everyone to figure out a decision. But we need to make a decision so we don't keep you all hanging.
I haven't circled back on this because there's been some internal debate on this.
At this point, the general consensus seems to be that we will support these at some point, but that it's not the highest priority so may take a bit longer to get to it.
