Integrating with sbt-dependency-check plugin about mill-github-dependency-graph HOT 3 CLOSED

Hey @maoo, thanks for the question. A couple things:

Firstly, you might have better luck asking about this in https://github.com/scalacenter/sbt-dependency-submission, which is the sbt equivalent for what the plugin is doing if your builds are with sbt. I'm not sure they are if you're using this, but then also saying you're using sbt-dependency-check.

since Dependabot doesn't work on transitive dependencies

So actually with both this mill plugin and the sbt one, your transitive dependencies actually are submitted. So dependabot can warn you about them.

I was wondering if there is a way to integrate the mill-github-dependency-grapth with the sbt-dependency-check plugin, and skip the whole part that submits data to GitHub.

Probably not as the whole point of this plugin is to submit it to GitHub in order to get dependabot alerts. Having a mill equivalent to sbt-dependency-check is a bit out of scope for this project.

Again, thanks for the questions!

from mill-github-dependency-graph.

Thanks for your quick reply @ckipp01 ! My idea is to actually build a mill-dependency-check plugin, starting from your code (Graph.scala, ModuleTrees.scala and Resolver.scala would actually be unchanged), adapt Writers.scala and add some logic from DependencyCheckPlugin.scala.

Before starting to code, I'll gather more validations, as I don't want to risk to reinvent the wheel; unfortunately, I've checked the results we get in the GitHub dependency tree, and it doesn't contain all transitive deps; as soon as the repo is public, I can share more info with you, if you're interested.

Thanks so much for your suggestions!

from mill-github-dependency-graph.

Thanks for your quick reply @ckipp01 ! My idea is to actually build a mill-dependency-check plugin, starting from your code (Graph.scala, ModuleTrees.scala and Resolver.scala would actually be unchanged), adapt Writers.scala and add some logic from DependencyCheckPlugin.scala.

Ah, cool. That'd be really useful!

I've checked the results we get in the GitHub dependency tree, and it doesn't contain all transitive deps

Ah really? It definitely should as we resolve everything, so the results should be everything after reconciliation. When the repo is public, for sure report back as I'd like to dig into what is missing. Also make sure to check out the [generate task]( I've checked the results we get in the GitHub dependency tree, and it doesn't contain all transitive deps) at the bottom with the latest version and you'll actually be able to see the full manifest to get a better idea of what might be missing.

from mill-github-dependency-graph.