Avoid forking repo about dependabot-script HOT 3 CLOSED

@gitfool Does user used by Dependabot has write access to repository? We use Dependabot with several repositories in our privately hosted Gitlab instance and Dependabot creates branches in original repository.

from dependabot-script.

I think you're asking about forking the https://github.com/dependabot/dependabot-script repo.

I'm just starting with this myself, but it looks like no you need to fork (or mirror) it yourself.
You create a new project that builds it into a Docker image itself.
I'm looking at that to save the time of bundle install -j $(nproc) --path vendor for each pipeline.

I did plan a way to just include this in each project pipeline directly using include.
This could possibly be direct from the GitHub repo (without a fork).
The downside I found was every project you scan would need your API token.
If you fork and schedule then only the bot project needs the token.

from dependabot-script.

This repo is primarily a collection of example scripts if you wish to run Dependabot outside of GitHub... it's a starting place, not expected to be production grade as users have all kinds of custom scenarios.

So forking in order to customize is almost inevitable. That said, there are some ways around that, as others have detailed above.

Closing, as nothing more to do here.

from dependabot-script.