GitHub GitHub Checkout, 6 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Dependabot version updates are now generally available - GitHub Checkout

Description

The big news is that Dependabot on GitHub is now generally available! It's got all the Dependency updating goodness of Dependabot Preview, but with a fully integrated GitHub experience.

Millions of repos use Dependabot to keep their dependencies up to date, either by updating when a Dependabot alert lets them know about a vulnerable dependency (security updates), or on a fixed schedule (version updates). Dependabot security updates have been generally available for over a year, and it's time that version updates join them in general availability.

Read more about it here:
https://github.blog/changelog/2021-03-31-dependabot-version-updates-are-now-generally-available/

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

What's up y'all, I'm b dougie and I've got a feature for you to check out. uh If you didn't know, you can actually go to github uh on the youtube and follow this playlist so definitely head over. There hit save playlist as well as check out some other content on the github youtube channel.

A

So these videos are a place for you to find out about the new features on github and also hear from the people who put them together and I've got mike mcdonald, aka ascii mike here, to talk about a new feature with dependabi mike. Take it away big.

B

News recently, dependabot is fully built into github and generally available, so you can get all of your security updates and your version updates all of that package management and package management, updating goodness directly in github. You don't need to install a third-party app, which is what dependable preview was, and so I'm here to talk to you about getting off of preview and into that fully native github experience, as well as some of the features that we added to uh to github native to pandabot. To make that happen.

B

So, let's imagine that you have a repository that is still on dependable preview, so I have my dependabot github checkout repo you'll notice that we have a dependable, config, yaml, so version one, and it is just saying: hey keep my javascript dependencies located at the root repo live and we have a simple package json that all it's doing is pull in low dash, but it is on the old version of dependable, so dependable preview had this ui, you can check out hey. We have the dependable github checkout repo, it has a package.json.

B

We checked it a little while ago and you'll notice. There's this really nice little button over here that says, update config file and you can click this button, as I am about to do, and it's going to magically update you to the latest version of dependable that version of dependable that is built into github, really really close to your source code. So I can click, create pull request and boom. It is creating a pull request back over in our repo we can update. I just refreshed the page and wow. It is already there.

B

We already have a pull request that says: hey from preview. You know as my last act as the dependable preview bot. I am going to migrate you over to dependable native github, so I have a pr I'm going to just merge this in well. We can actually take a look quickly before I do at what changed and one last thing just for verification. It's version, two version: two is the github native dependable version of the defenderbot config.

B

So we'll merge this pull request, and now we want to go and check out dependabot to make sure that it's actually running. So here we are in the dependabot view of github, so is insights, dependency, graph, dependabot and we're checking for the update to lowdash. So the dependable run just ran as you can see finished 10 seconds ago, and we can take a look at the logs and see what happened. That's.

A

Awesome uh and it seems pretty straightforward as well, uh but I'm curious what about if you wanted to host your own private packages.

B

Yeah, that's an awesome question. So, um first of all, you saw how easy and automated that pr was if you're already using you know, github packages or artifactory or whatever you were on preview. We will automatically migrate that over and so in that pull request. You noticed hey. These are some secrets.

B

We have actually already been using private registries and that was just a nice, little alert to say, hey you're, using private registries. You should pull whatever your credentials over if you're not doing that. This is actually a feature that we just added to github native dependable and it's private registry support. So I can walk us through how to set that up. I can go to my dependable yaml and what I want to do is I want to very quickly add a registries config and I'm going to do a little bit of copy paste magic.

B

But what if we wanted to add a registry to support, for instance, github packages, so I'm going to call it github npm, it's an npm registry, it's hosted on npm package github.com and the last important thing is. We want to add a token and so dependable added the ability to store some secrets and I'm going to create a secret called my github personal access token, and then I've created my registry. This is where I'm going to actually fetch the packages from I'm going to update my update job to actually use that package.

B

Let's actually do the second part, so now that I can fetch private packages.

B

Let's imagine that I now have a dependency that we're going to call my super secret inner source dependency, and I will just copy that directly over and if we actually look at this and we have a package hosted on github packages, be testing inner source 2, we'll put it at version, 1.0.6, adding inner source dependency, we're going to commit that and then the last thing that we have to do is I actually have to provide dependable with that token, without that, if we went over to our insights tab and check the run, the run will have failed.

B

I'm going to create a personal access token, so I called it my underscore github underscore personal access, token and dependibot is going to run and we can look at those logs again and now we're going to see both low dash and our private intersource dependency.

B

We go over here. We have a pull request, and here it is the new version of dependabot, so dependabot native to github notice. How it doesn't have depend about preview or anything, and it tells us everything that we need to know about updating from 106 to 107.

B

I'll merge that we have a package.json that has been updated. It's got the latest version of our intersource dependency and we go back version two. We have a private registry with one of my own github personal access tokens and we are pulling npm directly from it.

A

Well, that concludes our conversation. So if you want to learn more about github and what's happening on our feature set, uh stick around for the next.

A

A