Due to a series of unfortunate circumstances we have to deal with a couple of projects that use Gradle as build tool at work. For these projects we wanted automatic PR generation for updated dependencies. Since we use Github Enterprise, using Dependabot seems logical. However, this turned out to be not very straightforward. This article documents one way that works for us.
As we were experimenting with Dependabot, we discovered the following rules:
- The scala version in the artifact name must not be a variable.
- A variable for the artifact version is fine, but it must be declared in the same file in the ext block.
- Versions should follow the Semver specification.
- You must not use Gradle’s + version range syntax anywhere, Maven’s version range syntax is fine.
In our projects the scala version comes from a plugin. In addition, we sometimes need to cross build for different scala versions, very much at odds with rule no. 1. We solved this with a switch statement.
With these rules and constraints we discovered that the following structure works for us and Dependabot:
ext {
jacksonVersion = '2.15.2'
scalaTestVersion = '3.0.8'
}
dependencies {
switch(scalaMainVersion) {
case "2.12":
implementation "com.fasterxml.jackson.module:jackson-module-scala_2.12:$jacksonVersion"
testImplementation "org.scalatest:scalatest_2.12:$scalaTestVersion"
break
case "2.13":
implementation "com.fasterxml.jackson.module:jackson-module-scala_2.13:$jacksonVersion"
testImplementation "org.scalatest:scalatest_2.13:$scalaTestVersion"
break
default:
break
}
// implementation 'com.example:library:0.8+' // Don't do this
implementation 'com.example:library:[0.8,1.0[' // This is fine
}It took 3 people a month to slowly discover this solution (thank you!). I hope that you, dear reader, will spend your time more productive.
