README

@amanda-mitchell/semantic-release-notify-dependabot

This is a plugin for Semantic Release that notifies Dependabot of package updates in private registries.

Installation

yarn add --dev @amanda-mitchell/semantic-release-notify-dependabot

Usage

The plugin can be configured in the semantic-release configuration file:

{
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "@amanda-mitchell/semantic-release-notify-dependabot"
  ]
}

Configuration

By default, this plugin will assume that you are publishing an npm package and will inspect the package.json in the current working directory for the package name.

Authentication

Authentication configuration is required and can be set via environment variables.

Dependabot uses GitHub personal access tokens for authentication (docs). This plugin will use DEPENDABOT_TOKEN if it is set, but will fall back to either GITHUB_TOKEN or GH_TOKEN if it is missing.

Environment variable

Variable	Description
`DEPENDABOT_TOKEN`, `GITHUB_TOKEN`, or `GH_TOKEN`	Required. The token used to authenticate with Dependabot.

Options

Option	Description	Default
`packageManager`	The package manager to which this package belongs. At the time of this writing, must be one of `bundler`, `composer`, `docker`, `maven`, `npm_and_yarn`, `elm`, `submodules`, `hex`, `cargo`, `gradle`, `nuget`, `dep`, `go_modules`, `pip`, `terraform` or `github_actions` (From the Dependabot API docs)	`npm_and_yarn`
`packageRoot`	The directory holding the `package.json` for this package. (Ignored unless `packageManager` is `npm_and_yarn`)	Current working directory.
`packageName`	The package name that should be sent to Dependabot.	The `name` field from `package.json`.

Usage no npm install needed!