Allow to exclude internal repositories

[mkutz]

Hello,

we are facing the following challenge:

• Our Maven/Gradle projects require some artefacts from an internal repository which is (and should be) unreachable from the internet.
• Our self-hosted runners can reach it, hence we can build anyway.
• Dependabot does not use our self-hosted runners and hence cannot reach the repository.
• When we configure the repository in our pom.xml or build.gradle, Dependabot picks it up anyway and times out.

For Maven we found the solution to put a prepared settings.xml into the self-hosted runner, so we don't need to configure it in the projects' pom.xml. However, we find that solution not ideal and we don't have such a solution for Gradle.

The way we see it, the easiest way would be to put a list of blocked repositories into .github/dependabot.yml, which would then not be scanned even when the are configured in pom.xml or build.gradle files.

[jurre]

I think it should work to configure the private dependencies as ignored, using the ignore configuration setting. You can just list the dependency-name only without a version and it will ignore all versions that way.

In some ecosystems this still causes issues when resolving the dependency tree, but for Gradle I don't believe this is the case.

Lmk if that works or if you run into issues!

[stefanscheidt]

Hi. Thanks for the quick response. Unfortunately your suggestion would not work as Dependabot checks all repositories known to it for each dependency, e.g. for SLF4J we get this:

updater | INFO <job_xxxxxx> Checking if org.slf4j:slf4j-api 1.7.36 needs updating
  proxy | 2022/02/15 11:05:16 [056] GET https://our.private.repository:443/org/slf4j/slf4j-api/maven-metadata.xml
  proxy | 2022/02/15 11:05:28 [052] WARN: Cannot read TLS response from mitm'd server dial tcp xxx.xxx.xxx.xxx:443: connect: connection timed out
  proxy | 2022/02/15 11:05:36 [058] GET https://our.private.repository:443/org/slf4j/slf4j-api/maven-metadata.xml
  proxy | 2022/02/15 11:05:48 [056] WARN: Cannot read TLS response from mitm'd server dial tcp xxx.xxx.xxx.xxx:443: connect: connection timed out
  proxy | 2022/02/15 11:05:56 [060] GET https://our.private.repository:443/org/slf4j/slf4j-api/maven-metadata.xml
  proxy | 2022/02/15 11:06:08 [058] WARN: Cannot read TLS response from mitm'd server dial tcp xxx.xxx.xxx.xxx:443: connect: connection timed out
  proxy | 2022/02/15 11:06:16 [062] GET https://our.private.repository:443/org/slf4j/slf4j-api/maven-metadata.xml
  proxy | 2022/02/15 11:06:28 [060] WARN: Cannot read TLS response from mitm'd server dial tcp xxx.xxx.xxx.xxx:443: connect: connection timed out
  proxy | 2022/02/15 11:06:36 [064] GET https://repo.maven.apache.org:443/maven2/org/slf4j/slf4j-api/maven-metadata.xml
  proxy | 2022/02/15 11:06:36 [064] 200 https://repo.maven.apache.org:443/maven2/org/slf4j/slf4j-api/maven-metadata.xml

One way to work around this issue ist to declare our private repository in a Maven settings.xml or a Gradle init script provided by our self hosted runner. The issue with that though is that every developer has to configure his/her local machine accordingly. We would therefor very much prefer the possibility to black-list our private repository in the dependabot.yaml.

[jurre]

Ah yeah we bail out at the PR creation stage for ignored dependencies, we should see if we can prevent ignored dependencies from being checked earlier in the process and then this should work as expected. There might be some technical reason why this is not the case, will need to dig into it a little

[stefanscheidt]

Ignoring dependencies does not help in our case, I far as I can see.
In our example, our Maven project has a dependency to the public library slf4j-api.
We don't want to add this dependency to the list of dependencies that Dependabot should ignore.
And as Dependabot checks all repositories mentioned in the POM for every not-ignored dependency, it will also check our private repository for updates of slf4j-api, causing the mentioned time-out issues.
We still think a list of to-be-ignored repositories in dependabot.yaml would be a good and easy to understand solution ...

[mkutz]

As @stefanscheidt already said: ignoring dependencies does not work. The repository gets queried for every dependency and hence the timeout will happen anyway – unless we ignore all dependencies, which basically is the same as not using Dependabot at all.