mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-29 16:59:02 +00:00
zT-1337
ddc46220b9
* - Added Renovate support for the [SCM-Manager](https://scm-manager.org/) - SCM-Manager is a repository management tool like GitHub - It is maintained as an open source project by the company [Cloudogu](https://cloudogu.com/en/) - The SCM-Manager support is not feature complete yet, features like auto merging are still missing - The SCM-Manager also got added to the documentation as another platform author Thomas Zerr <thomas.zerr@cloudogu.com> 1690877165 +0200 committer Eduard Heimbuch <eduard.heimbuch@cloudogu.com> 1706264263 +0100 * Reverted numbering change in markdown docs * Changed from type to interface, if possible * Removed axios dependency and using the http layer of renovate instead * Fixed not using scmm specific mime types for accept header * Use git from test/util instead * Add dummy tests for no ops * Fix some phrasing and spelling issues * Change scmm to scm-manager and fix SCM-Manager specific content type * Add supported major versions, review plugin requirement, write permissions is needed * Change using actual host rules instead of mocking it * Change use http mocks for testing * Update docs/usage/getting-started/running.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/index.ts Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/mapper.spec.ts Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix scm-manager docs link * Fix linting * Fix linting * Throw errors if username or token is not provided by the host rules * Replace NO-OP with Not implemented * Remove objects from log messages * Fix linting * Fix path to platform config options * Fix link to self-host-configuration docs * Fix link to self-host-configuration docs * Remove the link to the platform config option, because the tests keep failing * Fix link to self-host-configuration docs * Remove not needed type cast Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Fix type check of protocol links * Move scm-manager into util http folder * Apply linting * Add maxBodyLength function and its test * Add test case if protocol links are not an array of links * Use zod schema for pagination * Apply linting * Refactor typing with zod schema * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update readme Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Add try catch around fetching the current user * Switch log statement from info to debug Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from debug to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Fix linting errors * Remove credentials check in initRepo * Fix imports * Fix zod schema for repositories * Fix zod schema for pull requests * Fix 500 error after attempting to update an pr * Fix wrong typing * Refactor parameterized tests for better readability * Refactor SCM HTTP API * Add setToken functionality * Remove not needed type definition Co-authored-by: Michael Kriese <michael.kriese@gmx.de> * Fix assertion * Fix istanbul comment * Change log statement * Remove type rename * Move inferred types close to corresponding schemas * Add platform is experimental * Remove type renaming * Fix type imports * Fix test suite description * Remove debug log statement Co-authored-by: Michael Kriese <michael.kriese@gmx.de> * Fix warning * Fix paremeterized unit tests with string templates * Fix spelling Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix eslint error * Convert trace logs to debug logs * Convert info logs to debug * Replace manual null and undefinded check with is util * Rephrase instruction in readme * Use ensureTrailingSlash instead * Fix linting * Keep type and schema together * Simplify hasAssignees check * Simplify reviewer mapping * Remove istanbul comments * Replace custom scmm header option with renovate native http headers option * Let the token be passed in initPlatform * Add description which permissions are needed * Add support for ignorePrAuthor filter * Add notes about automerge feature within platform readme * Add support for fast_forward_only * Change supported versions due to merge strategy change * Remove commented code * Fix import * Use email schema * Heed review advice * Fix import and empty array assertions * Fix linting issue * Fix import errors * Fix removed ignorePrAuthor parameter from initRepo function * Fix failing unit tests by setting/reseting the global config * Mark scm-manager as experimental * Fix zod import path * Change endpoint configuration, so that user only needs to define origin, but not also the path * Fix warning of redundant backslash --------- Co-authored-by: Eduard Heimbuch <eduard.heimbuch@cloudogu.com> Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Co-authored-by: Michael Kriese <michael.kriese@visualon.de> Co-authored-by: René Pfeuffer <rene@pfeuffer-web.de> Co-authored-by: Michael Kriese <michael.kriese@gmx.de> Co-authored-by: René Pfeuffer <rene.pfeuffer@cloudogu.com>
173 lines
15 KiB
Markdown
173 lines
15 KiB
Markdown
# Bot comparison
|
|
|
|
This page explains the key differences between Renovate and Dependabot, to help you choose a bot.
|
|
We're trying to be as objective as possible, so this is not a "versus" or anti-Dependabot page.
|
|
|
|
If you see anything wrong on this page, please let us know by creating a [Discussion](https://github.com/renovatebot/renovate/discussions), or edit this page with a PR.
|
|
|
|
## Table of features
|
|
|
|
| Feature | Renovate | Dependabot |
|
|
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| Dependency Dashboard | Yes | No |
|
|
| Grouped updates | Yes, use community-provided groups, or create your own | Yes, create [`groups`](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups) manually or [handled automatically by dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates#about-grouped-security-updates) |
|
|
| Upgrades common monorepo packages at once | Yes | Yes |
|
|
| Officially supported platforms | Azure, Bitbucket, Forgejo, Gitea, GitHub, GitLab, SCM-Manager, see [full list](./index.md#supported-platforms) | GitHub and Azure DevOps |
|
|
| Supported languages | [List for Renovate](./modules/manager/index.md) | [List for Dependabot](https://docs.github.com/en/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories#supported-ecosystems-and-repositories) |
|
|
| Show changelogs | Yes | Yes |
|
|
| Compatibility score badges | Four badges showing: Age, Adoption, Passing, Confidence | One badge with overall compatibility score |
|
|
| Built-in to GitHub | No, requires app or self-hosting | Yes |
|
|
| Scheduling | By default, Renovate runs as often as it is allowed to, read [Renovate scheduling](./key-concepts/scheduling.md) to learn more | Yes: `daily`, `weekly`, `monthly`, `quarterly`, `semiannually`, `yearly` or `cron` |
|
|
| License | [GNU Affero General Public License](https://github.com/renovatebot/renovate/blob/main/license) | [MIT License](https://github.com/dependabot/dependabot-core/blob/main/LICENSE) |
|
|
| Programming language of project | TypeScript | Ruby |
|
|
| Project pulse | [`renovatebot/renovate` pulse](https://github.com/renovatebot/renovate/pulse) | [`dependabot-core` pulse](https://github.com/dependabot/dependabot-core/pulse) |
|
|
| Contributor graph | [`renovatebot/renovate` contributor graph](https://github.com/renovatebot/renovate/graphs/contributors) | [`dependabot-core` contributor graph](https://github.com/dependabot/dependabot-core/graphs/contributors) |
|
|
|
|
## Hosted app
|
|
|
|
This section explains the key differences between the Mend Renovate app and the GitHub-native Dependabot.
|
|
|
|
Even if you're going to self-host a bot, read the hosted app section first, because many features and concepts are similar.
|
|
Then read the self-hosted section.
|
|
|
|
### Dependency Dashboard
|
|
|
|
One big feature of Renovate is the Dependency Dashboard, which is enabled by default.
|
|
Read the [Key concepts, Dependency Dashboard](./key-concepts/dashboard.md) page to learn more.
|
|
|
|
Dependabot does not have a similar feature.
|
|
|
|
### Grouped updates
|
|
|
|
Renovate comes with community-provided groupings of dependencies.
|
|
So Renovate groups common dependencies into a single PR, out-of-the-box.
|
|
|
|
Dependabot can group dependencies into a single PR too, but you must set your own [`groups`](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups) first.
|
|
|
|
### Upgrades common monorepo packages at once
|
|
|
|
Renovate has a [`group:monorepos`](./presets-group.md#groupmonorepos) preset, that upgrades common monorepo packages in a single PR.
|
|
|
|
Dependabot does not update common monorepo packages in a single PR.
|
|
|
|
### Supported platforms
|
|
|
|
Platform means the Git-hosting site or program, for example GitHub, GitLab or Azure.
|
|
|
|
Renovate works on multiple platforms, including GitHub.
|
|
Read the [list of Renovate platforms](./modules/platform/index.md) to learn more.
|
|
|
|
The _official_ Dependabot program only works on GitHub.
|
|
If you're an advanced user, you may use the [`dependabot-core` repository](https://github.com/dependabot/dependabot-core) as a base to build your own Dependabot, which you can run on other platforms.
|
|
|
|
### Supported languages
|
|
|
|
- [Renovate's supported managers](./modules/manager/index.md)
|
|
- [Dependabot's supported repositories and ecosystems](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates#supported-repositories-and-ecosystems)
|
|
|
|
### Show changelogs
|
|
|
|
| Feature | Renovate | Dependabot |
|
|
| ------------------------------------- | ---------------------------- | ------------------------------- |
|
|
| Link to GitHub release | Yes, to specific release tag | Yes, to "releases landing page" |
|
|
| Link to GitHub's comparing changes UI | Yes | Yes |
|
|
| Release notes | Yes | Yes |
|
|
| Links to issues | Yes | Yes |
|
|
| Upstream `CHANGELOG` file | No | Yes |
|
|
| Recent commits | No | Yes |
|
|
| Link to individual commits | No | Yes |
|
|
|
|
### Compatibility score badges
|
|
|
|
Renovate shows four _Merge Confidence_ badges in its PRs:
|
|
|
|
- **Age**: The age of the package
|
|
- **Adoption**: The percentage of this package's users (within Renovate) which are using this release
|
|
- **Passing**: The percentage of updates which have passing tests for this package
|
|
- **Confidence**: The confidence level for this update
|
|
|
|
Read the [Merge Confidence badges](./merge-confidence.md) page to learn more.
|
|
|
|
Dependabot shows one compatibility score badge in its PRs.
|
|
This score tells you how many other repositories have passing CI tests for the proposed update.
|
|
Read the [GitHub Docs, Dependabot's compatibility scores](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates#about-compatibility-scores) to learn more about Dependabot's badge.
|
|
|
|
### Built-in to GitHub vs app
|
|
|
|
Renovate needs app installation or self-hosting.
|
|
|
|
Dependabot is built-in to GitHub.
|
|
|
|
### Scheduling
|
|
|
|
You can set a schedule for Renovate, per dependency, manager, or even a global schedule.
|
|
Read [Renovate scheduling](./key-concepts/scheduling.md) to learn more.
|
|
|
|
Dependabot has four options that apply at a language level:
|
|
|
|
- [`schedule.interval`](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#interval)
|
|
- [`schedule.day`](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#day)
|
|
- [`schedule.time`](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#time)
|
|
- [`schedule.timezone`](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#timezone)
|
|
|
|
### License
|
|
|
|
Renovate uses the [GNU Affero General Public License](https://github.com/renovatebot/renovate/blob/main/license).
|
|
|
|
Dependabot uses the [MIT License](https://github.com/dependabot/dependabot-core/blob/main/LICENSE).
|
|
|
|
Neither license is relevant to the end user though if consuming through an App/SaaS.
|
|
|
|
### Programming language of project
|
|
|
|
Renovate uses TypeScript.
|
|
|
|
`dependabot-core` uses Ruby.
|
|
|
|
## Self-hosting a bot
|
|
|
|
This section explains how to self-host each bot.
|
|
|
|
### Self-hosting Renovate
|
|
|
|
You can self-host Renovate on all [officially supported platforms](./index.md#supported-platforms).
|
|
|
|
If you decide to self-host Renovate, read the items from the [Self-hosting Renovate reading list](./reading-list.md#self-hosting-renovate).
|
|
|
|
Available [Renovate distributions](./getting-started/running.md#available-distributions):
|
|
|
|
- npm package (CLI)
|
|
- Docker images
|
|
- GitHub Action
|
|
- GitLab Runner
|
|
- Mend Renovate On-Premises
|
|
- Mend Remediate (commercial offering)
|
|
- Forking Renovate app
|
|
|
|
### Self-hosting Dependabot
|
|
|
|
You can self-host Dependabot on other platforms than GitHub but none are officially supported.
|
|
|
|
#### As a GitHub Actions workflow on GitHub
|
|
|
|
You can run Dependabot as a GitHub Actions workflow on hosted and self-hosted runners.
|
|
Learn more by reading the:
|
|
|
|
- [GitHub Blog, Dependabot on GitHub Actions and self-hosted runners is now generally available](https://github.blog/news-insights/product-news/dependabot-on-github-actions-and-self-hosted-runners-is-now-generally-available/)
|
|
- [GitHub Docs, About Dependabot on GitHub Actions runners](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/about-dependabot-on-github-actions-runners)
|
|
|
|
#### `dependabot-core`
|
|
|
|
If you want to customize Dependabot, or self-host on another platform, you can use [`dependabot-core`](https://github.com/dependabot/dependabot-core).
|
|
Quote from the `dependabot-core` readme:
|
|
|
|
> It [`dependabot-core`] currently supports opening Pull Requests against repositories hosted on GitHub, Github Enterprise, Azure DevOps, GitLab, BitBucket, and AWS CodeCommit.
|
|
|
|
#### `dependabot-script`
|
|
|
|
The Dependabot team has a community-maintained collection of scripts to start self-hosting Dependabot: [`dependabot-script`](https://github.com/dependabot/dependabot-script) but the repository has included a message warning that the scripts are broken since March 2023.
|
|
|
|
#### `dependabot-gitlab/dependabot`
|
|
|
|
There's also a community-maintained Dependabot for GitLab: [`dependabot-gitlab/dependabot`](https://gitlab.com/dependabot-gitlab/dependabot).
|