zT-1337
ddc46220b9
* - Added Renovate support for the [SCM-Manager](https://scm-manager.org/) - SCM-Manager is a repository management tool like GitHub - It is maintained as an open source project by the company [Cloudogu](https://cloudogu.com/en/) - The SCM-Manager support is not feature complete yet, features like auto merging are still missing - The SCM-Manager also got added to the documentation as another platform author Thomas Zerr <thomas.zerr@cloudogu.com> 1690877165 +0200 committer Eduard Heimbuch <eduard.heimbuch@cloudogu.com> 1706264263 +0100 * Reverted numbering change in markdown docs * Changed from type to interface, if possible * Removed axios dependency and using the http layer of renovate instead * Fixed not using scmm specific mime types for accept header * Use git from test/util instead * Add dummy tests for no ops * Fix some phrasing and spelling issues * Change scmm to scm-manager and fix SCM-Manager specific content type * Add supported major versions, review plugin requirement, write permissions is needed * Change using actual host rules instead of mocking it * Change use http mocks for testing * Update docs/usage/getting-started/running.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/index.ts Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/mapper.spec.ts Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update lib/modules/platform/scm-manager/readme.md Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix scm-manager docs link * Fix linting * Fix linting * Throw errors if username or token is not provided by the host rules * Replace NO-OP with Not implemented * Remove objects from log messages * Fix linting * Fix path to platform config options * Fix link to self-host-configuration docs * Fix link to self-host-configuration docs * Remove the link to the platform config option, because the tests keep failing * Fix link to self-host-configuration docs * Remove not needed type cast Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Fix type check of protocol links * Move scm-manager into util http folder * Apply linting * Add maxBodyLength function and its test * Add test case if protocol links are not an array of links * Use zod schema for pagination * Apply linting * Refactor typing with zod schema * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix test description Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Update readme Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Add try catch around fetching the current user * Switch log statement from info to debug Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from debug to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Switch log statement from info to trace Co-authored-by: Michael Kriese <michael.kriese@visualon.de> * Fix linting errors * Remove credentials check in initRepo * Fix imports * Fix zod schema for repositories * Fix zod schema for pull requests * Fix 500 error after attempting to update an pr * Fix wrong typing * Refactor parameterized tests for better readability * Refactor SCM HTTP API * Add setToken functionality * Remove not needed type definition Co-authored-by: Michael Kriese <michael.kriese@gmx.de> * Fix assertion * Fix istanbul comment * Change log statement * Remove type rename * Move inferred types close to corresponding schemas * Add platform is experimental * Remove type renaming * Fix type imports * Fix test suite description * Remove debug log statement Co-authored-by: Michael Kriese <michael.kriese@gmx.de> * Fix warning * Fix paremeterized unit tests with string templates * Fix spelling Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> * Fix eslint error * Convert trace logs to debug logs * Convert info logs to debug * Replace manual null and undefinded check with is util * Rephrase instruction in readme * Use ensureTrailingSlash instead * Fix linting * Keep type and schema together * Simplify hasAssignees check * Simplify reviewer mapping * Remove istanbul comments * Replace custom scmm header option with renovate native http headers option * Let the token be passed in initPlatform * Add description which permissions are needed * Add support for ignorePrAuthor filter * Add notes about automerge feature within platform readme * Add support for fast_forward_only * Change supported versions due to merge strategy change * Remove commented code * Fix import * Use email schema * Heed review advice * Fix import and empty array assertions * Fix linting issue * Fix import errors * Fix removed ignorePrAuthor parameter from initRepo function * Fix failing unit tests by setting/reseting the global config * Mark scm-manager as experimental * Fix zod import path * Change endpoint configuration, so that user only needs to define origin, but not also the path * Fix warning of redundant backslash --------- Co-authored-by: Eduard Heimbuch <eduard.heimbuch@cloudogu.com> Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com> Co-authored-by: Michael Kriese <michael.kriese@visualon.de> Co-authored-by: René Pfeuffer <rene@pfeuffer-web.de> Co-authored-by: Michael Kriese <michael.kriese@gmx.de> Co-authored-by: René Pfeuffer <rene.pfeuffer@cloudogu.com>
15 KiB
Bot comparison
This page explains the key differences between Renovate and Dependabot, to help you choose a bot. We're trying to be as objective as possible, so this is not a "versus" or anti-Dependabot page.
If you see anything wrong on this page, please let us know by creating a Discussion, or edit this page with a PR.
Table of features
| Feature | Renovate | Dependabot |
|---|---|---|
| Dependency Dashboard | Yes | No |
| Grouped updates | Yes, use community-provided groups, or create your own | Yes, create groups manually or handled automatically by dependabot |
| Upgrades common monorepo packages at once | Yes | Yes |
| Officially supported platforms | Azure, Bitbucket, Forgejo, Gitea, GitHub, GitLab, SCM-Manager, see full list | GitHub and Azure DevOps |
| Supported languages | List for Renovate | List for Dependabot |
| Show changelogs | Yes | Yes |
| Compatibility score badges | Four badges showing: Age, Adoption, Passing, Confidence | One badge with overall compatibility score |
| Built-in to GitHub | No, requires app or self-hosting | Yes |
| Scheduling | By default, Renovate runs as often as it is allowed to, read Renovate scheduling to learn more | Yes: daily, weekly, monthly, quarterly, semiannually, yearly or cron |
| License | GNU Affero General Public License | MIT License |
| Programming language of project | TypeScript | Ruby |
| Project pulse | renovatebot/renovate pulse |
dependabot-core pulse |
| Contributor graph | renovatebot/renovate contributor graph |
dependabot-core contributor graph |
Hosted app
This section explains the key differences between the Mend Renovate app and the GitHub-native Dependabot.
Even if you're going to self-host a bot, read the hosted app section first, because many features and concepts are similar. Then read the self-hosted section.
Dependency Dashboard
One big feature of Renovate is the Dependency Dashboard, which is enabled by default. Read the Key concepts, Dependency Dashboard page to learn more.
Dependabot does not have a similar feature.
Grouped updates
Renovate comes with community-provided groupings of dependencies. So Renovate groups common dependencies into a single PR, out-of-the-box.
Dependabot can group dependencies into a single PR too, but you must set your own groups first.
Upgrades common monorepo packages at once
Renovate has a group:monorepos preset, that upgrades common monorepo packages in a single PR.
Dependabot does not update common monorepo packages in a single PR.
Supported platforms
Platform means the Git-hosting site or program, for example GitHub, GitLab or Azure.
Renovate works on multiple platforms, including GitHub. Read the list of Renovate platforms to learn more.
The official Dependabot program only works on GitHub.
If you're an advanced user, you may use the dependabot-core repository as a base to build your own Dependabot, which you can run on other platforms.
Supported languages
Show changelogs
| Feature | Renovate | Dependabot |
|---|---|---|
| Link to GitHub release | Yes, to specific release tag | Yes, to "releases landing page" |
| Link to GitHub's comparing changes UI | Yes | Yes |
| Release notes | Yes | Yes |
| Links to issues | Yes | Yes |
Upstream CHANGELOG file |
No | Yes |
| Recent commits | No | Yes |
| Link to individual commits | No | Yes |
Compatibility score badges
Renovate shows four Merge Confidence badges in its PRs:
- Age: The age of the package
- Adoption: The percentage of this package's users (within Renovate) which are using this release
- Passing: The percentage of updates which have passing tests for this package
- Confidence: The confidence level for this update
Read the Merge Confidence badges page to learn more.
Dependabot shows one compatibility score badge in its PRs. This score tells you how many other repositories have passing CI tests for the proposed update. Read the GitHub Docs, Dependabot's compatibility scores to learn more about Dependabot's badge.
Built-in to GitHub vs app
Renovate needs app installation or self-hosting.
Dependabot is built-in to GitHub.
Scheduling
You can set a schedule for Renovate, per dependency, manager, or even a global schedule. Read Renovate scheduling to learn more.
Dependabot has four options that apply at a language level:
License
Renovate uses the GNU Affero General Public License.
Dependabot uses the MIT License.
Neither license is relevant to the end user though if consuming through an App/SaaS.
Programming language of project
Renovate uses TypeScript.
dependabot-core uses Ruby.
Self-hosting a bot
This section explains how to self-host each bot.
Self-hosting Renovate
You can self-host Renovate on all officially supported platforms.
If you decide to self-host Renovate, read the items from the Self-hosting Renovate reading list.
Available Renovate distributions:
- npm package (CLI)
- Docker images
- GitHub Action
- GitLab Runner
- Mend Renovate On-Premises
- Mend Remediate (commercial offering)
- Forking Renovate app
Self-hosting Dependabot
You can self-host Dependabot on other platforms than GitHub but none are officially supported.
As a GitHub Actions workflow on GitHub
You can run Dependabot as a GitHub Actions workflow on hosted and self-hosted runners. Learn more by reading the:
- GitHub Blog, Dependabot on GitHub Actions and self-hosted runners is now generally available
- GitHub Docs, About Dependabot on GitHub Actions runners
dependabot-core
If you want to customize Dependabot, or self-host on another platform, you can use dependabot-core.
Quote from the dependabot-core readme:
It [
dependabot-core] currently supports opening Pull Requests against repositories hosted on GitHub, Github Enterprise, Azure DevOps, GitLab, BitBucket, and AWS CodeCommit.
dependabot-script
The Dependabot team has a community-maintained collection of scripts to start self-hosting Dependabot: dependabot-script but the repository has included a message warning that the scripts are broken since March 2023.
dependabot-gitlab/dependabot
There's also a community-maintained Dependabot for GitLab: dependabot-gitlab/dependabot.