Dependabot / security scanning

[indigoviolet]

What is the best way to work with Dependabot etc while using rye?

[evanbernstein]

I have this same question. It seems to work just fine for non-dev packages, but it does not seem to work the dev dependencies.

dev-dependencies = [...```

Am I missing something or is this a missing feature of Rye or Dependabot?

[wakabame]

As a workaround, I have set up the following in .pre-commit-config.yaml:

repos:
    - repo: local
      hooks:
      - id: update requirements.txt for dependabot
        name: update requirements.txt for dependabot
        entry: bash -c 'sed -e "/^-e/d" -e "s/setuptools/# setuptools/" requirements.lock > .github/dependabot/requirements.txt'
        language: system
    - repo: local
      hooks:
      - id: update requirements-dev.txt for dependabot
        name: update requirements-dev.txt for dependabot
        entry: bash -c 'sed -e "/^-e/d" -e "s/setuptools/# setuptools/" requirements-dev.lock > .github/dependabot/requirements-dev.txt'
        language: system

Running an equivalent shell script from GitHub Actions could also be a good idea!