dependency-management-data-example

dependency-management-data-example

An example of the data that can be used alongside the tools from dmd.tanna.dev (DMD).

The web application can be found hosted on fly.io, using DMD's web application.

There are also some examples on the dependency-management-data website that you can browse without needing to download anything or look through the codebase.

Using this data

First, install the dmd command-line tool, then check out this repository and run:

dmd db init --db dmd.db
# notice the quoting around the argument, to avoid shell globbing
dmd import renovate --db dmd.db 'renovate/*.json'
dmd import dependabot --db dmd.db 'dependabot/*.json'

Then, you can open SQLite to query it:

sqlite3 dmd.db

For instance:

.mode column
select count(package_manager), package_manager from dependabot group by package_manager order by count(package_manager) DESC;
select count(package_manager), package_manager from renovate group by package_manager order by count(package_manager) DESC;
select organisation, repo from renovate where package_name like '%testify%';

An example of the SQLite database can be found attached on the releases page on GitLab.com.

This data is continually updated and a database is generated by GitLab CI and attached as an artifact to the job.

To get access to the latest database, you can install a helper CLI:

go install gitlab.com/tanna.dev/dependency-management-data-example/cmd/dmd-example@HEAD

And then run:

$ dmd-example download
Successfully downloaded `dmd.db` (from the last run at dmd.db) to `2023-04-20 09:42:37.498 +0000 UTC`
$ ls dmd.db
dmd.db
$ dmd-example shell
# SQLite version 3.39.5 2022-10-14 20:58:05
# Enter ".help" for usage hints.
# sqlite>

How has this repo been seeded?

Check out the .gitlab-ci.yml for more information about exactly how we do it but we, on a schedule:

• list a set of public repos across GitLab
• list a set of public repos across GitHub
• run renovate-graph against those repos
• commit the files back to the repo

Then, on the push back to the repo, a new pipeline runs which:

• uses the dmd CLI to create a new database
• imports all renovate-graph data
• imports all dependabot-graph data