platformio/platformio-core

GitHub dependency graph for lib_deps

Open

#4,184 opened on Feb 16, 2022

View on GitHub
 (4 comments) (4 reactions) (0 assignees)Python (791 forks)batch import
help wantedintegration

Repository metrics

Stars
 (7,329 stars)
PR merge metrics
 (Avg merge 109d 16h) (5 merged PRs in 30d)

Description

Configuration

Operating system: Win10

PlatformIO Version (platformio --version): 5.2.5

Description of problem

There appears to be no current support for GitHub dependency graph and Dependabot alerts. Supporting GitHub dependency graph would be great for security updates in addition to the dependency graph it adds.

Steps to Reproduce

  1. Create new PlatformIO project via "New Project" button (configure name, board, framework, location)
  2. Open the "Libraries" tab find and select a library to install (for example: esp32-camera)
  3. Click "Add to Project" button
  4. Select the project that the dependency should be added to (seems like this should only be the current project)
  5. Click the "Add" button
  6. Push project to GitHub

Actual Results

Dependency is installed in /.pio/libdeps and added to lib_deps in /platformio.ini file which GitHub doesn't support for package management:

[env:esp32dev]
platform = espressif32
board = esp32dev
framework = arduino
lib_deps = espressif/esp32-camera@^2.0.0

Expected Results

Dependency is configured in a way compatible with GitHub's dependency graph.

Additional info

Community suggestion by @nicolas-rabault https://community.platformio.org/t/make-platformio-work-with-github-dependencies-graph/12965

Contributor guide

Research direction
Investigate how to generate a dependency manifest file that GitHub can parse (e.g., a JSON or YAML file) from the platformio.ini lib deps, possibly using a GitHub Action or a conversion script.
Tech stack
python
Domain
build system
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PythonGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60