Merge branch 'main' into npm_and_yarn/engines_field_for_package_manager_with_caret_and_major_version

Author: markhallen

README.md

@@ -52,18 +52,18 @@ started.
 
 >**Note:** If you're looking to run Dependabot locally for development/debugging purposes, see the [Development Guide](#development-guide).
 
-## Dependabot-Script
+## Dependabot CLI
 
-The [dependabot-script](https://github.com/dependabot/dependabot-script) repo provides a collection of example scripts for configuring the Dependabot-Core library.
-It is intended as a starting point for advanced users to run a self-hosted version of Dependabot within their own projects.
+The open-source [Dependabot CLI](https://github.com/dependabot/cli) is our recommended entrypoint for standalone use cases.
 
->**Note:** We recently refactored the monolithic docker image used within the Dependabot Core library into one-image-per-ecosystem. Unfortunately, that broke dependabot-scripts, and we haven't had time to update them yet. We are aware of the problem and hope to provide a solution soon.
+We use it in production here at GitHub, and advanced users can also leverage it to run a self-hosted version of Dependabot within their own projects / CI systems.
 
-## Dependabot CLI
+It creates dependency diffs but does not create PRs. So you will need to wire that up yourself.
+To aid with that, we created the [example-cli-usage](https://github.com/dependabot/example-cli-usage) repo which demonstrates how to turn those diffs into actual PR's.
+
+## Write your own Ruby-based tool
 
-The [Dependabot CLI](https://github.com/dependabot/cli) is a newer tool that may eventually replace [`dependabot-script`](#dependabot-script) for standalone use cases.
-While it creates dependency diffs, it's currently missing the logic to turn those diffs into actual PRs. Nevertheless, it
-may be useful for advanced users looking for examples of how to hack on Dependabot.
+Alternatively, because Dependabot-Core is a Ruby library, you can write your own ruby-based wrapper that leverages the Dependabot-core code. The tricky bit is Dependabot assumes it's running in an isolated, throw-away environment so you'll need to handle all that yourself. For example protecting against security risks of arbitrary code execution exfiltrating credentials, ensuring the appropriate version of Go or Python or whatever language you need is available, and handling when Dependabot makes changes to its runtime environment.
 
 ## Dependabot on CI
 

composer/Dockerfile

@@ -3,13 +3,15 @@ FROM ghcr.io/dependabot/dependabot-updater-core
 ARG COMPOSER_V2_VERSION=2.8.10
 ARG PHP_VERSION=8.4
 ENV COMPOSER_ALLOW_SUPERUSER=1
-RUN apt-get update \
-  && apt-get upgrade -y \
-  && apt-get install -y --no-install-recommends \
-    software-properties-common
-RUN add-apt-repository ppa:ondrej/php \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends \
+RUN <<EOF
+  apt-get update
+  apt-get upgrade -y
+  apt-get install -y --no-install-recommends software-properties-common
+
+  # Install PHP and its packages
+  add-apt-repository ppa:ondrej/php
+  apt-get update
+  apt-get install -y --no-install-recommends \
     php${PHP_VERSION} \
     php${PHP_VERSION}-apcu \
     php${PHP_VERSION}-bcmath \
@@ -34,10 +36,12 @@ RUN add-apt-repository ppa:ondrej/php \
     php${PHP_VERSION}-xml \
     php${PHP_VERSION}-zip \
     php${PHP_VERSION}-zmq \
-    php${PHP_VERSION}-mcrypt \
-  && rm -rf /var/lib/apt/lists/*
+    php${PHP_VERSION}-mcrypt
+  rm -rf /var/lib/apt/lists/*
 
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer --version=${COMPOSER_V2_VERSION}
+  # Install Composer
+  curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer --version=${COMPOSER_V2_VERSION}
+EOF
 
 USER dependabot
 # Perform a fake `composer update` to warm ~/dependabot/.cache/composer/repo

conda/lib/dependabot/conda/file_fetcher.rb

@@ -31,13 +31,6 @@ def self.required_files_message
 
       sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
-        unless allow_beta_ecosystems?
-          raise Dependabot::DependencyFileNotFound.new(
-            nil,
-            "Conda support is currently in beta. Set ALLOW_BETA_ECOSYSTEMS=true to enable it."
-          )
-        end
-
         fetched_files = []
 
         # Try to fetch environment.yml first, then environment.yaml