Support for Gradle Multi-Module Conventions/Pre-Compiled Script Plugins

[mgagliardo91]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

gradle (Kotlin)

Package manager version

Gradle 8.2.1

Language version

Kotlin 1.8.20

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: gradle
    directory: /
    target-branch: staging
    schedule:
      interval: weekly
    labels:
      - automerge

Updated dependency

No response

What you expected to see, versus what you actually saw

We have a multi-module gradle project using Kotlin Gradle (.kts). Each module is an independent deployable, but we ensure uniformity by leaning on Gradle convention plugins as a way to control dependencies as well as other plugin configuration.

Example Directory Structure:

• buildSrc/
  • build.gradle.kts
  • src/main/kotlin/
    • com.test.common-conventions.gradle.kts
• moduleA/
  • build.gradle.kts
• moduleB/
  • build.gradle.kts
• build.gradle.kts
• settings.gradle.kts

buildSrc/**/com.test.common-conventions.gradle.kts:

plugins {
    kotlin("jvm")
    idea
}

repositories {
    ...
}

dependencies {
    constraints {
        implementation("io.github.microutils:kotlin-logging-jvm:3.0.5")
        ...
    }
}

moduleA/build.gradle.kts

plugins {
    id("com.test.common-conventions")
}


dependencies {
    implementation("io.github.microutils:kotlin-logging-jvm")
}
...

This official pattern allows us to maintain the versions in one spot, while allowing our modules to be selective about the dependencies they want to include, though sharing the dependency with other modules that need the same.

• Gradle Multi-Module Project Setup
• Pre-compiled Scripts

Dependabot does not, unfortunately, pick up this pattern and instead only updates dependencies in our **/*/build.gradle.kts files which rarely have versions in them due to this pattern. I've tried to name our convention files to include dependencies to see if that would trip it, but I'm not seeing it being recognized.

Any chance we can get this included so we can benefit from dependabot?

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response