Added e2e nuget example for Azure DevOps

[matthewalltop]

Added a working example for using Dependabot CLI with Azure Devops Pipelines.

• Config file examples for nuget, npm_and_yarn, and pip.
• Example Azure Pipelines .yaml
• create-pull-requests.sh script - AzDo adaptation of the create.sh script in this repo.

Feel free to propose changes or adjust directly!

[brettfo]

Hi @matthewalltop, this PR just came across my radar. As I understand it, the example pipeline will download and run the CLI, publish the result file as an artifact, and a separate stage will extract the result contents and create a PR? If so, I only have once piece of feedback around detecting if the content is base64 encoded. The script checks for only base64-encoded characters and verifies the length, but each item under updated-dependency-files might have a content-encoding property. If this is missing it's assumed to be utf-8 but if it's explicitly base64 then you can trust that. It might make the detection a little cleaner, but ultimately I don't have strong feelings either way.

[matthewalltop]

Hi @matthewalltop, this PR just came across my radar. As I understand it, the example pipeline will download and run the CLI, publish the result file as an artifact, and a separate stage will extract the result contents and create a PR? If so, I only have once piece of feedback around detecting if the content is base64 encoded. The script checks for only base64-encoded characters and verifies the length, but each item under updated-dependency-files might have a content-encoding property. If this is missing it's assumed to be utf-8 but if it's explicitly base64 then you can trust that. It might make the detection a little cleaner, but ultimately I don't have strong feelings either way.

@brettfo Just wanted to acknowledge the comment since this PR has been out here for a while now.

I need to fully revisit this, as there have been a handful of lessons learned running this in our Azure DevOps organization over the past year.

Will follow up with those elements + the content-encoding update in short order.

[matthewalltop]

@brettfo - I have updated stale files.

Conditional Base 64 string handling has been addressed in the create-pull-requests.sh script and I did some clean up both there and on the AzDo pipeline yaml.

New config files for npm_and_yarn + pip were also added and I marked up the existing nuget config file to provide some clarity on the individual settings.