Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

GitHub actions

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

https://github.com/microsoft/TypeScript/blob/main/.github/workflows/nightly.yaml

dependabot.yml content

https://github.com/microsoft/TypeScript/blob/main/.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: 'github-actions'
    directory: '/'
    schedule:
      interval: 'weekly'
    groups:
      github-actions:
        patterns:
          - '*'

Updated dependency

From:

actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0

To:

actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1

What you expected to see, versus what you actually saw

When dependabot updates the yaml file, it should use the line endings already used in the file. However, it appears to always use LF line endings on the lines it modifies. This leads to mixed line ending files, which is bad. In the TypeScript repo, this manifests as a CI failure due to the file not being formatted.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

microsoft/TypeScript#56870 is an example of a failing PR.

microsoft/TypeScript@d9cabbf (#56870) is the commit, but doesn't show the difference.

Locally, I can run a script which splits the lines on just \n. On main, the lines changed for one of these files looks like:

  '    steps:\r',
  '      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1\r',
  '      - uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0\r',
  '        with:\r',
  '          # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry.\r',
  '          registry-url: https://registry.npmjs.org/\r',

But after:

  '    steps:\r',
  '      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1\r',
  '      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1',
  '        with:\r',
  '          # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry.\r',
  '          registry-url: https://registry.npmjs.org/\r',

Note the missing \r on the updated line.

A workaround is to not use CRLF

Smallest manifest that reproduces the issue

No response