Description

I am using the dependabot/fetch-metadata action (v1.3.6) in my workflow to handle Dependabot pull requests. However, I am encountering an issue where the update-type output is returning null, even though the pull request is created by Dependabot.

Repository Configuration

Here's the dependabot.yml configuration for the repository:

version: 2

updates:
  - package-ecosystem: pip
    directory: /dependabot/
    schedule:
      interval: "weekly"
      day: "sunday"
    commit-message:
      prefix: "build: "
      prefix-development: "build: "
      include: "scope"
    rebase-strategy: "auto"
    target-branch: "develop"
    labels:
      - "build"
      - "dependencies"
    versioning-strategy: auto
    allow:
      - dependency-type: "all"
    open-pull-requests-limit: 10

The pyproject.toml file is located in the /dependabot/ directory, which is specified in the dependabot.yml configuration

Workflow Configuration

The following is the configuration for the workflow that uses the dependabot/fetch-metadata action:

on:
  pull_request_target:
    types:
      - opened
      - synchronize
permissions:
    pull-requests: write
    contents: write
jobs:
  review-dependabot-pr:
    runs-on: ubuntu-latest
    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
    outputs:
      approved: ${{ steps.set-output.outputs.approved }}
    steps:

        # ... (other steps)

        - name: 📛 Dependabot metadata
            id: dependabot-metadata
            uses: dependabot/fetch-metadata@v1.3.6 # https://github.com/dependabot/fetch-metadata
            with:
                github-token: "${{ steps.generate_token.outputs.token }}"

        # ... (subsequent steps using the outputs)

Issue Details

When the workflow runs for a pull request created by Dependabot, the action returns a null update-type output, which causes issues in the subsequent steps that rely on this output.

Here's an example of the outputs returned by the dependabot/fetch-metadata action:

##[group]Run dependabot/fetch-metadata@v1.3.6
with:
  github-token: ***
  skip-commit-verification: false
##[endgroup]
Parsing Dependabot metadata
##[group]Outputting metadata for 1 updated dependency
outputs.dependency-names: pytest
outputs.dependency-type: direct:development
outputs.update-type: null
outputs.directory: /dependabot/develop
outputs.package-ecosystem: pip
outputs.target-branch: develop
outputs.previous-version: 
outputs.new-version: 
outputs.compatibility-score: 0
outputs.alert-state: 
outputs.ghsa-id: 
outputs.cvss: 0
##[endgroup]

The issue persists even after verifying that the pull request is created by Dependabot and that the workflow is triggered by the correct event (pull_request_target with opened and synchronize types).

Request for Assistance

I would appreciate any help in diagnosing and resolving this issue. If there's any additional information or logs that would be useful, please let me know, and I will provide them.