-
Notifications
You must be signed in to change notification settings - Fork 40
Description
Prerequisites
- I have written a descriptive issue title
- I have searched existing issues to ensure the issue has not already been raised
Issue
We are using the action @v3.10.1 but see a lot of PRs that are in semver range but those are sadly not merged because (somehow) Dependabot's metadata is outputting update-type: null.
I am not 100% if this is a broader Dependabot related issue or if this action could enhance it's behavior.
Interestingly it only affects PRs that Updates the requirements on xx to permit the latest version.
(see screenshot attached)
Here is the update from the log:
Run fastify/github-action-merge-dependabot@v3.10.1
Run dependabot/fetch-metadata@v1
Parsing Dependabot metadata
Outputting metadata for 1 updated dependency
outputs.dependency-names: lint-staged
outputs.dependency-type: direct:development
outputs.update-type: null
outputs.directory: /maintenance
outputs.package-ecosystem: npm_and_yarn
outputs.target-branch: main
outputs.previous-version:
outputs.new-version:
outputs.compatibility-score: 0
outputs.maintainer-changes: false
outputs.dependency-group:
outputs.alert-state:
outputs.ghsa-id:
outputs.cvss: 0
The PR is from a private repo, hence I can't link to it.
Cross ref to dependabot/fetch-metadata#499 & dependabot/fetch-metadata#339
As this is open for 1 1/2 years maybe you can have a fallback method which tries to parse the semver information from e.g. the commit message or PR title, too, in case the update-type is null.
If you believe this is outside of this action's scope that is also fine.