Skip to content

Handle dependency updates without an update-type #644

@timbru31

Description

@timbru31

Prerequisites

  • I have written a descriptive issue title
  • I have searched existing issues to ensure the issue has not already been raised

Issue

We are using the action @v3.10.1 but see a lot of PRs that are in semver range but those are sadly not merged because (somehow) Dependabot's metadata is outputting update-type: null.

I am not 100% if this is a broader Dependabot related issue or if this action could enhance it's behavior.
Interestingly it only affects PRs that Updates the requirements on xx to permit the latest version.
(see screenshot attached)

Screenshot 2024-09-02 at 12 35 33

Here is the update from the log:

Run fastify/github-action-merge-dependabot@v3.10.1
Run dependabot/fetch-metadata@v1
Parsing Dependabot metadata
Outputting metadata for 1 updated dependency
  outputs.dependency-names: lint-staged
  outputs.dependency-type: direct:development
  outputs.update-type: null
  outputs.directory: /maintenance
  outputs.package-ecosystem: npm_and_yarn
  outputs.target-branch: main
  outputs.previous-version: 
  outputs.new-version: 
  outputs.compatibility-score: 0
  outputs.maintainer-changes: false
  outputs.dependency-group: 
  outputs.alert-state: 
  outputs.ghsa-id: 
  outputs.cvss: 0

The PR is from a private repo, hence I can't link to it.

Cross ref to dependabot/fetch-metadata#499 & dependabot/fetch-metadata#339
As this is open for 1 1/2 years maybe you can have a fallback method which tries to parse the semver information from e.g. the commit message or PR title, too, in case the update-type is null.

If you believe this is outside of this action's scope that is also fine.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions