Skip to content

feat: support automerge of npm_and_yarn group PRs#659

Closed
toomuchdesign wants to merge 1 commit intofastify:mainfrom
toomuchdesign:bump-the-npm_and_yarn-group-support
Closed

feat: support automerge of npm_and_yarn group PRs#659
toomuchdesign wants to merge 1 commit intofastify:mainfrom
toomuchdesign:bump-the-npm_and_yarn-group-support

Conversation

@toomuchdesign
Copy link
Contributor

@toomuchdesign toomuchdesign commented Oct 16, 2024

Feature Proposal

Dependabot seems to open a special kind of PR (npm_and_yarn group) which this action doesn't merge because of the lack of an explicit semver bump value:

Semver bump '' is invalid!

"npm_and_yarn group" PR metadata example:

 outputs.dependency-names: cookie, light-my-request
 outputs.dependency-type: indirect
 outputs.update-type: null
 outputs.directory: /
 outputs.package-ecosystem: npm_and_yarn
 outputs.target-branch: master
 outputs.previous-version: 
 outputs.new-version: 
 outputs.compatibility-score: 0
 outputs.maintainer-changes: true
 outputs.dependency-group: npm_and_yarn
 outputs.alert-state: 
 outputs.ghsa-id: 
 outputs.cvss: 0

Motivation

The goal of this PR is recognise such PRs so that they can be merged automatically.

Extra information

I decided to detect by default npm_and_yarn group PRs using dependency-group metadata prop.

Another approach could consist of exposing an option to whitelist specific PRs by metadata. The API of such option should be carefully designed, though.

Happy to review the detection logic in case it's too loose.

Checklist

@github-actions
Copy link

github-actions bot commented Oct 16, 2024

No linked issues found. Please add the corresponding issues in the pull request description.
Use GitHub automation to close the issue when a PR is merged

@simoneb
Copy link
Collaborator

simoneb commented Oct 16, 2024

Thanks for the PR. I'm not entirely sure how the logic would work though. The PR is handling an "update group" gracefully now, but we are missing a fundamental piece of information which is the "update type" in any case. So, even if we handle this type of grouped update gracefully, how can we apply the logic whereby we only merge certain semver version bumps, if that information is missing? Maybe I'm missing something

@toomuchdesign
Copy link
Contributor Author

toomuchdesign commented Oct 17, 2024

You're right.
I initially assumed the missing update-type was expected within a "dependency-type: indirect" PR, but it's not the case. It is actually a long standing Dependabot issue.

I'm closing this PR and opening a new one proposing a new target- option to specifically handle indirect dependency type PRs.

Thank you Simone.

@toomuchdesign toomuchdesign mentioned this pull request Oct 17, 2024
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@toomuchdesign @simoneb