-
Notifications
You must be signed in to change notification settings - Fork 35
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Major version update is auto-merged with target set to minor #452
Comments
I am taking a look on this. |
Could @haoliangyu share the PR's title? The PR updates 2 dependancies: the |
We're already looking into this @Eomm and we're confident the issue is exactly that. It's an edge case with 2 deps bumped together, one of which is minor and the other major. |
The PR title is |
We're not using the PR title any longer @Eomm , we're using the native fetch-metadata action. |
@haoliangyu I am not able to reproduce this issue. I tried using this snippet:
But I got 2 different PRs from Dependabot: Can you confirm this is still happening? If so, can you share a reproducible snippet for it? |
@jhonrocha See haoliangyu/dependabot-minor-version-update-demo#1 It only install the
and |
@haoliangyu Thanks for that! I just tried it and I see the single PR with 2 updates from Dependabot as well.
Here is a link to the action: https://github.com/jhonrocha/test-dependabot/actions/runs/5744423046/job/15570672528 |
@jhonrocha Please review this auto-merged PR haoliangyu/dependabot-minor-version-update-demo#1 again. The workflow configuration is the same as your test repository. However, your |
I am sure it is the problem on For advice, we can add empty inside the propriety list to see if it helps. github-action-merge-dependabot/src/mapUpdateType.js Lines 11 to 16 in 645c6a2
@haoliangyu In order to helps troubleshoot more easily, can you add |
@climba03003 This is the raw log of the workflow run, which contains the
You can see that the For reference, this is the full raw log.
|
Thanks, this is exactly the problem.
|
Thanks for identifying the source. I think this should be the problematic part of this repo. github-action-merge-dependabot/src/action.js Lines 87 to 96 in 645c6a2
Because the This is the related issue at the upstream dependabot/fetch-metadata#339. |
What if we invert the order? Check it here #462 . |
We have fixed handling the invalid |
🎉 This issue has been resolved in version 3.9.1 🎉 The release is available on: Your optic bot 📦🚀 |
Prerequisites
Fastify version
3.x.x
Plugin version
No response
Node.js version
18.x
Operating system
Linux
Operating system version (i.e. 20.04, 11.3, 10)
20
Description
This is similar but not identical to the existing issue #166. I am using the v3 action in my project workflow and the target is set to
minor
.I notice that dependabot is able to create a PR with a minor update for a dependency and a major update for its ancestor dependency, like
It is expected that this action would ignore this PR because of the major bump. However, as the screenshot shows, the action actually merges the PR automatically. I wonder if it is an edge case for the action.
Steps to Reproduce
This is from a private repository so I cannot share the PR but code snippet. It is a nodejs (v18) application using the nestjs (v8) framework.
Here is the workflow configuration I am using
and the PR tends to change the
package.json
, which is not desiredHere is the raw log of the action execution.
Expected Behavior
No response
The text was updated successfully, but these errors were encountered: