dependabot / dependabot/dependabot-core
Python multi-dir update results in duplicate PRs
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Python - pip and pip-compile
### What you expected to see, versus what you actually saw
Reproducible with the following input file:
```yml
job:
allowed-updates:
- dependency-type: direct
update-type: all
package-manager: pip
source:
provider: github
repo: opentracing-contrib/nginx-opentracing
commit: 69dd153598307375363650ea301c92cb59d997f3
api-endpoint: https://api.github.com/
hostname: github.com
directories:
- "/**/*"
```
Run with the Dependabot CLI: `dependabot update -f input.yml`
The issue seems to be caused by the FileFetcher's behavior in the Python ecosystem of searching subdirectories for requirements files:
https://github.com/dependabot/dependabot-core/blob/4420d677450d0e685c6b2f49aed16a3b14aec788/python/lib/dependabot/python/file_fetcher.rb#L243-L257
This results in the same requirements file appearing twice, thus it puts up 2 PRs.
We'll need to analyze why this behavior exists and maybe remove it. Ideally Dependabot would only process the directory it was given.
Contributor guide
Research direction
Reproduce the issue with the provided input.yml using `dependabot update -f input.yml`. Start in python/lib/dependabot/python/file_fetcher.rb at lines 243-257 and inspect why subdirectory searching returns the same requirements file twice. Done means the repository configuration produces one PR rather than duplicate PRs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100