dependabot / dependabot/dependabot-core

Manually trigger multi-ecosystem update

Open
#12,948 3 comments 3 reactions 0 assignees View on GitHub
T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

We're testing [multi-ecosystem updates](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates) to raise a single PR for all our web application dependencies (both front and backend) in one go, e.g.

```yaml
version: 2

multi-ecosystem-groups:
all-dependencies:
schedule:
interval: "weekly"
day: "sunday"

updates:
- package-ecosystem: "bundler"
directory: "/"
multi-ecosystem-group: "all-dependencies"
patterns: ["*"]

- package-ecosystem: "npm"
directory: "/"
multi-ecosystem-group: "all-dependencies"
patterns: ["*"]
```

However, it doesn't seem possible to manually trigger Dependabot to raise a PR for this repository either by using the "Check for updates" button on each package ecosystem within the "Dependabot" tab of the "Dependency Graph" section of "Insights", or by pushing a change to the `.github/dependabot.yml` configuration file.

Both of these actions will trigger the appropriate "Dependabot Updates" GitHub Actions workflow but they don't seem to result in a PR being created. Looking at the logs, I can see that `multi-ecosystem-update` is set to `false` in the job definition, e.g.

```yaml
{
"job": {
"allowed-updates": [
{
"dependency-type": "direct",
"update-type": "all"
}
],
"commit-message-options": {
"prefix": null,
"prefix-development": null,
"include-scope": null
},
"credentials-metadata": [
{
"type": "git_source",
"host": "github.com"
},
{
"type": "rubygems_server",
"host": "rubygems.pkg.github.com"
}
],
"debug": null,
"dependencies": null,
"dependency-groups": [
{
"name": "all-dependencies",
"rules": {
"patterns": [
"*"
]
}
}
],
"dependency-group-to-refresh": null,
"existing-pull-requests": [],
"existing-group-pull-requests": [],
"experiments": {
"record-ecosystem-versions": true,
"record-update-job-unknown-error": true,
"proxy-cached": true,
"move-job-token": true,
"dependency-change-validation": true,
"enable-file-parser-python-local": true,
"npm-fallback-version-above-v6": true,
"lead-security-dependency": true,
"enable-record-ecosystem-meta": true,
"enable-corepack-for-npm-and-yarn": true,
"enable-shared-helpers-command-timeout": true,
"enable-dependabot-setting-up-cronjob": true,
"enable-engine-version-detection": true,
"avoid-duplicate-updates-package-json": true,
"allow-refresh-for-existing-pr-dependencies": true,
"allow-refresh-group-with-all-dependencies": true,
"exclude-local-composer-packages": true,
"enable-enhanced-error-details-for-updater": true,
"enable-cooldown-for-python": true,
"enable-cooldown-for-uv": true,
"enable-cooldown-for-npm-and-yarn": true,
"enable-cooldown-for-nuget": true,
"enable-cooldown-for-bun": true,
"enable-cooldown-for-bundler": true,
"enable-cooldown-for-cargo": true,
"enable-cooldown-for-maven": true,
"enable-cooldown-for-gomodules": true,
"enable-cooldown-metrics-collection": true,
"enable-cooldown-for-composer": true,
"enable-cooldown-for-gradle": true,
"enable-cooldown-for-pub": true,
"enable-cooldown-for-gitsubmodules": true,
"enable-cooldown-for-elm": true,
"gradle-lockfile-updater": true,
"enable-cooldown-for-github-actions": true,
"enable-cooldown-for-dev-containers": true,
"enable-cooldown-for-hex": true,
"enable-cooldown-for-dotnet-sdk": true,
"enable-exclude-paths-subdirectory-manifest-files": true
},
"ignore-conditions": [],
"lockfile-only": false,
"max-updater-run-time": 2700,
"package-manager": "bundler",
"proxy-log-response-body-on-auth-failure": true,
"requirements-update-strategy": null,
"reject-external-code": false,
"security-advisories": [],
"security-updates-only": false,
"source": {
"provider": "github",
"repo": "REDACTED",
"branch": null,
"directory": "/.",
"api-endpoint": "https://api.github.com/",
"hostname": "github.com"
},
"updating-a-pull-request": false,
"update-subdependencies": false,
"vendor-dependencies": false,
"enable-beta-ecosystems": false,
"repo-private": true,
"multi-ecosystem-update": false,
"exclude-paths": null
}
}
```

Is there a way to trigger a run manually or is this not yet supported for multi-ecosystem updates?

Contributor guide

Open the contributing guide

Research direction

Start with the .github/dependabot.yml configuration and the Dependabot Updates GitHub Actions workflow, then trace how the manual refresh actions produce the job definition and set multi-ecosystem-update. Confirm the behavior for the bundler and npm entries; done means a manual run can create the configured grouped pull request, or clearly reports that the operation is unsupported.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript, ruby
Domain
ci-cd, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.