dependabot / dependabot/dependabot-core
Manually trigger multi-ecosystem update
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
We're testing [multi-ecosystem updates](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates) to raise a single PR for all our web application dependencies (both front and backend) in one go, e.g.
```yaml
version: 2
multi-ecosystem-groups:
all-dependencies:
schedule:
interval: "weekly"
day: "sunday"
updates:
- package-ecosystem: "bundler"
directory: "/"
multi-ecosystem-group: "all-dependencies"
patterns: ["*"]
- package-ecosystem: "npm"
directory: "/"
multi-ecosystem-group: "all-dependencies"
patterns: ["*"]
```
However, it doesn't seem possible to manually trigger Dependabot to raise a PR for this repository either by using the "Check for updates" button on each package ecosystem within the "Dependabot" tab of the "Dependency Graph" section of "Insights", or by pushing a change to the `.github/dependabot.yml` configuration file.
Both of these actions will trigger the appropriate "Dependabot Updates" GitHub Actions workflow but they don't seem to result in a PR being created. Looking at the logs, I can see that `multi-ecosystem-update` is set to `false` in the job definition, e.g.
```yaml
{
"job": {
"allowed-updates": [
{
"dependency-type": "direct",
"update-type": "all"
}
],
"commit-message-options": {
"prefix": null,
"prefix-development": null,
"include-scope": null
},
"credentials-metadata": [
{
"type": "git_source",
"host": "github.com"
},
{
"type": "rubygems_server",
"host": "rubygems.pkg.github.com"
}
],
"debug": null,
"dependencies": null,
"dependency-groups": [
{
"name": "all-dependencies",
"rules": {
"patterns": [
"*"
]
}
}
],
"dependency-group-to-refresh": null,
"existing-pull-requests": [],
"existing-group-pull-requests": [],
"experiments": {
"record-ecosystem-versions": true,
"record-update-job-unknown-error": true,
"proxy-cached": true,
"move-job-token": true,
"dependency-change-validation": true,
"enable-file-parser-python-local": true,
"npm-fallback-version-above-v6": true,
"lead-security-dependency": true,
"enable-record-ecosystem-meta": true,
"enable-corepack-for-npm-and-yarn": true,
"enable-shared-helpers-command-timeout": true,
"enable-dependabot-setting-up-cronjob": true,
"enable-engine-version-detection": true,
"avoid-duplicate-updates-package-json": true,
"allow-refresh-for-existing-pr-dependencies": true,
"allow-refresh-group-with-all-dependencies": true,
"exclude-local-composer-packages": true,
"enable-enhanced-error-details-for-updater": true,
"enable-cooldown-for-python": true,
"enable-cooldown-for-uv": true,
"enable-cooldown-for-npm-and-yarn": true,
"enable-cooldown-for-nuget": true,
"enable-cooldown-for-bun": true,
"enable-cooldown-for-bundler": true,
"enable-cooldown-for-cargo": true,
"enable-cooldown-for-maven": true,
"enable-cooldown-for-gomodules": true,
"enable-cooldown-metrics-collection": true,
"enable-cooldown-for-composer": true,
"enable-cooldown-for-gradle": true,
"enable-cooldown-for-pub": true,
"enable-cooldown-for-gitsubmodules": true,
"enable-cooldown-for-elm": true,
"gradle-lockfile-updater": true,
"enable-cooldown-for-github-actions": true,
"enable-cooldown-for-dev-containers": true,
"enable-cooldown-for-hex": true,
"enable-cooldown-for-dotnet-sdk": true,
"enable-exclude-paths-subdirectory-manifest-files": true
},
"ignore-conditions": [],
"lockfile-only": false,
"max-updater-run-time": 2700,
"package-manager": "bundler",
"proxy-log-response-body-on-auth-failure": true,
"requirements-update-strategy": null,
"reject-external-code": false,
"security-advisories": [],
"security-updates-only": false,
"source": {
"provider": "github",
"repo": "REDACTED",
"branch": null,
"directory": "/.",
"api-endpoint": "https://api.github.com/",
"hostname": "github.com"
},
"updating-a-pull-request": false,
"update-subdependencies": false,
"vendor-dependencies": false,
"enable-beta-ecosystems": false,
"repo-private": true,
"multi-ecosystem-update": false,
"exclude-paths": null
}
}
```
Is there a way to trigger a run manually or is this not yet supported for multi-ecosystem updates?
Contributor guide
Research direction
Start with the .github/dependabot.yml configuration and the Dependabot Updates GitHub Actions workflow, then trace how the manual refresh actions produce the job definition and set multi-ecosystem-update. Confirm the behavior for the bundler and npm entries; done means a manual run can create the configured grouped pull request, or clearly reports that the operation is unsupported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, javascript, ruby
- Domain
- ci-cd, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100