dependabot / dependabot/dependabot-core
Update existing multi-ecosystem PR rather than creating a new one
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
As mentioned in https://github.com/dependabot/dependabot-core/issues/12948, we're testing multi-ecosystem updates for a Rails application where we want a single PR raised weekly with both front-end (npm) and back-end (Bundler) dependency updates.
However, every Dependabot run will create a new PR if dependencies change (as they will week to week), e.g. `dependabot/all_dependencies-cc30755e31` and `dependabot/all_dependencies-abd6b84e54`. This leaves us in a strange situation where no one PR contains all the latest dependency updates for a group as the first might contain some npm and Bundler updates and the second only npm updates depending on what has been published.
Ideally, we'd like to be able to have Dependabot raise a single PR for a multi-ecosystem group (in our case, `all-dependencies`) and _update that existing PR_ on subsequent runs. That way, we only have a single PR to review and merge that contains the latest updates for a group rather than updates being spread across multiple PRs from separate runs.
Contributor guide
Research direction
Start with the linked issue 12948 and trace the multi-ecosystem group PR creation and update path in dependabot-core; the issue names no source files or tests. Done means repeated runs for one group update its existing PR rather than opening another, while retaining the latest npm and Bundler updates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, javascript, rails, ruby
- Domain
- devops, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100