dependabot / dependabot/dependabot-core
Don't respond with `I won't notify you again about this release` when resolved by another PR
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
github-actions
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
`.github/workflows/x.yml`:
```yaml
on:
push:
jobs:
x:
steps:
- uses: 'google-github-actions/auth@v0'
with:
credentials_json: '${{ secrets.GCR_JSON_KEY }}'
```
### dependabot.yml content
```
version: 2
updates:
- package-ecosystem: github-actions
directory: "/"
```
### Updated dependency
```diff
- uses: 'google-github-actions/auth@v0'
+ uses: 'google-github-actions/auth@v1'
```
### What you expected to see, versus what you actually saw
Another user created a PR which subsumed this PR.
It included the same change. Their PR included a `closes #...` notation.
When they created the PR, a
> `user` mentioned this pull request ...
Entry was added.
When they merged the PR, a
> `user` closed this in `pr...`
Entry was added.
Dependabot responded by saying:
> OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an [ignore condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired update_types to your config file.
It should have checked to see if the goal it was trying to achieve was still relevant, if the dependency was either updated to match (or surpass) its goal, or was removed entirely, it should have provided some other message acknowledging that its services were no longer needed, but not suggesting that it be told to ignore things for this.
### Native package manager behavior
A human would not say "oh, you could tell me not to pay attention to this anymore", that's what the `closes` and closed in merged PR notations tell humans.
### Images of the diff or a link to the PR, issue, or logs

### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Use the `.github/workflows/x.yml` manifest and the supplied `dependabot.yml` as the reproduction case, with one update PR superseded by another PR. Trace the notification handling for the merged `closes #...` and closed-in-PR events; done means a superseded update receives an acknowledgement that no further service is needed instead of an ignore-release message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, ruby
- Domain
- ci-cd, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100