dependabot / dependabot/dependabot-core

Don't respond with `I won't notify you again about this release` when resolved by another PR

Open
#6,161 2 comments 0 reactions 0 assignees View on GitHub
F: pull-requests service 💁 T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

github-actions

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

`.github/workflows/x.yml`:
```yaml
on:
push:
jobs:
x:
steps:
- uses: 'google-github-actions/auth@v0'
with:
credentials_json: '${{ secrets.GCR_JSON_KEY }}'
```

### dependabot.yml content

```
version: 2
updates:
- package-ecosystem: github-actions
directory: "/"
```

### Updated dependency

```diff
- uses: 'google-github-actions/auth@v0'
+ uses: 'google-github-actions/auth@v1'
```

### What you expected to see, versus what you actually saw

Another user created a PR which subsumed this PR.

It included the same change. Their PR included a `closes #...` notation.

When they created the PR, a
> `user` mentioned this pull request ...
Entry was added.

When they merged the PR, a
> `user` closed this in `pr...`
Entry was added.

Dependabot responded by saying:

> OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an [ignore condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired update_types to your config file.

It should have checked to see if the goal it was trying to achieve was still relevant, if the dependency was either updated to match (or surpass) its goal, or was removed entirely, it should have provided some other message acknowledging that its services were no longer needed, but not suggesting that it be told to ignore things for this.

### Native package manager behavior

A human would not say "oh, you could tell me not to pay attention to this anymore", that's what the `closes` and closed in merged PR notations tell humans.

### Images of the diff or a link to the PR, issue, or logs

![image](https://user-images.githubusercontent.com/2119212/202523644-354fb26b-3ea5-4c0a-9c1d-3e135956cf1e.png)

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Use the `.github/workflows/x.yml` manifest and the supplied `dependabot.yml` as the reproduction case, with one update PR superseded by another PR. Trace the notification handling for the merged `closes #...` and closed-in-PR events; done means a superseded update receives an acknowledgement that no further service is needed instead of an ignore-release message.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, ruby
Domain
ci-cd, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.