dependabot / dependabot/dependabot-core

Insights about the `updated-dependencies` section of the commit message

Open
#6,777 9 comments 2 reactions 0 assignees View on GitHub
core 🍏 dependabot-script Keep L: go:modules L: java:maven
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

I am currently running [dependabot-script](https://github.com/dependabot/dependabot-script) in a private instance of GHE, and I would like to leverage [fetch-metadata](https://github.com/dependabot/fetch-metadata) to extract additional information about my pull requests

While going through their code, I noticed that the `updated-dependencies` block is a requirement to make that action work, but that the logic to derive that block is not present in core as far as I understand

Would it be possible to release some insights about how this block is currently derived in Dependabot?

Example:

```yml

---
updated-dependencies:
- dependency-name: io.quarkus:quarkus-bom
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: io.quarkus:quarkus-maven-plugin
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: io.quarkus:quarkus-bootstrap-maven-plugin
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: io.quarkus:quarkus-extension-processor
dependency-type: direct:production
update-type: version-update:semver-patch
```

I can probably calculate/guess it myself, but it is not ideal

Additionally, I am not sure what the different options are besides the example above

If this information is secret/private to the Dependabot-hosted version, feel free to close this

Thank you!

Contributor guide

Open the contributing guide

Research direction

Compare dependabot-script with fetch-metadata to determine how the updated-dependencies block is consumed. Document how Dependabot derives the shown fields and enumerate the supported options, making the result usable for private GitHub Enterprise instances.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
documentation, tooling
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.