dependabot / dependabot/dependabot-core
GitHub Actions updater uses LF newline for modified lines even if file uses CRLF
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
GitHub actions
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
https://github.com/microsoft/TypeScript/blob/main/.github/workflows/nightly.yaml
### dependabot.yml content
https://github.com/microsoft/TypeScript/blob/main/.github/dependabot.yml
```yaml
version: 2
updates:
- package-ecosystem: 'github-actions'
directory: '/'
schedule:
interval: 'weekly'
groups:
github-actions:
patterns:
- '*'
```
### Updated dependency
From:
```
actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
```
To:
```
actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
```
### What you expected to see, versus what you actually saw
When dependabot updates the yaml file, it should use the line endings already used in the file. However, it appears to always use LF line endings on the lines it modifies. This leads to mixed line ending files, which is bad. In the TypeScript repo, this manifests as a CI failure due to the file not being formatted.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
https://github.com/microsoft/TypeScript/pull/56870 is an example of a failing PR.
[microsoft/TypeScript@`d9cabbf` (#56870)](https://github.com/microsoft/TypeScript/pull/56870/commits/d9cabbf055249df15d171b5b488e9a23466e742c) is the commit, but doesn't show the difference.
Locally, I can run a script which splits the lines on just `\n`. On main, the lines changed for one of these files looks like:
```
' steps:\r',
' - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1\r',
' - uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0\r',
' with:\r',
' # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry.\r',
' registry-url: https://registry.npmjs.org/\r',
```
But after:
```
' steps:\r',
' - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1\r',
' - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1',
' with:\r',
' # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry.\r',
' registry-url: https://registry.npmjs.org/\r',
```
Note the missing `\r` on the updated line.
A workaround is to not use CRLF
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start with the GitHub Actions manifest at .github/workflows/nightly.yaml and the configuration in .github/dependabot.yml, reproducing the update with CRLF line endings. Compare the original and updated lines, then verify that the updater preserves the file's existing newline style without producing mixed line endings or the reported CI formatting failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, ruby
- Domain
- ci-cd, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100