dependabot / dependabot/dependabot-core

GitHub Actions updater uses LF newline for modified lines even if file uses CRLF

Open
#8,693 15 comments 16 reactions 0 assignees View on GitHub
T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

GitHub actions

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

https://github.com/microsoft/TypeScript/blob/main/.github/workflows/nightly.yaml

### dependabot.yml content

https://github.com/microsoft/TypeScript/blob/main/.github/dependabot.yml

```yaml
version: 2
updates:
- package-ecosystem: 'github-actions'
directory: '/'
schedule:
interval: 'weekly'
groups:
github-actions:
patterns:
- '*'
```

### Updated dependency

From:

```
actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
```

To:

```
actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
```

### What you expected to see, versus what you actually saw

When dependabot updates the yaml file, it should use the line endings already used in the file. However, it appears to always use LF line endings on the lines it modifies. This leads to mixed line ending files, which is bad. In the TypeScript repo, this manifests as a CI failure due to the file not being formatted.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

https://github.com/microsoft/TypeScript/pull/56870 is an example of a failing PR.

[microsoft/TypeScript@`d9cabbf` (#56870)](https://github.com/microsoft/TypeScript/pull/56870/commits/d9cabbf055249df15d171b5b488e9a23466e742c) is the commit, but doesn't show the difference.

Locally, I can run a script which splits the lines on just `\n`. On main, the lines changed for one of these files looks like:

```
' steps:\r',
' - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1\r',
' - uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0\r',
' with:\r',
' # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry.\r',
' registry-url: https://registry.npmjs.org/\r',
```

But after:

```
' steps:\r',
' - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1\r',
' - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1',
' with:\r',
' # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry.\r',
' registry-url: https://registry.npmjs.org/\r',
```

Note the missing `\r` on the updated line.

A workaround is to not use CRLF

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the GitHub Actions manifest at .github/workflows/nightly.yaml and the configuration in .github/dependabot.yml, reproducing the update with CRLF line endings. Compare the original and updated lines, then verify that the updater preserves the file's existing newline style without producing mixed line endings or the reported CI formatting failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, ruby
Domain
ci-cd, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.