dependabot / dependabot/dependabot-core

`Pipfile` updater doesn't pick up all files in a monorepo

Open
#8,988 2 comments 0 reactions 0 assignees View on GitHub
T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

pip

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

https://github.com/NomicFoundation/slang/blob/main/.github/dependabot.yml

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

I have the following `Pipfile` entries in the repository:

- https://github.com/NomicFoundation/slang/blob/main/Pipfile
- https://github.com/NomicFoundation/slang/blob/main/documentation/Pipfile
- https://github.com/NomicFoundation/slang/blob/main/crates/infra/cli/Pipfile

However, during dependabot runs, only the first one (in the root folder) is updated, while the other two are silently ignored:

- Here is a recent PR: https://github.com/NomicFoundation/slang/pull/781
- Which was created from this update job: https://github.com/NomicFoundation/slang/network/updates/782719277

Given that my `dependabot.yml` already specifies `directory: "/"`, what else should be done?

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Compare the root Pipfile with documentation/Pipfile and crates/infra/cli/Pipfile, then inspect the linked dependabot.yml and update job or PR. Reproduce the run with all three manifest locations and determine why only the root file is discovered. Done means the Pipfile updater handles the monorepo manifests described in the issue and creates the expected updates.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, ruby
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.