dependabot / dependabot/dependabot-core

Pipeline fails after bumping 5 packages

Open
#9,407 5 comments 0 reactions 0 assignees View on GitHub
L: docker L: dotnet:nuget L: git:submodules L: python T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

NuGet

### Package manager version

6.8.0.131

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

``` yaml
# Disable CI trigger
trigger: none

schedules:
- cron: "0 6 * * 1"
displayName: Weekly Dependabot run
branches:
include:
- master
always: true

jobs:
- job: 'Dependabot'
pool:
vmImage: 'ubuntu-latest'

variables:
- name: DIRECTORY_PATH
value: /XXX
- name: PACKAGE_MANAGER
value: nuget
- name: PROJECT_PATH
value: XXX/XXX/_git/XXX
- group: XXXSecrets

steps:
# Get the repo
- script: git clone https://github.com/dependabot/dependabot-script.git
displayName: Clone Dependabot config repo
# Build the docker image
- script: |
cd dependabot-script
docker build -t "dependabot/dependabot-script" -f Dockerfile .
displayName: Build Dependabot Image
- script: |
docker run --rm -e AZURE_ACCESS_TOKEN='$(XXXDEVOPSTOKEN)' \
-e PACKAGE_MANAGER='$(PACKAGE_MANAGER)' \
-e PROJECT_PATH='$(PROJECT_PATH)' \
-e DIRECTORY_PATH='$(DIRECTORY_PATH)' \
-e LOG_LEVEL=debug \
dependabot/dependabot-script
displayName: Run Dependabot
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

I expect when the pipeline finishes it should be success but what's happening is that 5 PR bumps are created but the pipeline fails for example:
`Running with options: {}
Fetching nuget dependency files for MediusDevOps/APAutomation/_git/APA
Parsing dependencies information
- Updating Azure.Security.KeyVault.Certificates (from 4.5.1)… submitted
- Updating Azure.Security.KeyVault.Secrets (from 4.5.0)… submitted
- Updating Microsoft.ApplicationInsights (from 2.21.0)… submitted
- Updating Microsoft.NET.Test.Sdk (from 17.8.0)… submitted
- Updating NUnit (from 3.14.0)… submitted
- Updating Duende.IdentityServer (from 6.3.4)…
##[error]Bash exited with code '1'.`
The pipeline was only green once.
I would like to know why is this happening, maybe something wrong with my script?

### Native package manager behavior

If I use NuGet manually the update is smooth.

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Review the embedded dependabot.yml pipeline configuration and the debug log around the Duende.IdentityServer update after the five earlier PRs are submitted. Re-run the pipeline with the same NuGet, Docker, and Azure settings, then identify the failure cause and confirm that all updates complete with a successful pipeline.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, docker
Domain
ci-cd, devops, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.