fastify / fastify/github-action-merge-dependabot

Add support for dependabot's compatibility score

Open
#286 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
185
Forks
41
Avg merge
6h 6m
Merged PRs (30d)
4

Description

### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have searched existing issues to ensure the feature has not already been requested

### 🚀 Feature Proposal

#### Description
It would be nice to be able to use dependabot's [compatibility score](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates#about-compatibility-scores) when deciding whether to merge a PR or not.

#### Notes
There are [some reports](https://github.com/dependabot/dependabot-core/issues/4407) of this not working as expected and returning `unknown` insted of the compatibility score for all PRs, but as far as I tested some PRs do have a compatibility score and it seems to be working just fine. Those reports are probably just related to the update not having the 5 candidates needed for the score as mentioned on [this comment](https://github.com/dependabot/dependabot-core/issues/4407#issuecomment-1061945421).

Following are some recent PRs with compatibility score being shown:
https://github.com/nearform/the-fastify-workshop/pull/626
https://github.com/dependabot/fetch-metadata/pull/270

### Motivation

_No response_

### Example

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.