ahmadnassri / action-dependabot-auto-merge

Automatically merge Dependabot PRs when version comparison is within range
MIT License
342 stars 48 forks source link

Dependencies ending in "to" (eg "moto") are parsed incorrectly. #114

Open eviltwin opened 2 years ago

eviltwin commented 2 years ago

I recently wondered why moto upgrades weren't merging automatically, and found that it was incorrectly identifying the "to" version:

title: "Bump moto from 2.2.15 to 2.2.16"
depName: moto
from: 2.2.15
to: 2.2.15
dependency type: production
security critical: false
config: all:semver:minor
Warning: no version range detected in PR title
manual merging required

it looks like the regex here is detecting the "to" at the end of "moto", followed by the \D swallowing the " from " portion of the title, leading to it grabbing the first semver in the title and not the second.

This could be fixed a number of ways, including using a single regex to parse the whole title or being stricter about what may appear in the \D position.