Consider combining this action with `dependabot/fetch-metadata` to support multi-dependency updates

[AlCalzone]

I've noticed that this action fails when Dependabot creates a single PR for multiple updates. It is possible though to combine this with a helper-action from Dependabot to fetch the update metadata in a standardized format, making a lot of parsing here unnecessary:

# ...
      - name: Dependabot metadata
        id: dependabot-metadata
        uses: dependabot/fetch-metadata@v1
        with:
          github-token: ${{ secrets.PAT }} # This must be a personal access token to fetch if a PR closes a security issue

The result can then be passed to this action:

# ...
        env:
          updatedDependenciesJson: ${{ steps.dependabot-metadata.outputs.updated-dependencies-json }}

which can then be parsed using JSON.parse and contains something like this:

[
    {
        dependencyName: 'prettier',
        dependencyType: 'direct:development',
        updateType: 'version-update:semver-patch',
        directory: '/prettier-and-types',
        packageEcosystem: 'npm_and_yarn',
        targetBranch: 'master',
        prevVersion: '',
        newVersion: '',
        compatScore: 0,
        alertState: '',
        ghsaId: '',
        cvss: 0
    },
    {
        dependencyName: '@types/prettier',
        dependencyType: 'direct:development',
        updateType: 'version-update:semver-patch',
        directory: '/',
        packageEcosystem: 'npm_and_yarn',
        targetBranch: 'master',
        prevVersion: '',
        newVersion: '',
        compatScore: 0,
        alertState: '', // <-- THIS will be "OPEN" if there is an open security issue
        ghsaId: '',
        cvss: 0
    }
]

[hendrickson-tyler]

Would love to see this enhancement as well. This is made especially important by the grouped version updates feature that was just released as a public beta for Dependabot.

[ahmadnassri]

this is the plan, a complete re-write to make it compatible / dependant on dependabot/fetch-metadata

[hendrickson-tyler]

@ahmadnassri Apologies for tagging you, but I'm curious on how this re-write is going? I have a lot more of my Dependabot updates grouped these days, so this feature would definitely be appreciated. Thanks for all your work on this action!