search

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.53k stars 944 forks source link

Wildcard doesn't work #10090

Open lucacome opened 1 week ago

lucacome commented 1 week ago

Is there an existing issue for this?

Package ecosystem

Docker

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

https://github.com/opentracing-contrib/nginx-opentracing/blob/master/.github/dependabot.yml

Updated dependency

No response

What you expected to see, versus what you actually saw

Dependabot says this in the logs:

updater | 2024/06/26 23:45:12 INFO Results:
updater | +------------------------------------------+
updater | |   Changes to Dependabot Pull Requests    |
updater | +---------+--------------------------------+
updater | | created | ubuntu ( from 22.04 to 24.04 ) |
updater | | created | php ( from 7-fpm to 8-fpm )    |
updater | | created | ubuntu ( from 18.04 to 24.04 ) |
updater | | created | ubuntu ( from 18.04 to 24.04 ) |
updater | | created | ubuntu ( from 18.04 to 24.04 ) |
updater | | created | ubuntu ( from 17.10 to 24.04 ) |
updater | | created | ubuntu ( from 17.10 to 24.04 ) |
updater | | created | ubuntu ( from 22.04 to 24.04 ) |
updater | | created | python ( from 3.10 to 3.12 )   |
updater | +---------+--------------------------------+

but it only opened:

I expected a PR for ubuntu with changes to all the Dockerfiles

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

lucacome commented 1 week ago

I triggered dependabot again after merging 631 and it opened one for the next ubuntu on the list https://github.com/opentracing-contrib/nginx-opentracing/pull/634 but then decided to supersede it with one in another folder https://github.com/opentracing-contrib/nginx-opentracing/pull/635

robbert-nlo commented 1 week ago

I'm seeing something similar with this config:

version: 2
updates:
  - package-ecosystem: "terraform"
    directories:
      - "*"
    schedule:
      interval: "monthly"

This is running on a Terraform project having multiple envs in multiple directories, with manifest files like this:

lab/providers.tf
acc/providers.tf
prd/providers.tf

It only creates a PR for one of the dirs/files.

lucacome commented 2 days ago

From the conversation in https://github.com/dependabot/dependabot-core/issues/2178 it seemed like using the grouping settings would force dependabot to open a PR with all the changes across multiple directories.

But this doesn't seem to be working either.

I have a grouping of go.opentelemetry.io/otel dependencies and dependabot opened just one PR for a single directory instead of two.

deki commented 2 hours ago

@lucacome same behavior on my end