dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.72k stars 1.02k forks source link

badge issues after switch from dependabot-preview to GitHub's dependabot #1960

Closed piramiday closed 2 years ago

piramiday commented 4 years ago

I had set up a badge while using dependabot-preview, like so:

Originally posted by @greysteil in https://github.com/dependabot/feedback/issues/6#issuecomment-503994253 So Dependabot Status would be https://api.dependabot.com/badges/status?host=github&repo=yss14/musicshare. For private repos you have to add &identifer=<the github repo's ID> onto that.

after I migrated my settings to GitHub, my badge is now showing a gray inactive, rather than a green enabled.

is this supposed to happen? should I have updated the code for the badge, post-inclusion in GitHub? if so, how?

piramiday commented 4 years ago

I've also manually reverted a Python package in my private repository to test the new dependabot bot.

the PR opened a while back by dependabot-preview had a nice-looking compatibility badge (e.g. for pytest 5.4.2 > 5.4.3): Dependabot compatibility score

whereas the PR opened just now by dependabot shows this, instead: Dependabot compatibility score

I'm not sure this quirkyness is due to the same issue, but any help is appreciated. thanks

feelepxyz commented 4 years ago

@piramiday thanks for reporting this. We're aware of the broken status badge and thinking of ways to bring it back.

whereas the PR opened just now by dependabot shows this, instead: Is that for the same version update pytest 5.4.2 > 5.4.3? Do you any public PRs to share?

piramiday commented 4 years ago

thanks for reporting this. We're aware of the broken status badge and thinking of ways to bring it back.

I hope I didn't create a duplicate issue, if that's the case feel free to close this one and refer me to the original one. I turned out empty handed in my original search.

Is that for the same version update pytest 5.4.2 > 5.4.3? Do you any public PRs to share?

yes, exactly the same version update -- I simply reverted the original PR pushed a couple of weeks back to wait and see what the new dependabot did.

no, sorry, that's a private repo. I do confirm that the compatibility badge is the major difference with the new PR text, the rest is a couple of new commands and some added text. diff:

21,24d20
< <summary>Changelog</summary>
< <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst">pytest's changelog</a>.</em></p>
< </details>
< <details>
43c39
< [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=pytest&package-manager=pip&previous-version=5.4.2&new-version=5.4.3)](https://dependabot.com/compatibility-score/?dependency-name=pytest&package-manager=pip&previous-version=5.4.2&new-version=5.4.3)
---
> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pytest&package-manager=pip&previous-version=5.4.2&new-version=5.4.3)](https://help.github.com/articles/configuring-automated-security-fixes)
52,55d47
< **Note:** This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.
< 
< You can always request more updates by clicking `Bump now` in your [Dependabot dashboard](https://app.dependabot.com).
< 
71,82d62
< - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
< - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
< - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
< - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
< - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
< 
< Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
< - Update frequency (including time of day and day of week)
< - Pull request limits (per update run and/or open at any time)
< - Out-of-range updates (receive only lockfile updates, if desired)
< - Security updates (receive only security updates, if desired)
HonkingGoose commented 4 years ago

@feelepxyz @piramiday This issue (#1960) is a duplicate of #1912, I'll leave it to the maintainers to decide on how/if to resolve the duplication.

mwaddell commented 2 years ago

Maybe this could be finally addressed using a custom workflow (see task #4680)?

jeffwidman commented 2 years ago

Closing as a duplicate of https://github.com/dependabot/dependabot-core/issues/1912