dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.63k stars 993 forks source link

Grouped update with one commit per dependency in a single PR #8450

Open Stadly opened 10 months ago

Stadly commented 10 months ago

Is there an existing issue for this?

Feature description

The functionality for grouped updates is very nice! Would it be possible to, instead of creating a single PR consisting of a single commit updating all the dependencies, create a single PR consisting of one commit per updated dependency?

Then we would have these different configuration options:

No grouping (possible today)

Grouping with single commit (possible today)

Grouping with individual commits (the requested feature)

I think this would give the best of both worlds:

For dependencies that must be updated together, they must of course be combined in a commit, just as they are without grouping.

corneliusroemer commented 1 week ago

This would be super cool - I'm currently struggling with finding which dep update in a minorAndPatch group update caused issues. Having individual commits would be amazing.

Alternatively, there could be a dependabot command that splits a failing PR up into 2 PR with each having around half of the updates, to let CI do it's job more efficiently than having one commit per dep update.