dependabot / fetch-metadata

Extract information about the dependencies being updated by a Dependabot-generated PR.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

package-ecosystem metadata not outputting

hnandiwada opened this issue · comments

I want dependabot PRs to automerge ONLY if the PR is to package.json. I have the following ci.yml.

jobs:
  npm-automerge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v1.1.1
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Merge without testing for dependabot npm PRs
        id: merge
        if: ${{ steps.metadata.outputs.package-ecosystem == 'npm' }}
        run: |
          echo "detected npm ecosystem"
          gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
      - name: Fail if not npm
        id: fail-not-npm
        if: ${{ steps.metadata.outputs.package-ecosystem != 'npm' }}
        run: |
          exit 1

Dependabot recently created a PR to upgrade a dependency in our package.json. The first step ran, the second step was skipped, and the third step ran and exited 1. I think this is a bug in the outputting of the metadata step. Either way, how can I get this to merge and pass?

-steps.metadata.outputs.package-ecosystem == 'npm'
+startsWith(steps.metadata.outputs.package-ecosystem, 'npm')

How about this in v1.3.6?
It looks like npm_and_yarn in default.

packageEcosystem: 'npm_and_yarn',

https://github.com/dependabot/fetch-metadata/actions/runs/3992569574/jobs/6848537513

Outputting metadata for 1 updated dependency
  outputs.dependency-names: @typescript-eslint/parser
  outputs.dependency-type: direct:development
  outputs.update-type: version-update:semver-minor
  outputs.directory: /
  outputs.package-ecosystem: npm_and_yarn
  outputs.target-branch: main
  outputs.previous-version: 5.4[8](https://github.com/dependabot/fetch-metadata/actions/runs/3992569574/jobs/6848537513#step:3:9).2
  outputs.new-version: 5.4[9](https://github.com/dependabot/fetch-metadata/actions/runs/3992569574/jobs/6848537513#step:3:10).0
  outputs.compatibility-score: 0
  outputs.alert-state: 
  outputs.ghsa-id: 
  outputs.cvss: 0

This worked perfectly. Thank you!