Keeps incorrectly reporting packages as changed

[tannyl]

I keep getting false positives on two packages.

As you can see above the roave/security-advisories package reports as downgraded, even though 9999999-dev 77e3164 is exactly the same version as dev-latest 77e3164.

As for friendsofsymfony/oauth-server-bundle dev-master is a alias of 2.0.x-dev, so 2.0.x-dev 5940472 and dev-master 5940472 are also exactly the same versions.

I guess the problem is not actually related to your code (after looking through it briefly) but more likely due to problems in the https://github.com/IonBazan/composer-diff plugin you are using.

[WyriHaximus]

Hey @tannyl it isn't even per se an issue with the underlying package used to generate the output. But how composer looks at them and considers them internally. I might be able to use markdown parsing and filter them out tbh.

[tannyl]

Thanks @WyriHaximus
It is strange that composer ends up with two different names (for base and for target), considering the actual values in the compared lock files are the same?
But anyway, if you could filter messages like this, that would be great.

[ruudk]

While testing out the plugin I noticed the same problem. We rely on a few unreleased packages, and that makes the output unusable.

In this example, only the nette/neon package was bumped by Dependabot.

[WyriHaximus]

Started working on this in #74

[ruudk]

Thanks @WyriHaximus for working on this 💙

[WyriHaximus]

The filtering is working, making sure it now won't comment empty tables next before releasing the fix.

[WyriHaximus]

Confirmed the fix works, need to put in some work to confirm not commenting empty tables also works as intended before tagging a release.

[ruudk]

🚀 👏

[WyriHaximus]

Ok I found a bug. The fix works, but it doesn't delete existing comments that came obsolete. Will create a fix for that as well

[WyriHaximus]

🤦 The bug turned out to be GitHub not always refreshing the UI because the comment gets deleted.

Just released v1.1.0, and if you've been using this action with the @v1 targeting you'll automatically get this release and fix.

[ruudk]

Thanks @WyriHaximus, we're gonna try it out 😊