Support auto merge in Dependabot

[DominicBoettger]

For my private repository it's not possible to add the auto merge feature. I added dependabot via the web interface and I receive PRs but the PRs are not merged automatically.

After this did not work I also tried via the dependabot config. The behaviour is the same. The check runs daily and creates PRs but does not merge them.

version: 1
update_configs:
  - package_manager: "javascript"
    directory: "/"
    update_schedule: "daily"
    automerged_updates:
      - match:
          dependency_type: "development"
          # Supported dependency types:
          # - "development"
          # - "production"
          # - "all"
          update_type: "all"
          # Supported updates to automerge:
          # - "security:patch"
          #   SemVer patch update that fixes a known security vulnerability
          # - "semver:patch"
          #   SemVer patch update, e.g. > 1.x && 1.0.1 to 1.0.3
          # - "semver:minor"
          #   SemVer minor update, e.g. > 1.x && 2.1.4 to 2.3.1
          # - "in_range"
          #   matching the version requirement in your package manifest
          # - "all"
      - match:
          dependency_type: "production"
          update_type: "all"

[leonardovillela]

Same here. Is anything wrong with my project configuration? https://github.com/leonardovillela/redux-zero-chat/blob/master/.dependabot/config.yml

I already have enabled auto-merge in my account. As you can see the PR's are open but not auto-merged 🤔

[infin8x]

Thanks for the feedback and sorry for the confusion here.

Auto-merge will not be supported in GitHub-native Dependabot for the foreseeable future. We know some of you have built great workflows that rely on auto-merge, but right now, we’re concerned about auto-merge being used to quickly propagate a malicious package across the ecosystem. We recommend always verifying your dependencies before merging them.

[leonardovillela]

Okay, but I'm not using GitHub-native Dependabot, so auto merging is supposed to work, right?

[feelepxyz]

@leonardovillela it looks like you don't have CI set up on the repo, which is why Dependabot doesn't want to automerge: leonardovillela/redux-zero-chat#2

You need to add some CI check on pull requests, you could add a GitHub action that runs on every push. Doesn't actually have to do anything as long as the task succeeds.

[chdsbd]

If you don't mind adding another GitHub Bot to the mix, I built an open source bot called Kodiak which supports auto merging pull requests.

There's specific instructions for using Kodiak with Dependabot here: https://kodiakhq.com/docs/recipes#automated-dependency-updates-with-dependabot

Also, there are a ton of other GitHub Bots doing similar things. Here's a non-exhaustive list: https://kodiakhq.com/docs/prior-art-and-alternatives

[jrjohnson]

@infin8x I understnd the security concerns and wanting to make this something we have to do intentionally, but I haven't found a bot that can distinguish the pacakge name and semver bump before merging. If this isn't going to be supported in dependabot directly is there a way to add labels based on names and semver?

An example of our current config:

automerged_updates:
    - match:
        dependency_name: "eslint"
    - match:
        update_type: "semver:minor"
        dependency_name: "@fortawesome/free-brands-svg-icons"

We don't want to automerge everything (or even most things) so automerging based on a label applied to every update doesn't work, we'd need to be able to label based on the same criteria we used to auto merge with.

[seanconnollydev]

@infin8x I understand the security concern but we were hoping to set our target_branch to something that is not our default branch and then auto-merge into that branhc to limit the number of PRs that get opened per project. Many integration services like Chromatic, Heroku, etc. have costs associated with each PR that gets created in a repo so this is an important capability for us. I think you need to reconsider this policy to at least allow auto-merge on non-default branches.

[danielbachhuber]

@chdsbd Can Kodiak distinguish between patch, minor, and major versions?

[chdsbd]

@danielbachhuber Sadly not.

There was a discussion about adding that kind of metadata in a structured form via probot metadata, but I don't think that's gone anywhere yet.

#2294 would also make automatic updates based on type easy.

A potentially less robust solution would be to parse the update type from the PR description.

Assuming the following example is consistent I think a github action could label the PR based on the PR description.

Bumps eslint from 7.6.0 to 7.7.0.

...more content...

Here's a example script that could probably be integrated into some GitHub Action or bot:

https://runkit.com/chdsbd/5f3c822e5eda78001ac183df

const semver = require('semver')

const PR_DESCRIPTION = `\
Bumps eslint from 7.6.0 to 7.7.0.
Release notes
Sourced from ...`

const regex = /^Bumps\s.*\sfrom\s(.*)\sto\s(.*)\./;

/* determine the update type (major, premajor, minor, preminor, patch, prepatch, or prerelease) from a dependabot PR */
function parseUpdateType(x) {
  const match = x.match(regex)
  const prevVersion = match[1]
  const newVersion = match[2]
  return semver.diff(prevVersion, newVersion)
}

parseUpdateType(PR_DESCRIPTION)
/* equals "minor" */