feat: Parse versions from metadata links #632
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Dependabot PRs that update a single dependency include version details in the commit message introduction, e.g.,
This is the format generated by the
commit_message_intro
method in Dependabot Core.However, when multiple dependencies are updated in a single PR, this format isn't used, which limits the action’s ability to extract accurate version information.
This change improves version parsing for multi-dependency PRs by introducing two additional detection strategies:
YAML metadata parsing Dependabot includes a YAML block in the commit message with structured details for each updated dependency:
This is the most reliable and stable source for the new version of each dependency, though it does not include the previous version.
Metadata links parsing In multi-dependency updates, Dependabot also appends “metadata links” with a format like:
These lines are generated bythe
metadata_links
method and provide both the old and new versions.By combining these sources, the action now supports version parsing for PRs with multiple updated dependencies—broadening its coverage and improving reliability.
Closes #402