Dependabot-core: Ability to ignore CI-generated commits when auto-rebasing

[qnighy]

We sometimes want to automatically generate commits over dependabot-generated commits, like:

• Running go mod tidy over go modules version bump
• Running some code generation over git submodules bump

However, this is incompatible to dependabot's auto-rebasing feature: if a dependabot-generated branch is modified, dependabot will no longer auto-rebase the branch even if there's a conflict.

It would be convenient if there's some pragma in commit messages like [dependabot-ignore] to tell dependabot to ignore the commit when auto-rebasing.

[qnighy]

I'm willing to implement this by myself given some instructions. I couldn't find where auto-rebasing happens in the source code...

[jurre]

Thanks @qnighy, rebasing etc is currently not a part of dependabot-core but belongs to the internal services we use to run dependabot at GitHub.

I understand the feature request and think it would be useful, although I have not thought through all the possible edge-cases yet. Currently our small team is swamped with rolling out the GitHub native version of Dependabot, so it might be a while before we have time to think about how we could improve this.

[feelepxyz]

Yeah makes a lot of sense. Adding some more context for when we get to this. I think we'd always need to throw away any additional commits when rebasing as we're not doing a git rebase. Dependabot will re-run the update against the latest master version of the manifest as any change might cause other lockfile changes. In which case you'd need to re-run the action every time Dependabot rebases the branch.

[jurre]

FYI you can now include [dependabot skip] in your CI-generated commits in the GH-native version of Dependabot, and also, we natively run go mod tidy ✨