Dependabot-core: Q: How does Dependabot know when to merge after `@dependabot merge`?
I've written a GitHub App of my own to auto-merge PRs based on a label after all checks pass. But GitHub sadly reports PR status as stable when the PR is brand new (or just synchronized) but before checks are actually added to the PR a few seconds later.
How does dependabot solve this problem when @dependabot merge is used to schedule an auto-completion of the PR?
The issue on my repo tracking this problem is here, FYI: https://github.com/AArnott/pr-autocomplete-app/issues/27
AArnott
All 4 comments
We store some state that stores wether or not the repository normally has CI, and if it does, we wait until there are check-runs and they're passing. Unfortunately there's no easy way to do this via just the API.
jurre
on 6 Aug 2020
That's disappointing, but a way forward. Thanks.
AArnott
on 6 Aug 2020
@AArnott you could require that users specify branch protection and use required checks, you could then wait for these checks to pass before merging: https://developer.github.com/v3/repos/branches/#get-branch-protection
feelepxyz
on 6 Aug 2020
Yes, that works today. But I've been surprised how many repos don't have branch protections set up. Private, team repos aren't even allowed to set up branch protections on the free plan.
I'm thinking of perhaps just adding a 'minimum age' of a PR that must elapse before we merge it, where the age resets on open/create of the PR or when the synchronize event comes in. That would presumably give time for the checks to be added to the PR. We could set it to 15 seconds or something.
Alternatively we could assume that folks who use our auto-complete functionality _always_ have some check in place (otherwise why use auto-merge in the first place?) and simply _never_ auto-complete the PR until at least one check has passed along with all the other criteria.
AArnott
on 6 Aug 2020
Related issues
tjwallace
路
3Comments
greysteil
路
4Comments
v1sion
路
3Comments
rebelagentm
路
3Comments
byjrack
路
3Comments
Most helpful comment
Yes, that works today. But I've been surprised how many repos don't have branch protections set up. Private, team repos aren't even allowed to set up branch protections on the free plan.
I'm thinking of perhaps just adding a 'minimum age' of a PR that must elapse before we merge it, where the age resets on open/create of the PR or when the synchronize event comes in. That would presumably give time for the checks to be added to the PR. We could set it to 15 seconds or something.
Alternatively we could assume that folks who use our auto-complete functionality _always_ have some check in place (otherwise why use auto-merge in the first place?) and simply _never_ auto-complete the PR until at least one check has passed along with all the other criteria.