fix: remove $ anchor from updateFragment regex to handle pip directory suffixes#698
Conversation
…y suffixes The updateFragment regex used a $ end-of-line anchor that prevented matching pip ecosystem commit messages ending with 'in /dir' (e.g., 'Update boto3 requirement from <=1.42.76 to <=1.42.86 in /app'). This caused update-type to be null and previous-version to be empty for all pip requirement updates. Removing the $ anchor is safe because \S* already stops at whitespace, preventing over-matching. The bumpFragment regex (which ends with \.$) is unaffected. Fixes dependabot#339 Co-authored-by: Copilot <[email protected]>
E2E Verification — dry-run against a real pip PRTested using the built-in Before fix (upstream code){
"dependencyName": "boto3",
"updateType": "",
"prevVersion": "",
"newVersion": "1.42.86",
"directory": "/app",
"packageEcosystem": "pip"
}
After fix (this PR){
"dependencyName": "boto3",
"updateType": "version-update:semver-patch",
"prevVersion": "1.42.76",
"newVersion": "1.42.86",
"directory": "/app",
"packageEcosystem": "pip"
}Both |
There was a problem hiding this comment.
Pull request overview
Fixes parse() failing to extract previous/new versions from pip “Update … requirement …” commit messages that include a trailing directory suffix (e.g. in /app), which previously caused update-type to be empty/null.
Changes:
- Relax
updateFragmentmatching by removing the end-of-line$anchor so pip commit messages within /<dir>still match. - Add a Jest regression test covering the pip directory suffix format.
- Regenerate the bundled
dist/index.jsto include the source change.
Show a summary per file
| File | Description |
|---|---|
src/dependabot/update_metadata.ts |
Removes $ from updateFragment regex so pip commit messages with directory suffixes are parsed correctly. |
src/dependabot/update_metadata.test.ts |
Adds a regression test for pip “Update … requirement … in /app” format to ensure updateType, versions, and directory are populated. |
dist/index.js |
Updates the built action bundle to reflect the regex change. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/3 changed files
- Comments generated: 0
truggeri
left a comment
truggeri
left a comment
There was a problem hiding this comment.
The change makes sense to me. Having the multiline flag means we should be okay here without the end of line.
Summary
The
updateFragmentregex on line 71 ofsrc/dependabot/update_metadata.tsuses a$end-of-line anchor:This fails for pip ecosystem commit messages that end with a directory suffix like
in /app:Because the regex doesn't match,
previs empty, andcalculateUpdateType('', '1.42.86')returns an empty string — causingupdate-typeto benullin the action output.Fix
Remove the
$anchor fromupdateFragment. This is safe because:^anchor +/mflag ensures we match from the start of a line\S*already stops at whitespace, so capture groups won't over-match past the versionbumpFragmentregex (which ends with\.$) is unaffected — "Bumps" messages always end with a periodTest
Added a test case reproducing the exact pip requirement format with
in /appsuffix.Fixes #339