Dependabot is not working

[bmuenzenmeyer]

Myself and @ovflowd are troubleshooting why dependabot is not working.

so far

It did not run as we expected it to today.

Having not known the circumstances of turning it off, I've tried turning it off and on again in the settings.
I used this Insight to try to trigger dependabot https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates

The UI errors, https://github.com/nodejs/nodejs.org/network/updates/702239395, though the log eventually states:

updater | | Changes to Dependabot Pull Requests |
updater | +---------+--------------------------------------------------------------------------------------------------------------------------+
updater | | created | @storybook/addon-controls ( from 7.0.26 to 7.1.1 ), @storybook/addon-interactions ( from 7.0.26 to 7.1.1 ), @storyboo... |
updater | | created | @testing-library/jest-dom ( from 5.16.5 to 5.17.0 ), @types/testing-library__jest-dom ( from 5.14.7 to 5.14.9 ) |
updater | | created | next ( from 13.4.9 to 13.4.12 ), turbo ( from 1.10.7 to 1.10.12 ) |
updater | | created | @types/react ( from 18.2.14 to 18.2.17 ), @types/react-dom ( from 18.2.6 to 18.2.7 ) |
updater | | created | jest ( from 29.6.1 to 29.6.2 ), @types/jest ( from 29.5.2 to 29.5.3 ) |
updater | | created | stylelint ( from 15.10.1 to 15.10.2 ) |
updater | | created | framer-motion ( from 10.12.18 to 10.15.0 ) |
updater | | created | @typescript-eslint/eslint-plugin ( from 5.61.0 to 6.2.0 ) |
updater | | created | jest-environment-jsdom ( from 29.6.1 to 29.6.2 ) |
updater | | created | eslint-config-prettier ( from 8.8.0 to 8.9.0 ) |
updater | | created | eslint-plugin-storybook ( from 0.6.12 to 0.6.13 ) |
updater | | created | eslint-config-next ( from 13.4.9 to 13.4.12 ) |
updater | | created | @typescript-eslint/parser ( from 5.61.0 to 5.62.0 ) |
updater | | created | sharp ( from 0.32.1 to 0.32.4 ) |
updater | | created | eslint ( from 8.44.0 to 8.46.0 ) |
updater | | created | @types/node ( from 18.16.19 to 20.4.5 ) |
updater | +---------+--------------------------------------------------------------------------------------------------------------------------+
updater | time="2023-07-28T20:56:36Z" level=info msg="task complete" container_id=job-702239395-updater exit_code=0 job_id=702239395 step=updater

[bmuenzenmeyer]

I see https://github.com/nodejs/nodejs.org/runs/15441072510 on my hotfix commit

[bmuenzenmeyer]

still failing

[bmuenzenmeyer]

going to look into https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#troubleshooting-failed-workflow-runs tonight

[bmuenzenmeyer]

tried a couple things that looked promising, still no PRs created

Reviewed https://docs.github.com/en/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors - no leads

Trying to restore a branch and PR of an old update to see if it helps jumpstart it

trying with #5255

[bmuenzenmeyer]

thought maybe dependabot was paused per https://github.blog/changelog/2023-01-12-dependabot-pull-requests-pause-for-inactivity/ but none of these indicators are present.

[bmuenzenmeyer]

Created a ticket with GitHub support

[ovflowd]

Thanks, @bmuenzenmeyer

[ovflowd]

I've found the root cause. By analyzing the output of Dependabot Run within (https://github.com/nodejs/nodejs.org/network/updates), as you mentioned in your opening issue, Dependabot is trying to create Pull Requests.

Then I remembered we have GitHub "Rules" configured on (https://github.com/nodejs/nodejs.org/settings/rules). This immediately made me check the Insights tab (https://github.com/nodejs/nodejs.org/settings/rules/insights), which output:

And an example entry would show:

The Pull Request ruleset was configured for All Branches instead of main. I've updated the Rulesets with the correct configuration and some tweaks to Bypasses and permissions.

[ovflowd]

@bmuenzenmeyer we can close this issue, I assume?

[bmuenzenmeyer]

you bet - closed this support ticket with this info - i suspect GitHub could/should update their docs to account for this situation