{"id":13527456,"url":"https://github.com/dependabot/fetch-metadata","last_synced_at":"2025-05-14T12:09:24.303Z","repository":{"id":37391902,"uuid":"371068214","full_name":"dependabot/fetch-metadata","owner":"dependabot","description":"Extract information about the dependencies being updated by a Dependabot-generated PR.","archived":false,"fork":false,"pushed_at":"2025-04-11T23:52:03.000Z","size":2205,"stargazers_count":223,"open_issues_count":25,"forks_count":73,"subscribers_count":16,"default_branch":"main","last_synced_at":"2025-04-11T23:55:47.254Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dependabot.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-05-26T14:42:50.000Z","updated_at":"2025-04-11T21:26:57.000Z","dependencies_parsed_at":"2024-03-21T04:26:16.612Z","dependency_job_id":"2c9605a1-4062-49c7-98b1-74fcbe3bb531","html_url":"https://github.com/dependabot/fetch-metadata","commit_stats":{"total_commits":369,"total_committers":28,"mean_commits":"13.178571428571429","dds":0.5636856368563685,"last_synced_commit":"06ea45a2e4582d87b11f03c7ce596ae3261f39f6"},"previous_names":[],"tags_count":26,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dependabot%2Ffetch-metadata","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dependabot%2Ffetch-metadata/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dependabot%2Ffetch-metadata/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dependabot%2Ffetch-metadata/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dependabot","download_url":"https://codeload.github.com/dependabot/fetch-metadata/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248497811,"owners_count":21113984,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T06:01:48.384Z","updated_at":"2025-05-14T12:09:24.282Z","avatar_url":"https://github.com/dependabot.png","language":"TypeScript","funding_links":[],"categories":["TypeScript","Actions","others"],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003e\n    \u003cpicture\u003e\n        \u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://user-images.githubusercontent.com/7659/174594540-5e29e523-396a-465b-9a6e-6cab5b15a568.svg\"\u003e\n        \u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://user-images.githubusercontent.com/7659/174594559-0b3ddaa7-e75b-4f10-9dee-b51431a9fd4c.svg\"\u003e\n        \u003cimg src=\"https://user-images.githubusercontent.com/7659/174594540-5e29e523-396a-465b-9a6e-6cab5b15a568.svg\" alt=\"Dependabot\" width=\"336\"\u003e\n    \u003c/picture\u003e\n\u003c/h1\u003e\n\n# Fetch Metadata Action\n\n**Name:** `dependabot/fetch-metadata`\n\nExtract information about the dependencies being updated by a Dependabot-generated PR.\n\n## Usage instructions\n\nCreate a workflow file that contains a step that uses: `dependabot/fetch-metadata@v2`, e.g.\n\n```yaml\n# .github/workflows/dependabot-prs.yml\nname: Dependabot Pull Request\non: pull_request\njobs:\n  dependabot:\n    permissions:\n      pull-requests: read\n    runs-on: ubuntu-latest\n    if: github.event.pull_request.user.login == 'dependabot[bot]' \u0026\u0026 github.repository == 'owner/my_repo'\n    steps:\n    - name: Fetch Dependabot metadata\n      id: dependabot-metadata\n      uses: dependabot/fetch-metadata@v2\n      with:\n        alert-lookup: true\n        compat-lookup: true\n        github-token: \"${{ secrets.PAT_TOKEN }}\"\n```\n\nSupported inputs are:\n\n- `github-token` (string)\n  - The `GITHUB_TOKEN` secret\n  - Defaults to `${{ github.token }}`\n  - Note: this must be set to a [personal access token (PAT)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) if you enable `alert-lookup` or `compat-lookup`.\n- `alert-lookup` (boolean)\n  - If `true`, then populate the `alert-state`, `ghsa-id` and `cvss` outputs.\n  - Defaults to `false`\n  - Note: the `github-token` field must be set to a [personal access token (PAT)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).\n- `compat-lookup` (boolean)\n  - If `true`, then populate the `compatibility-score` output.\n  - Defaults to `false`\n  - Note: the `github-token` field must be set to a [personal access token (PAT)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).\n- `skip-commit-verification` (boolean)\n  - If `true`, then the action will not expect the commits to have a verification signature. **It is required to set this to 'true' in GitHub Enterprise Server**\n  - Defaults to `false`\n- `skip-verification` (boolean)\n    - If `true`, the action will not validate the user or the commit verification status\n    - Defaults to `false`\n\nSubsequent actions will have access to the following outputs:\n\n- `steps.dependabot-metadata.outputs.dependency-names`\n  - A comma-separated list of the package names updated by the PR.\n- `steps.dependabot-metadata.outputs.dependency-type`\n  - The type of dependency has determined this PR to be.  Possible values are: `direct:production`, `direct:development` and `indirect`.  See [the `allow` documentation](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#dependency-type-allow) for descriptions of each.\n- `steps.dependabot-metadata.outputs.update-type`\n  - The highest semver change being made by this PR, e.g. `version-update:semver-major`. For all possible values, see [the `ignore` documentation](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--).\n- `steps.dependabot-metadata.outputs.updated-dependencies-json`\n  - A JSON string containing the full information about each updated Dependency.\n- `steps.dependabot-metadata.outputs.directory`\n  - The `directory` configuration that was used by dependabot for this updated Dependency.\n- `steps.dependabot-metadata.outputs.package-ecosystem`\n  - The `package-ecosystem` configuration that was used by dependabot for this updated Dependency.\n- `steps.dependabot-metadata.outputs.target-branch`\n  - The `target-branch` configuration that was used by dependabot for this updated Dependency.\n- `steps.dependabot-metadata.outputs.previous-version`\n  - The version that this PR updates the dependency from.\n- `steps.dependabot-metadata.outputs.new-version`\n  - The version that this PR updates the dependency to.\n- `steps.dependabot-metadata.outputs.alert-state`\n  - If this PR is associated with a security alert and `alert-lookup` is `true`, this contains the current state of that alert (OPEN, FIXED or DISMISSED).\n- `steps.dependabot-metadata.outputs.ghsa-id`\n  - If this PR is associated with a security alert and `alert-lookup` is `true`, this contains the GHSA-ID of that alert.\n- `steps.dependabot-metadata.outputs.cvss`\n  - If this PR is associated with a security alert and `alert-lookup` is `true`, this contains the CVSS value of that alert (otherwise it contains 0).\n- `steps.dependabot-metadata.outputs.compatibility-score`\n  - If this PR has a known compatibility score and `compat-lookup` is `true`, this contains the compatibility score (otherwise it contains 0).\n- `steps.dependabot-metadata.outputs.maintainer-changes`\n  - Whether or not the the body of this PR contains the phrase \"Maintainer changes\" which is an indicator of whether or not any maintainers have changed.\n- `steps.dependabot-metadata.outputs.dependency-group`\n  - The dependency group that the PR is associated with (otherwise it is an empty string).\n\n**Note:** By default, these outputs will only be populated if the target Pull Request was opened by Dependabot and contains\n**only** Dependabot-created commits. To override, see `skip-commit-verification` / `skip-verification`.\n\nFor workflows initiated by Dependabot (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by Dependabot (`github.event.pull_request.user.login == 'dependabot[bot]'`), the `GITHUB_TOKEN` will be read-only and secrets are not available.\n\nThis metadata can be used along with Action's [expression syntax](https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#functions) and the [GitHub CLI](https://github.com/cli/cli) to create\nuseful automation for your Dependabot PRs.\n\n### Auto-approving\n\nSince the `dependabot/fetch-metadata` Action will set a failure code if it cannot find any metadata, you can\nhave a permissive auto-approval on all Dependabot PRs like so:\n\n```yaml\nname: Dependabot auto-approve\non: pull_request\npermissions:\n  pull-requests: write\njobs:\n  dependabot:\n    runs-on: ubuntu-latest\n    # Checking the author will prevent your Action run failing on non-Dependabot PRs\n    if: github.event.pull_request.user.login == 'dependabot[bot]' \u0026\u0026 github.repository == 'owner/my_repo'\n    steps:\n      - name: Dependabot metadata\n        id: dependabot-metadata\n        uses: dependabot/fetch-metadata@v2\n      - uses: actions/checkout@v4\n      - name: Approve a PR if not already approved\n        run: |\n          gh pr checkout \"$PR_URL\" # sets the upstream metadata for `gh pr status`\n          if [ \"$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)\" != \"APPROVED\" ];\n          then gh pr review --approve \"$PR_URL\"\n          else echo \"PR already approved, skipping additional approvals to minimize emails/notification noise.\";\n          fi\n        env:\n          PR_URL: ${{github.event.pull_request.html_url}}\n          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}\n```\n\n### Enabling auto-merge\n\nIf you are using [the auto-merge feature](https://docs.github.com/en/github/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) on your repository,\nyou can set up an action that will enable Dependabot PRs to merge once CI and other [branch protection rules](https://docs.github.com/en/github/administering-a-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule) are met.  (Note that you must use a [personal access token (PAT)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) when executing the merge instruction.)\n\nFor example, if you want to automatically merge all patch updates to Rails:\n\n```yaml\nname: Dependabot auto-merge\non: pull_request\npermissions:\n  pull-requests: write\n  contents: write\njobs:\n  dependabot:\n    runs-on: ubuntu-latest\n    if: github.event.pull_request.user.login == 'dependabot[bot]' \u0026\u0026 github.repository == 'owner/my_repo'\n    steps:\n      - name: Dependabot metadata\n        id: dependabot-metadata\n        uses: dependabot/fetch-metadata@v2\n      - name: Enable auto-merge for Dependabot PRs\n        if: ${{contains(steps.dependabot-metadata.outputs.dependency-names, 'rails') \u0026\u0026 steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch'}}\n        run: gh pr merge --auto --merge \"${{github.event.pull_request.html_url}}\"\n        env:\n          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}\n```\n\n### Labelling\n\nIf you have other automation or triage workflows based on GitHub labels, you can configure an action to assign these based on the metadata.\n\nFor example, if you want to flag all production dependency updates with a label:\n\n```yaml\nname: Dependabot auto-label\non: pull_request\npermissions:\n  pull-requests: write\n  issues: write\n  repository-projects: write\njobs:\n  dependabot:\n    runs-on: ubuntu-latest\n    if: github.event.pull_request.user.login == 'dependabot[bot]' \u0026\u0026 github.repository == 'owner/my_repo'\n    steps:\n      - name: Dependabot metadata\n        id: dependabot-metadata\n        uses: dependabot/fetch-metadata@v2\n      - name: Add a label for all production dependencies\n        if: ${{ steps.dependabot-metadata.outputs.dependency-type == 'direct:production' }}\n        run: gh pr edit \"${{github.event.pull_request.html_url}}\" --add-label \"production\"\n        env:\n          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}\n```\n\n## Notes for project maintainers:\n\n\u003cdetails\u003e\u003csummary\u003e:book: Release guide\u003c/summary\u003e\n\u003cp\u003e\n\n  ## Dependabot PR's\n\n  - We expect Dependabot PRs to be passing CI and have any changes to the `dist/` folder built for production dependencies\n  - Some development dependencies may fail the `dist/` check if they modify the Typescript compilation, these should be updated manually via `npm run build`. See the [`dependabot-build`](https://github.com/dependabot/fetch-metadata/blob/main/.github/workflows/dependabot-build.yml) action for details.\n\n ## Tagging a new release\n\n  Publish a new release by running the [`Release - Bump Version`](https://github.com/dependabot/fetch-metadata/actions/workflows/release-bump-version.yml) workflow and following the instructions on the job summary.\n\n  In a nutshell the process will be:\n\n  1. Run the action to generate a version bump PR.\n  2. Merge the PR.\n  3. Tag that merge commit as a new release using the format `v1.2.3`. The job summary contains a URL pre-populated with the correct version for the title and tag.\n  4. Once the release is tagged, another GitHub Action workflow automatically publishes the new version of the immutable action package for this release.\n\n\u003c/p\u003e\n\u003c/details\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdependabot%2Ffetch-metadata","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdependabot%2Ffetch-metadata","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdependabot%2Ffetch-metadata/lists"}