Dependabot recreate / rebase not working

[jack-berg]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

gradle

Package manager version

maven

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

No response

Updated dependency

No response

What you expected to see, versus what you actually saw

I expected rebase / recreate to rebase / recreate the PR respectively. Instead, no updates are made to the PR commits. The PR description is temporarily changed to indicate some work is happening, but nothing is changed when the description returns to normal.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

The commands recreate and rebase don't do anything. When I comment with those commands, dependabot adds a 👍 emoji, the PR temporarily has its description changed to:

⚠️ Dependabot is rebasing this PR ⚠️
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Eventually, the description is restored, but no changes have be applied. I'm forced to manually resolve conflicts.

Examples:

• Bump com.github.johnrengelman.shadow from 8.1.0 to 8.1.1 open-telemetry/opentelemetry-java#5315
• Bump com.gradle.enterprise from 3.12.4 to 3.12.5 open-telemetry/opentelemetry-java#5316
• Bump slf4jVersion from 2.0.6 to 2.0.7 open-telemetry/opentelemetry-java#5310

Many more examples available upon request.

Seems to be a duplicate of #1645 but the advice in that issue is that "catch all" issues aren't helpful and I should open a new issue.

Smallest manifest that reproduces the issue

No response

[jeffwidman]

Hmm... I'm not seeing any conflicts on those PR's?

[jack-berg]

They need to rebase to incorporate updates to the target branch required for the build to pass. See this other PR where I manually merged main into the dependabot branch and the build now passes. I should be able to rebase or recreate to achieve the same affect.

[rturner3]

I am also seeing the same issue on several PRs:
spiffe/spire#4015
spiffe/spire#4016

[ikisler]

I am also running into this issue in multiple JS repos, but unfortunately they are all private so I can't share examples.

[nibynool]

Like @ikisler I'm also experiencing this on some JS/TS private repos. About 95% of the time asking dependabot to close the PR and then asking it to reopen it, then requesting a recreate or rebase will get things moving again. In the other 5% of cases I will wait for my team to push some additional changes to master/main and that will get the rebase going.

[jeffwidman]

Yeah, this unfortunately isn't one we can just ask you to repro on a public repository because it's a non-deterministic issue of some kind related to the service that GitHub runs.

I think the best thing to do here is to create a GitHub support ticket so you can point to the specific examples in your private repo, feel free to link specifically to this issue, and then one of us can dig into it to see if there's a race or some infra / DB flake that we're not properly recovering from.

I'm going to close as this isn't one we can really address via the public issue tracker.

[jack-berg]

@jeffwidman can you clarify why this is closed? The original issue I posted was reproducible on a public repo. Was this not an appropriate forum?

[jeffwidman]

Ah yeah, I missed that sorry. Let me re-open this one.

We will almost certainly end up having an internal ticket on our side to track the investigation and any internal facing notes about DB/service, and using the support ticket that we get is a good placeholder for that conversation, but there's nothing needed more from you, so no need for you to jump through the hoops necessary for that.

For anyone else who comes along, please open separate tickets... in general a public ticket linking to a publicly reproducible repository is preferred, but for something like this where it may only manifest on your private repo, then an internal support ticket is okay.

[jakecoffman]

I can see in the server logs that Dependabot ran the rebase, but when it posted the PR update to GitHub, it went silent. I'm adding additional logging on the server-side to get a better idea of what is happening. We need to capture what the error is from GitHub in order to address it.

Let me know if it happens again to another PR.

[jack-berg]

Let me know if it happens again to another PR.

Will do! Thanks for the update.

[jack-berg]

@jakecoffman just had another occurrence here.

[jakecoffman]

@jack-berg can you give it the rebase command one more time?

[jack-berg]

Just ran it.

[jakecoffman]

Thanks I was able to capture the error with the new logging: 422 - At least 1 approving review is required by reviewers with write access.

It looks like that repo has a wildcard branch protection rule. I think it is preventing Dependabot from force pushing to the branch it created.

[jack-berg]

Huh. There's a branch protection rule for branching matching dependabot/**/** which applies to this branch. It does require approvals (which we want), but is configured to allow force pushes by all users with push access. Seems weird that I would need to remove a required approvals setting to allow force pushing. Can I somehow grant dependabot push / write acces?

[jack-berg]

Oh never mind I see. The "Require a pull request before merging" setting dictates that changes can't be made to the dependabot branches except through a pull request.

[jack-berg]

Removed that setting and it worked. Thanks for looking into that @jakecoffman! I didn't se anything like that in the docs, but maybe I missed something. If not, would be good to add it so folks like me that self help. Thanks again! 🙂

[asbjornu]

Please allow me to echo @jack-berg's request:

I didn't se anything like that in the docs, but maybe I missed something. If not, would be good to add it so folks like me that self help.

I just ran into this problem myself, where @dependabot rebase and @dependabot recreate caused Dependabot to thumbs up my comment and mark the original pull request message with:

⚠️ Dependabot is rebasing this PR ⚠️

However, no force-push was performed by Dependabot no matter how long I waited (over 24 hours for a particular pull request). I'm not sure how to tweak the branch protection rules in my repositories to allow Dependabot to do its thing. Just to be clear: I only have branch protection rules for main in my repositories, there are no rules defined for dependabot/**.

I would expect Dependabot to respond to the pull request with a comment explaining why it was unable to update it. Isn't that a reasonable thing to expect, @jakecoffman?