Multi-directory support bug with go, terraform, docker

[carlincherry]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

go

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

No response

Updated dependency

No response

What you expected to see, versus what you actually saw

#2178 (comment)

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

[lucacome]

Thanks @carlincherry!
You can see the config here https://github.com/nginxinc/nginx-gateway-fabric/blob/main/.github/dependabot.yml and the PR with only one update nginxinc/nginx-gateway-fabric#1921

[carlincherry]

This also happens in Terraform and Docker

[ivanvc]

This is my dependabot configuration: https://github.com/ivanvc/etcd/blob/77b2dfdaedc602904b208d91127b7a4d9ed66be7/.github/dependabot.yml#L9-L23.

A good example of it failing is that it created two PRs for the same dependency:

• build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.34.0 in /tools/mod ivanvc/etcd#41
• build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.34.0 ivanvc/etcd#40

In other instances, it created a single PR updating the dependency in a single location, rather than everywhere it is referenced:

ivanvc/etcd#38

tests/go.mod
69:     github.com/gorilla/websocket v1.4.2 // indirect

server/go.mod
56:     github.com/gorilla/websocket v1.4.2 // indirect

go.mod
59:     github.com/gorilla/websocket v1.4.2 // indirect

[ivanvc]

Now, it seems like dependabot stopped working with the configuration I provided. We're still getting dependabot PRs with the old configuration at etcd-io/etcd. But my fork (ivanvc/etcd), which has the new configuration, hasn't received any go-related version PR bumps.

The configuration seems to be valid as of ivanvc/etcd@ad4baf0: https://github.com/ivanvc/etcd/runs/24565853947. But there are no new PR in the last week: https://github.com/ivanvc/etcd/pulls?q=is%3Aopen+is%3Apr+author%3Aapp%2Fdependabot+label%3Ago