Skip to content

Dependabot submodule updates are broken #3198

Closed
#3201
Closed
Dependabot submodule updates are broken#3198
#3201
Labels
bugSomething isn't working

Description

@victor-gp
victor-gp
opened on Feb 3, 2025

(It's probably an upstream error. It should be easily mitigable on bat's side but I lack context to say for sure.)

The Dependabot action to update submodules has been failing since at least the last couple of months.

The two runs we can access both fail on the same step:

2025-02-01T03:34:09.3613620Z   proxy | 2025/02/01 03:34:09 [066] GET https://api.github.com:443/repos/sharkdp/bat/contents/assets/syntaxes/02_Extra/JavaScript%20(Babel)?ref=4fc55cfcec44dba3f67bd79cac9ccf64dc18eb08
2025-02-01T03:34:09.3614825Z   proxy | 2025/02/01 03:34:09 [066] * authenticating github api request with token for api.github.com
2025-02-01T03:34:09.4715821Z   proxy | 2025/02/01 03:34:09 [066] 404 https://api.github.com:443/repos/sharkdp/bat/contents/assets/syntaxes/02_Extra/JavaScript%20(Babel)?ref=4fc55cfcec44dba3f67bd79cac9ccf64dc18eb08
2025-02-01T03:34:09.4737486Z updater | 2025/02/01 03:34:09 ERROR <job_956925857> Error during file fetching; aborting: assets/syntaxes/02_Extra/JavaScript (Babel) not found

Previous runs are all deleted because of the GitHub Actions' eviction policy. But there's a Dependabot message in a previously-created PR that reports an error on fetching this same submodule.

I only noticed because I was expecting cmd-help to be auto-bumped and it was not.

I think I have tracked the bug to the GitHub API, I have reported it here.

Mitigation

The bug seems to affect submodule files/mappings that contain spaces in their name. We could change those paths to remove spaces and it should fix this workflow.

e.g.:

# .gitmodules
[submodule "assets/syntaxes/JavaScript (Babel)"]
- 	path = assets/syntaxes/02_Extra/JavaScript (Babel)
+ 	path = assets/syntaxes/02_Extra/JavaScript(Babel)

If the error persists, we may try removing parentheses too. But the only bug I've been able to prove is with spaces.

Activity

  1. victor-gp
    added
    bugSomething isn't working
    on Feb 3, 2025

  2. keith-hall commented on Feb 3, 2025

    @keith-hall
    keith-hall
    on Feb 3, 2025
    Collaborator

    Thanks for investigating and reporting! I'd be okay with removing the space in the name for now to see if it helps

  3. victor-gp commented on Feb 3, 2025

    @victor-gp
    victor-gp
    on Feb 3, 2025
    ContributorAuthor

    Cool, I'll try my hand at this if that's ok.

    It seems I can test these GitHub API calls on my fork too.

    Also, thank you (first) for bat!

  4. victor-gp
    added a commit that references this issue on Feb 3, 2025

    Replace spaces in git submodule paths

    0ed527f
  5. keith-hall
    closed this as completedin #3201on Feb 4, 2025

  6. victor-gp commented on Mar 1, 2025

    @victor-gp
    victor-gp
    on Mar 1, 2025
    ContributorAuthor

    It apparently worked:

    Image

    But it's weird because it should have created quite a few more PRs.

    From the end of the logs:

    updater | 2025/03/01 03:05:12 INFO <job_972488185> Finished job processing
updater | 2025/03/01 03:05:12 INFO Results:
+---------------------------------------------------------------------------------------+
|                          Changes to Dependabot Pull Requests                          |
+---------+-----------------------------------------------------------------------------+
| created | assets/syntaxes/02_Extra/Nix ( from `9032bd6` to `48c497c` )                |
| created | assets/syntaxes/02_Extra/Zig ( from `1a4a384` to `8a4a3fe` )                |
| created | assets/syntaxes/02_Extra/Org_mode ( from `4976d8f` to `bb6e5d8` )           |
| created | assets/syntaxes/02_Extra/cmd-help ( from `209559b` to `68e727b` )           |
| created | assets/syntaxes/02_Extra/PowerShell ( from `c0372a1` to `a08b55b` )         |
| created | assets/syntaxes/02_Extra/Idris2 ( from `7c1bf44` to `ba8e925` )             |
| created | assets/syntaxes/02_Extra/Apache ( from `163bc03` to `08fac4f` )             |
| created | assets/syntaxes/02_Extra/CFML ( from `b91c44a` to `28a76c3` )               |
| created | assets/syntaxes/02_Extra/VimL ( from `ee85822` to `fe5bf5e` )               |
| created | assets/syntaxes/02_Extra/ssh-config ( from `bf49e91` to `aab74b1` )         |
| created | assets/themes/zenburn ( from `86d4ee7` to `9abc728` )                       |
| created | assets/syntaxes/02_Extra/Crontab ( from `54f1fa7` to `8021de7` )            |
| created | assets/syntaxes/02_Extra/Fish ( from `98316d4` to `fdc9fc2` )               |
| created | assets/syntaxes/02_Extra/JavaScript_(Babel) ( from `f4579f9` to `2b3608c` ) |
+---------+-----------------------------------------------------------------------------+

    But only the first 4 received a PR.

  7. victor-gp commented on Mar 1, 2025

    @victor-gp
    victor-gp
    on Mar 1, 2025
    ContributorAuthor

    Ok, actually, this seems to be default Dependabot behavior. From their docs:

    Dependabot default behavior:

    If five pull requests with version updates are open, no further pull requests are raised until some of those open requests are merged or closed.

    Security updates have a separate, internal limit of ten open pull requests which cannot be changed.

    This checks out because it's these 4 PRs plus an already open one for syntaxes/**/Docker.

  8. tmeijn
    added a commit that references this issue on Oct 22, 2025

    build(deps): update sharkdp/bat to v0.26.0

    60c0a0f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions