Skip to content

Skip auto-generated ignore conditions for git SHA versions#616

Open
JamieMagee wants to merge 1 commit intomainfrom
skip-ignore-conditions-for-sha-versioned-ecosystems
Open

Skip auto-generated ignore conditions for git SHA versions#616
JamieMagee wants to merge 1 commit intomainfrom
skip-ignore-conditions-for-sha-versioned-ecosystems

Conversation

@JamieMagee
Copy link
Copy Markdown
Member

generateIgnoreConditions adds a version-requirement: '>X' entry per create_pull_request output so regenerated smoke tests stay stable. When X is a 40-character git SHA, Ruby's Gem::Requirement rejects it (BadRequirementError: Illformed requirement) and the smoke test run fails.

The previous workaround was an inline pm != "submodules" check that disabled the whole ecosystem. That worked for submodules (always SHAs) but doesn't fit nix, which mixes SHA-pinned and tag-pinned (semver) flake inputs in the same lock file. Skipping the entire ecosystem would also skip the legitimate semver tag deps. See dependabot/smoke-tests#479 for the failure that prompted this.

This PR moves the check down to the individual condition: if a dependency's version matches a 40-character hex SHA, skip generating an ignore for it. Semver versions in any ecosystem still get one; SHAs are skipped wherever they appear. The existing gitShaRegex (already used to validate Source.Commit) is reused.

Test coverage: Test_generateIgnoreConditions/skips_git_SHA_versions asserts that a mixed dependency list produces a condition only for the semver entry.

`generateIgnoreConditions` produces `version-requirement: '>X'` per
`create_pull_request` output. When `X` is a 40-character git SHA
(submodules, nix flake inputs pinned to a branch or rev), Ruby's
`Gem::Requirement` rejects it as ill-formed and the smoke test fails.

The previous workaround was an inline `pm != "submodules"` check that
disabled generation for the entire ecosystem. That doesn't work for
nix, which can mix SHA-pinned and tag-pinned (semver) flake inputs in
the same lock file.

Detect git SHAs at the individual condition level instead. Semver-style
versions in any ecosystem still get a stability ignore condition; SHAs
are skipped wherever they appear (see dependabot/smoke-tests#479).
@JamieMagee JamieMagee requested review from a team as code owners April 28, 2026 23:16
@JamieMagee JamieMagee enabled auto-merge April 28, 2026 23:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant