Display release notes for private packages that are successfully upgraded by Dependabot

[ntravis]

I did a search across issues and PRs looking for this sort of request (but I could have been using bad search terms). We use Dependabot to get notifications of both public and private packages, and it would be amazing if we could get the changelog feature that happens on public packages to work for our private ones. We typically publish release notes in a description on the particular release like so:

but then the resulting PR looks like this:

Looking at a PR for a public repo that uses releases:

It would be great if we could get that releases for our private repos since that is our primary method right now. If changelogs would be possible as an alternative or additive for teams that wanted to use it, I could champion that internally. So, the request is adding any and/or all of the various dropdowns (release notes, changelog, and commits) to private repo PRs.

Happy to clarify anything or provide more details.

[jurre]

I'm actually somewhat surprised that doesn't work, I'll look into why this doesn't work, and if it would be different for the GH native version of dependabot.

cc @jasonrudolph would be nice if we support this when private registries land in the GH native version!

[asciimike]

@ntravis we just launched support for private registries in beta, would you ming adding the registries where those release notes are and see if it works?

[carusogabriel]

Hey guys, I'd like to share that we face this same problem at https://github.com/usabilla. As far as we debugged, both dependabot-preview and dependabot have the same issue: PRs opened for private dependencies, aka behind a private packagist, do not have their release notes attached :)

Let us know if there's something we can debug, or do, to help you with this issue.

[carusogabriel]

Hey, looks like this one is fixed for now 🎉

This morning we received some internal updates for our packages, they contained the release notes 🙏🏻

(idk if this is per language, but if it is: PHP I'm talking about)

[feelepxyz]

@carusogabriel 🎉 this should work in github-native dependabot where we've made changes to how PR creation works with private registry credentials. There might be cases where we don't find the correct release notes but that should be per package.

[maciejmakowski]

is there something additional that needs to be done to make this work?

Updates as such work just fine for us, but we have also given access to private repositories explicitely as stated here just to be sure:
https://github.blog/2021-03-15-dependabot-private-dependencies/#updates-from-private-github-repositories

However, we still do not see the same level of detail in our dependabot PRs as we've seen with dependabot-preview. Note that the link to the repo and the commits is generated, but releases are not:

Also note that the "See full diff in compare view" link only links to /commits and doesn't actually show commits between the two release tags like it does below for dependabot-preview.

For comparison, this is the same library bump on the same repo that was done by dependabot-preview before we switched:

Also note that this is specifically for Ruby gems / Bundler, not sure if that makes a difference.

Can someone please provide any pointers how to make the Github native dependabot provide the same level of details in the PR description including correctly identifying and listing all the releases and commits between the previous and current version?

[ntravis]

I've gone through the process of directly giving dependabot access to python package repos in our org, but this doesn't seem like an easily sustainable option. Our PHP devs are creating new package repos every other day, so how are teams supposed to manage remembering to add that access every time?

Will reply back here with results after a python package release happens.

[maciejmakowski]

@ntravis any luck?

@asciimike could you take another look please?

We continue to see that the same library that is being bumped with dependabot and doesn't generate a proper PR description and in parallel dependabot-preview creates the same bump on another repo that wasn't migrated to Github native dependabot and it generates the description properly. So we're pretty sure it's not about how we have set up the library.

I suspect it has either something to do with the (Github native) Dependabot configuration or there's a bug somewhere still. Either way we can't figure out so far how to fix it.

[ntravis]

no luck on my end. here's an example:

on my repo, billboard, I have a private dependency fool-auth. I know that they recently updated to version six and had previously allowed access to the fool-auth repo (even though I'm not sure it is required but the wording is a bit ambiguous). We typically only publish release notes on github and do not codify them into a file or put them up in our package manager at this time.

The new PR on billboard does not display anything related to the release notes from Github:

[maciejmakowski]

@asciimike can we reopen this issue to continue tracking this here or should we create a separate issue?

[dudo]

I work with @maciejmakowski - if it helps, here's an offending dependabot.yml

version: 2
registries:
  rubygems-server-gem-fury-io-company:
    type: rubygems-server
    url: https://gem.fury.io/company
    token: "${{secrets.RUBYGEMS_SERVER_GEM_FURY_IO_COMPANY_TOKEN}}"

updates:
- package-ecosystem: bundler
  directory: "/"
  schedule:
    interval: daily
    time: "07:00"
    timezone: America/Los_Angeles
  pull-request-branch-name:
    separator: "-"
  open-pull-requests-limit: 10
  versioning-strategy: lockfile-only
  registries:
  - rubygems-server-gem-fury-io-company

[asciimike]

@dudo @maciejmakowski thanks for the info, we're looking into it now!

[jurre]

For Dependabot to be able to fetch the CHANGELOG / release notes contents, it needs to know the source repo that contains this, for Bundler it'll hit the gem server API or download the gemspec and grab the changelog_uri or a few other possible keys from there. It then uses the GitHub (or GitLab if it's hosted there) API to access that repository and find the changelog/release notes.

@maciejmakowski or @dudo since you mention this worked in preview, my best guess is that GH native dependabot does not have access to the repo. Alternatively, the gemspec might not include the required details? Could you check the logs for that update (they should be in https://github.com/:org/:repo/network/updates then click into bundler) and see if there are any 404 or 401 responses to that endpoint? Alternatively, if you pass me the job id listed in those logs I'd be happy to take a look.

@ntravis the same goes for python, could you verify that the response for https://<your.registry>/<dependency_name/json exposes one of these fields, and that dependabot has access to that repo (you mention it does so that's probably 👍)

[maciejmakowski]

@jurre thanks for the pointers.

I double-checked the logs of the latest run for the repo and that specific dependency update and I don't see any issues to get the access to the gem information in gemfury (see config sample that @dudo shared above).

The job id referenced in the logs I was looking at is: 142043928

Our gemspec includes the source_code_uri (dependabot-preview appears to have started being happy when we added that a while back). We only generate release in Github automatically and do not update the changelog (automatically or manually) at this point, so we don't use set changelog_uri. We're fine with just having "Release notes" and "Commits" show up in the PR description (see screenshot above from dependabot-preview).

Also, just to clarify: Our gems (coming from gemfury) are set up pretty consistently in terms of gem meta-information and we see issues with the PR description details on all of them when dependabot creates the PR and we seem to be fine when dependabot-preview creates them.

Please let us know if you have any pointers for what to fix should this be a configuration issue on our end.

[maciejmakowski]

@jurre did you have a chance to look into this by any chance?

[ntravis]

@ntravis the same goes for python, could you verify that the response for https://<your.registry>/<dependency_name/json exposes one of these fields, and that dependabot has access to that repo (you mention it does so that's probably 👍)

@jurre hmm, it doesn't look like Nexus Repository Manager exposes a JSON endpoint but neither does pypi from just copy-pasta attempt. Do you have an example from pypi that I could try to translate to Nexus?

[jurre]

@jurre did you have a chance to look into this by any chance?

my best guess is that GH native dependabot does not have access to the repo

^ is still my best guess here, https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-repositories

If you could share the repo Dependabot is configured on and the repo of the dependency it's trying to update, that'd make it easier for me to check up on how it's set up. Feel free to go through support if these are sensitive.

[jurre]

@ntravis the same goes for python, could you verify that the response for https://<your.registry>/<dependency_name/json exposes one of these fields, and that dependabot has access to that repo (you mention it does so that's probably 👍)

@jurre hmm, it doesn't look like Nexus Repository Manager exposes a JSON endpoint but neither does pypi from just copy-pasta attempt. Do you have an example from pypi that I could try to translate to Nexus?

https://pypi.org/pypi/Django/json for example

[maciejmakowski]

@jurre I have submitted a ticket for this.

[mctofu]

For Bundler, Hex and Python we don't yet support the private repository access feature: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#package-ecosystem

In order to retrieve release notes from a private repo in those ecosystems you'll need to add a git registry to your dependabot.yaml with a PAT that can access the private repos: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#git

Then link it to any ecosystems that need access: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#registries

[maciejmakowski]

@mctofu thank you for the additional information. Is there an ETA by when you will support it?

We will try changing things according to the latest instructions and see whether this resolves the issue on a few selected repos. Doing it on all the repos will be significantly more work.

As for instructions, I think it might be helpfu to emphasize this more in the PRs that Deploybot creates to migrate to from dependabot-preview -> Githib-native dependabot. This document is linked from there, but it's not super specific about private Github repos. It seems to be rather focused on access to private artifact registries, at least the way I read it.

What's linked from there is the article and that does not seem to be directing people in the right direction either, as far as I understand.

[asciimike]

I don't generally like to give timelines (the ones we do give are on https://github.com/github/roadmap), but I'd put this in the "medium priority" camp: lower than the things directly referenced on the roadmap, but higher than most of the things labeled "feature request" in this repo.

I'll see if there's a better way of clearing up confusion in the migration docs (e.g. pointing people to git registries vs repos).

If things aren't working, feel free to re-open!

[vweevers]

I don't see NuGet (specifically GitHub Packages on a private org) mentioned in this thread. It seems to have the same problem: no release notes or commit log in PRs from Dependabot. I checked the following:

• The private dependency has a GitHub Release, a CHANGELOG.md (in git, not the package) and git tags (in form of v1.2.3)
• The repository name matches the NuGet package name
• The *.nuspec file contains the necessary metadata: <repository type="git" url="https://github.com/ORG/REPO" />

Which matches the following logic (I looked for the nuget equivalent of the bundler link that was shared above):

dependabot-core/nuget/lib/dependabot/nuget/metadata_finder.rb

Lines 19 to 22 in a35b58b

	potential_source_urls = [
	nuspec.at_css("package > metadata > repository")&.
	attribute("url")&.value,
	nuspec.at_css("package > metadata > repository > url")&.content,

Lastly, here's the Dependabot log if it helps (with ORG and PACKAGE placeholders):

Click to expand

updater | INFO <job_***> Checking if PACKAGE 2.0.1 needs updating
  proxy | 2021/12/08 16:16:03 [032] GET https://nuget.pkg.github.com:443/ORG/index.json
  proxy | 2021/12/08 16:16:03 [032] * authenticating nuget feed request (host: nuget.pkg.github.com, basic auth)
  proxy | 2021/12/08 16:16:03 [032] 200 https://nuget.pkg.github.com:443/ORG/index.json
  proxy | 2021/12/08 16:16:03 [034] GET https://nuget.pkg.github.com:443/ORG/query?q=PACKAGE&prerelease=true
  proxy | 2021/12/08 16:16:03 [034] * authenticating nuget feed request (host: nuget.pkg.github.com, basic auth)
  proxy | 2021/12/08 16:16:04 [034] 200 https://nuget.pkg.github.com:443/ORG/query?q=PACKAGE&prerelease=true
  proxy | 2021/12/08 16:16:04 [036] GET https://api-v2v3search-0.nuget.org:443/query?q=PACKAGE&prerelease=true
updater | INFO <job_***> Latest version is 2.0.2

The response of one of those (https://nuget.pkg.github.com:443/ORG/query?q=PACKAGE&prerelease=true) also contains "projectUrl": "https://github.com/ORG/REPO" which could be used as an alternative metadata source.

[jurre]

@vweevers for debugging issues with private repo's and registries, it's usually easiest if you open a ticket via support, because that way we can reference the repo in question without worrying about exposing private data in a public forum.

Based on what you described, my initial hunch would be that Dependabot has access to the private package, but not the private repository that backs it. So we are able to pull the latest version, but cannot access the repo to fetch metadata like release-notes from.

I'd recommend try giving dependabot access to the repo (docs). If that doesn't work, would you mind opening an issue with GitHub Support so we can discuss it?

[dhruvCW]

I am facing the same issue mentioned here https://github.com/dhruv-test-org/test-app/pull/11

I created a test gem and repository so it's visible publicly, the gem is published on the github package registry if that makes a difference, though try as I might I cannot show the changelog nor the commit diff.

I am using github native dependabot if that helps, would really appreciate some help figuring out how to fix this 😅 if it's possible.

[maciejmakowski]

@dhruvCW did you give the user that the token ${{secrets.DEPENDABOT_TOKEN}} is assigned to (at least) read access to the repo where the gem is located and did you set the meta information in the gem so that Dependabot knows where to look for the information while processing the gem?

[dhruvCW]

It's my PAT so I do have read access, and Dependabot was given access via the org as well. The PAT had repo scope.

For the metadata I have set the source_code_uri and changelog_uri like so

s.metadata = {
  "changelog_uri"     => "https://github.com/dhruv-test-org/test-gem/blob/v#{s.version}/CHANGELOG.md",
  "source_code_uri"   => "https://github.com/dhruv-test-org/test-gem/tree/v#{s.version}"
}

[maciejmakowski]

I think this should just be:

s.metadata = {
  "changelog_uri"     => "https://github.com/dhruv-test-org/test-gem/",
  "source_code_uri"   => "https://github.com/dhruv-test-org/test-gem/"
}

That's what we have anyhow in all of our gems, and it appears to work fine.

Disclaimer as well: We don't bother with Changelog. We purely rely on creating Github releases (which automatically also create tags) and those being parsed by Dependabot.

[dhruvCW]

Disclaimer as well: We don't bother with Changelog. We purely rely on creating Github releases (which automatically also create tags) and those being parsed by Dependabot.

I would love to do that too, I originally did set them up as you mentioned but it didn't seem to work, are you also using the github private registry ? or something else ?

[maciejmakowski]

Yes, our Dependabot settings look pretty much the same as yours in terms of registries.

[dhruvCW]

Just created a new test gem (different name) same organisation. dependabot doesn't seem to even try and access the repository. the generated PR

doesn't even matter if the gem repo is public or not. at this point I am extremely out of ideas.

updater | INFO <job_451876915> Checking if dhruv-gem 0.2.0 needs updating
  proxy | 2022/09/02 19:13:08 [020] GET https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:08 [020] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:08 [020] 404 https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:08 [022] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:08 [022] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:08 [022] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:08 [024] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=dhruv-gem
  proxy | 2022/09/02 19:13:08 [024] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:08 [024] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=dhruv-gem
updater | INFO <job_451876915> Latest version is 0.3.0
  proxy | 2022/09/02 19:13:08 [026] GET https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:08 [026] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:08 [026] 404 https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:09 [028] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:09 [028] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:09 [028] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:09 [030] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=dhruv-gem%2Ctest-gem
  proxy | 2022/09/02 19:13:09 [030] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:09 [030] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=dhruv-gem%2Ctest-gem
  proxy | 2022/09/02 19:13:09 [032] GET https://index.rubygems.org:443/versions
  proxy | 2022/09/02 19:13:09 [032] 206 https://index.rubygems.org:443/versions
  proxy | 2022/09/02 19:13:11 [034] GET https://index.rubygems.org:443/info/activemodel
  proxy | 2022/09/02 19:13:11 [034] 200 https://index.rubygems.org:443/info/activemodel
  proxy | 2022/09/02 19:13:11 [036] GET https://index.rubygems.org:443/info/activerecord
  proxy | 2022/09/02 19:13:11 [036] 200 https://index.rubygems.org:443/info/activerecord
  proxy | 2022/09/02 19:13:11 [039] GET https://index.rubygems.org:443/info/bcrypt-ruby
  proxy | 2022/09/02 19:13:11 [040] GET https://index.rubygems.org:443/info/arel
  proxy | 2022/09/02 19:13:11 [039] 200 https://index.rubygems.org:443/info/bcrypt-ruby
  proxy | 2022/09/02 19:13:11 [040] 200 https://index.rubygems.org:443/info/arel
  proxy | 2022/09/02 19:13:11 [042] GET https://index.rubygems.org:443/info/activerecord-deprecated_finders
  proxy | 2022/09/02 19:13:11 [042] 200 https://index.rubygems.org:443/info/activerecord-deprecated_finders
  proxy | 2022/09/02 19:13:11 [044] GET https://index.rubygems.org:443/info/bcrypt
  proxy | 2022/09/02 19:13:11 [044] 200 https://index.rubygems.org:443/info/bcrypt
updater | INFO <job_451876915> Requirements to unlock own
updater | INFO <job_451876915> Requirements update strategy bump_versions
updater | INFO <job_451876915> Updating dhruv-gem from 0.2.0 to 0.3.0
  proxy | 2022/09/02 19:13:12 [046] GET https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:12 [046] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:12 [046] 404 https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:12 [048] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:12 [048] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:12 [048] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:12 [050] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=dhruv-gem%2Ctest-gem
  proxy | 2022/09/02 19:13:12 [050] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:12 [050] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=dhruv-gem%2Ctest-gem
  proxy | 2022/09/02 19:13:13 [052] GET https://index.rubygems.org:443/versions
  proxy | 2022/09/02 19:13:13 [052] 304 https://index.rubygems.org:443/versions
  proxy | 2022/09/02 19:13:14 [054] GET https://api.github.com:443/repos/dhruv-test-org/test-app/commits?per_page=100
  proxy | 2022/09/02 19:13:14 [054] * authenticating github api request
  proxy | 2022/09/02 19:13:14 [054] 200 https://api.github.com:443/repos/dhruv-test-org/test-app/commits?per_page=100
  proxy | 2022/09/02 19:13:14 [056] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/gems/dhruv-gem.json
  proxy | 2022/09/02 19:13:14 [056] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:14 [056] 404 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/gems/dhruv-gem.json
  proxy | 2022/09/02 19:13:15 [058] GET https://rubygems.pkg.github.com:443/dhruv-test-org/quick/Marshal.4.8/dhruv-gem-0.3.0.gemspec.rz
  proxy | 2022/09/02 19:13:15 [058] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:15 [058] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/quick/Marshal.4.8/dhruv-gem-0.3.0.gemspec.rz
updater | INFO <job_451876915> Submitting dhruv-gem pull request for creation
updater | INFO <job_451876915> Checking if test-gem 3.0.0 needs updating
  proxy | 2022/09/02 19:13:17 [062] GET https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:17 [062] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:17 [062] 404 https://rubygems.pkg.github.com:443/dhruv-test-org/versions
  proxy | 2022/09/02 19:13:17 [064] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:17 [064] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:17 [064] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies
  proxy | 2022/09/02 19:13:17 [066] GET https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=test-gem
  proxy | 2022/09/02 19:13:17 [066] * authenticating rubygems server request (host: rubygems.pkg.github.com)
  proxy | 2022/09/02 19:13:17 [066] 200 https://rubygems.pkg.github.com:443/dhruv-test-org/api/v1/dependencies?gems=test-gem
updater | INFO <job_451876915> Latest version is 3.0.0
updater | INFO <job_451876915> No update needed for test-gem 3.0.0
updater | INFO <job_451876915> Checking if sqlite3 1.4.4 needs updating
  proxy | 2022/09/02 19:13:17 [068] GET https://rubygems.org:443/api/v1/versions/sqlite3.json
  proxy | 2022/09/02 19:13:17 [068] 200 https://rubygems.org:443/api/v1/versions/sqlite3.json
updater | INFO <job_451876915> Latest version is 1.4.4
updater | INFO <job_451876915> No update needed for sqlite3 1.4.4
updater | INFO <job_451876915> Finished job processing
updater | INFO Results:
updater | +---------------------------------------------+
updater | |     Changes to Dependabot Pull Requests     |
updater | +---------+-----------------------------------+
updater | | created | dhruv-gem ( from 0.2.0 to 0.3.0 ) |
updater | +---------+-----------------------------------+
updater | time="2022-09-02T19:13:18Z" level=info msg="task complete" container_id=job-451876915-updater exit_code=0 job_id=451876915 step=updater