Document how and when Dependabot triggers auto rebase

[yeikel]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates#changing-the-rebase-strategy-for-dependabot-pull-requests

What part(s) of the article would you like to see updated?

Dependabot's approach to auto-rebasing pull requests appears non-deterministic or unclear. According to the documentation:

By default, Dependabot automatically rebases pull requests to resolve any conflicts

However, this doesn't always happen immediately. Sometimes, Dependabot triggers a rebase when a pull request is out of date, but other times it doesn't.

Similarly, changes to the target branch may or may not prompt a rebase of existing pull requests, and this behavior seems inconsistent. Manually running a new update job doesn't trigger rebases, it only creates new pull requests. Manually forcing the rebase/recreate commands does work reliably, but it's unclear when it's necessary versus when Dependabot will handle it automatically.

Examples:

https://github.com/yeikel/dependabot-limit-tests/pull/113

The commit https://github.com/yeikel/dependabot-limit-tests/commit/d6b0effd627f75c9b1b4fa3593ffaf6d59a11b4d is expected to trigger a rebase to update the existing out of date pull requests. But as of the time of this message that did not happen yet. It may happen eventually, but that's what's confusing

Example out of date pull request:

Example of the current workflows running:

However, here is another similar scenario where the rebases did happen without intervention

[Sharra-writes]

@yeikel I'll ask the team about this and make sure there isn't some kind of bug that's causing inconsistencies.

[Sharra-writes]

@yeikel
From @jakecoffman:

This happens because GitHub can sometimes take a bit longer to calculate whether a branch is in conflict or “behind.” Due to the volume, Dependabot only asks once.

Most people don’t notice because Dependabot checks every time the base branch has a push. So another push or a merge to the main branch will cause it to check again.

I’m reluctant to document this info since it’s implementation details and subject to change. But perhaps we can say “By default, Dependabot makes a best effort to automatically rebase pull requests to resolve any conflicts.”

If you find that wording helpful, I'll run it by the rest of the docs team. I don't know if it clarifies that much, but maybe it's useful to note that Dependabot won't always succeed immediately.

[yeikel]

@Sharra-writes @jakecoffman

Thank you for clarifying.

I understand the challenge and I agree with the revised suggestion.

Beyond that, I have a follow-up question to ensure we're on the same page.

Does Dependabot only perform rebases to resolve merge conflicts, or is it also expected to automatically rebase when a branch is simply out of date in some scenarios?

I ask because I've also seen the latter mentioned around(or at least it does not explicitly say that it is only for merge conflicts in blogs like this

When changes in a repository make a Dependabot pull request out-of-date, Dependabot will automatically rebase it so that it is able to be merged without your manual effort

At the same time, I also noticed that an open issue about this exists: dependabot/dependabot-core#2224 so maybe I am answering my own question

[github-actions]

A stale label has been added to this issue, because it has been open for 30 days with no activity. If you think this issue should remain open, please add a new comment.