Repository navigation
Match Swift Dependabot group patterns on full package names - #6
Merged
Merged
Conversation
Dependabot names Swift dependencies by their normalized repository URL, not by the bare package identity. The metadata block on its commits shows this: 2682f8f (PR #4): dependency-name: github.com/apple/swift-log cf2d36b (PR #5): dependency-name: github.com/ajevans99/swift-json-schema Group patterns are matched against the whole name (the wildcard matcher anchors with ^...$), so the bare `swift-log` and `swift-argument-parser` patterns never matched anything. That is why PR #4 was opened on its own, with no `dependency-group:` line in its metadata, even though a 1.14.0 -> 1.15.1 bump is a minor update the group's update-types allow. Use the full names so the apple-swift group picks up both packages. Full names are preferred over `*swift-log`-style globs, which could also match a fork or an unrelated package with the same suffix.
k3KAW8Pnf7mkmdSMPHz27
deleted the
fix-dependabot-swift-group-patterns
branch
September 23, 2026 16:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
apple-swiftgroup in.github/dependabot.ymlnever matched anything. PR #4 bumped swift-log by itself ("Bump github.com/apple/swift-log from 1.14.0 to 1.15.1") when it should have been a grouped "Bump the apple-swift group …" PR.Evidence
Dependabot names Swift dependencies by their normalized repository URL, not by the bare package identity. The
updated-dependenciesmetadata on its commits:dependency-namedependency-group2682f8fgithub.com/apple/swift-logcf2d36bgithub.com/ajevans99/swift-json-schema0c5bfe9actions/checkoutactionsFor comparison, the working
actionsgroup writes adependency-group:line. The swift-log commit has none.The same result from dependabot-core's source:
Dependabot::Swift::UrlHelpers.normalize_namebuilds the name as host + path, lowercased, withwww., the trailing/and.gitstripped. Sohttps://github.com/apple/swift-log.gitbecomesgithub.com/apple/swift-log.WildcardMatcher.match?, which grouppatternsuse, is case-insensitive but anchored (^…$), and*is the only wildcard. A bareswift-logtherefore has to equal the whole name, and it never does.*as a wild card to define matches with dependency names". It doesn't mention substring matching.Group
update-typesdoesn't explain the separate PR. The swift-log bump wasversion-update:semver-minor, and the group allowsminorandpatch.Change
I used full names rather than
*swift-log-style globs. A full name matches exactly the package declared inPackage.swift. A suffix glob could also match a fork (github.com/someone/swift-log) or any package whose name ends the same way. Both packages are pinned to theirgithub.com/apple/…URLs, so a glob wouldn't match anything extra today.I ran the updated patterns through a local copy of
WildcardMatcherandnormalize_name. Both Apple packages now match, andswift-json-schemaandswift-sdkstill don't, so they keep getting their own PRs as before. The file still parses as YAML.The
github-actionsgroup ("*") works and is unchanged. Schedules and limits are unchanged too.