Skip to content

Match Swift Dependabot group patterns on full package names - #6

Merged
k3KAW8Pnf7mkmdSMPHz27 merged 1 commit into
mainfrom
fix-dependabot-swift-group-patterns
Sep 23, 2026
Merged

k3KAW8Pnf7mkmdSMPHz27 merged 1 commit into
mainfrom
fix-dependabot-swift-group-patterns

Conversation

@k3KAW8Pnf7mkmdSMPHz27

Copy link
Copy Markdown
Owner

Problem

The apple-swift group in .github/dependabot.yml never matched anything. PR #4 bumped swift-log by itself ("Bump github.com/apple/swift-log from 1.14.0 to 1.15.1") when it should have been a grouped "Bump the apple-swift group …" PR.

Evidence

Dependabot names Swift dependencies by their normalized repository URL, not by the bare package identity. The updated-dependencies metadata on its commits:

Commit PR dependency-name dependency-group
2682f8f #4 (swift-log) github.com/apple/swift-log none
cf2d36b #5 (swift-json-schema) github.com/ajevans99/swift-json-schema none
0c5bfe9 #2 (actions) actions/checkout actions

For comparison, the working actions group writes a dependency-group: line. The swift-log commit has none.

The same result from dependabot-core's source:

  • Dependabot::Swift::UrlHelpers.normalize_name builds the name as host + path, lowercased, with www., the trailing / and .git stripped. So https://github.com/apple/swift-log.git becomes github.com/apple/swift-log.
  • WildcardMatcher.match?, which group patterns use, is case-insensitive but anchored (^…$), and * is the only wildcard. A bare swift-log therefore has to equal the whole name, and it never does.
  • GitHub's options reference agrees: patterns "support using * as a wild card to define matches with dependency names". It doesn't mention substring matching.

Group update-types doesn't explain the separate PR. The swift-log bump was version-update:semver-minor, and the group allows minor and patch.

Change

         patterns:
-          - swift-log
-          - swift-argument-parser
+          - github.com/apple/swift-log
+          - github.com/apple/swift-argument-parser

I used full names rather than *swift-log-style globs. A full name matches exactly the package declared in Package.swift. A suffix glob could also match a fork (github.com/someone/swift-log) or any package whose name ends the same way. Both packages are pinned to their github.com/apple/… URLs, so a glob wouldn't match anything extra today.

I ran the updated patterns through a local copy of WildcardMatcher and normalize_name. Both Apple packages now match, and swift-json-schema and swift-sdk still don't, so they keep getting their own PRs as before. The file still parses as YAML.

The github-actions group ("*") works and is unchanged. Schedules and limits are unchanged too.

Dependabot names Swift dependencies by their normalized repository URL,
not by the bare package identity. The metadata block on its commits
shows this:

  2682f8f (PR #4):  dependency-name: github.com/apple/swift-log
  cf2d36b (PR #5):  dependency-name: github.com/ajevans99/swift-json-schema

Group patterns are matched against the whole name (the wildcard
matcher anchors with ^...$), so the bare `swift-log` and
`swift-argument-parser` patterns never matched anything. That is why
PR #4 was opened on its own, with no `dependency-group:` line in its
metadata, even though a 1.14.0 -> 1.15.1 bump is a minor update the
group's update-types allow.

Use the full names so the apple-swift group picks up both packages.
Full names are preferred over `*swift-log`-style globs, which could
also match a fork or an unrelated package with the same suffix.
@k3KAW8Pnf7mkmdSMPHz27
k3KAW8Pnf7mkmdSMPHz27 merged commit 9168afe into main Sep 23, 2026
1 check passed
@k3KAW8Pnf7mkmdSMPHz27
k3KAW8Pnf7mkmdSMPHz27 deleted the fix-dependabot-swift-group-patterns branch September 23, 2026 16:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant