Potential fix for dependabot

[networkfusion]

Description

• Dependabot does not currently support lock files, however, there is a potential workaround.

Motivation and Context

• Adds a GH action to "attempt" to support it, as using it is advantagous.

How Has This Been Tested?

• Not really sure how to without trying in the real world...

Screenshots

Types of changes

• [ ] Improvement (non-breaking change that improves a feature, code or algorithm)
• [ ] Bug fix (non-breaking change which fixes an issue with code or algorithm)
• [ ] New feature (non-breaking change which adds functionality to code)
• [ ] Breaking change (fix or feature that would cause existing functionality to change)
• [ ] Config and build (change in the configuration and build system, has no impact on code or features)
• [x] Dependencies (update dependencies and changes associated, has no impact on code or features)
• [ ] Unit Tests (add new Unit Test(s) or improved existing one(s), has no impact on code or features)
• [ ] Documentation (changes or updates in the documentation, has no impact on code or features)

Checklist:

• [ ] My code follows the code style of this project (only if there are changes in source code).
• [ ] My changes require an update to the documentation (there are changes that require the docs website to be updated).
• [ ] I have updated the documentation accordingly (the changes require an update on the docs in this repo).
• [ ] I have read the CONTRIBUTING document.
• [ ] I have tested everything locally and all new and existing tests passed (only if there are changes in source code).
• [ ] I have added new tests to cover my changes.

[coderabbitai[bot]]

Walkthrough

Adds a new GitHub Actions workflow that runs on dependabot pull requests, executes dotnet restore --force-evaluate, checks for lockfile diffs, and commits & pushes NuGet lockfile updates when changes are detected.

Changes

Cohort / File(s)	Summary
GitHub Actions workflow ​.github/workflows/dependabot-packagelock-update.yml	New workflow triggered on pull_request for dependabot branches. Runs on windows-latest, performs checkout, runs dotnet restore --force-evaluate, computes a git diff, and if changes exist configures git, commits (chore(deps): update NuGet lock file) and pushes the updates.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Dependabot as Dependabot PR
  participant GH as GitHub Actions
  participant Runner as windows-latest runner
  participant Repo as Repository

  Note over Dependabot,GH `#DDDDFF`: Trigger
  Dependabot->>GH: open pull_request (head contains "dependabot")
  GH->>Runner: start "restore" job

  Note over Runner: Steps
  Runner->>Repo: actions/checkout
  Runner->>Runner: dotnet restore --force-evaluate
  Runner->>Runner: git diff --exit-code

  alt diff found
    Runner->>Runner: git config user, commit changes
    Runner->>Repo: git push
    Note right of Repo `#E6F7E6`: Lockfile updated in PR branch
  else no diff
    Runner->>Runner: exit (no changes)
  end

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify trigger filtering correctly matches dependabot branch names.
• Confirm dotnet restore --force-evaluate is appropriate for intended lockfile updates.
• Inspect git commit/push steps for correct user config and safe push behavior.
• Validate diff detection command and conditions that gate committing.

Pre-merge checks and finishing touches

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is vague and non-specific, using the qualifier 'Potential fix' which doesn't clearly describe what is being fixed or the actual change being implemented.	Consider a more descriptive title such as 'Add GitHub Action to update NuGet lock files on dependabot PRs' or 'Support lock file updates for dependabot via GitHub Actions workflow'.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing touches

🧪 Generate unit tests (beta)

• [ ] Create PR with unit tests
• [ ] Post copyable unit tests in a comment
• [ ] Commit unit tests in branch fix-dependabot

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 27a992dece5af5719795cada3ec1b0daedda8532 and 2c51cbcc36e1d788416426f1613555e8757a89c9.

📒 Files selected for processing (1)

• .github/workflows/dependabot-packagelock-update.yml (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/dependabot-packagelock-update.yml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: nanoFirmwareFlasher (Build_tool)
• GitHub Check: nanoFirmwareFlasher (Check_Build_Options)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[networkfusion]

Closing as (hopefully) obsolete.

[networkfusion]

Re-opening as may still be necessary!

[networkfusion]

/azp run

[azure-pipelines[bot]]

Azure Pipelines successfully started running 1 pipeline(s).

[josesimoes]

@networkfusion to be honest this is way more work than handling the updates manually as we've been doing... 😅 Moreover, because (by the time being) the tool needs to work in VS2019 we can't just use the latest on several NuGets. So... again more time picking up which updates should be merged or not...