[Dependabot] Sudden change in access required for dependabot commands. Is this documented?

[melink14]

My dependency management setup uses dependebot to open PRs and a third party tool (Mergify) to manage those PRs such that merging many dependency updates doesn't require any more CI runs then necessary.

This is accomplished by configuring Dependabot to not auto-rebase and instead to just allow Mergify update non conflicting PRs when it's their turn to be merged.

When there is a conflict, I've configured Mergify to add a comment "@dependabot rebase" in order to have Dependabot figure out what the new state of the PR should be.

This was working as early as a couple weeks ago but today that comment failed with the reply:
"Sorry, only users with push access can use that command."

This was already the case for commands like "@dependabot recreate" but it's unclear when and how these requirements are enforced.
The mergify bot I use has permisssions to add commits, merge, comment in my repo so it's pretty surprising that dependabot thinks it shouldn't have permission to run a command that has no risk of improper use.

Is this working as intended? Is this access control documented anywhere? I couldn't find it when searching though maybe it used to exist based on some tangential references I saw.

Thanks!

rebase successful PR: melink14/rikaikun#1393
rebase failed PR: melink14/rikaikun#1419

[jpaakko]

We have a similar setup to reduce the number of CI runs and stumbled upon this same problem. We've also accomplished this by disabling Dependabot's auto-rebase and by using a GitHub workflow to rebase the open Dependabot PRs one at a time by commenting @dependabot rebase on the PRs. The GitHub workflow that comments on the PRs is using the GITHUB_TOKEN secret with the pull-requests: write permission.

This was still working on Thursday, 16 February 2023. However, on Friday, 17 February 2023, this suddenly stopped working and fails with Dependabot replying Sorry, only users with push access can use that command..

I also tried to find documentation about the required permissions for the different Dependabot comment commands but couldn't find anything. I'd also be interested to know whether this is documented somewhere?

One way to solve this would probably be to use a personal access token instead of the GITHUB_TOKEN secret. However, I'd also like to know whether this sudden permission change is intentional before going that road.

[breneckd]

Also experienced this the past few days. Noticed than when I ran "@dependabot recreate" then waited for our automerge GHA to run (before any other PRs got merged), it was able to merge. And then future PRs were able to "@dependabot rebase" without any issue.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[melink14]

This is still a problem and there's been no input from github or dependentbot devs to date. It'd be great to hear an answer as to whether this is intended or a bug and perhaps get a workaround for these user journies.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[melink14]

This is still a problem and there's been no input from github or dependentbot devs to date. It'd be great to hear an answer as to whether this is intended or a bug and perhaps get a workaround for these user journies.

[Mington84]

Adjust your setup or give Dependabot the right permissions.

[melink14]

Hmm, can you give more details. In this case, dependabot works fine as long as a human user runs the rebase command but fails with an error if a robot account makes the same comment (even though that app has full access to my repos)

Do you have a setup where an app or robot account is able to get Dependabot to rebase or recreate PRs?

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[melink14]

This still happens quite often that an app with full read/write repo permissions is not allowed to ask dependabot to rebase a pull request. Not sure what more information is needed.