compatibility: (?<score>\d+)%<\/title>/m` to extract the score from the SVG response. Sources: [src/dependabot/verified_commits.ts:107-123]() * **`scoreLookup` interface**: A functional interface defining the parameters needed for the lookup: `dependencyName`, `previousVersion`, `newVersion`, and `ecosystem`. Sources: [src/dependabot/update_metadata.ts:32-34]() ## Configuration and Inputs To populate compatibility data, specific inputs must be configured in the GitHub Actions workflow. By default, these values are not fetched to minimize API overhead and requirements for elevated permissions. | Input | Type | Default | Description | | :--- | :--- | :--- | :--- | | `compat-lookup` | boolean | `false` | If true, the action populates the `compatibility-score` output. | | `github-token` | string | `${{github.token}}` | Required for API calls; must be a PAT if `compat-lookup` is true. | Sources: [action.yml:6-15](), [README.md:43-52]() ## Metadata Integration The compatibility score is integrated into the `updatedDependency` data structure alongside other versioning and alert information. This data is eventually serialized into the `updated-dependencies-json` output. ### Updated Dependency Schema The following table describes the fields relevant to compatibility and versioning within the metadata object: | Field | Type | Description | | :--- | :--- | :--- | | `compatScore` | number | The numerical compatibility score (0-100). | | `prevVersion` | string | The version the dependency is being updated from. | | `newVersion` | string | The version the dependency is being updated to. | | `updateType` | string | Calculated semver change (e.g., `version-update:semver-minor`). | Sources: [src/dependabot/update_metadata.ts:15-26](), [src/dependabot/output.test.ts:31-48]() ### Logic for Multi-Dependency PRs In cases where a PR updates multiple dependencies (e.g., grouped updates), the action handles compatibility scores for each individual item. However, the top-level `compatibility-score` output for the entire action run is typically derived from the highest-impact dependency or summarized across the set. ```mermaid sequenceDiagram participant Main as Action Main participant Parser as Metadata Parser participant Compat as Compatibility Service Main->>Parser: parse(commitMessage, branch) loop For Each Dependency Parser->>Compat: getCompatibility(name, versions, ecosystem) Compat-->>Parser: score (e.g., 85) end Parser-->>Main: Array of updatedDependency Main->>Main: Summarize Results Main->>Main: setOutput('compatibility-score', score) ``` Sources: [src/dependabot/update_metadata.ts:80-101](), [src/main.test.ts:255-300]() ## Implementation Example The retrieval logic utilizes the `https` module to perform the lookup. If the service is unavailable or returns an error, the system is designed to fail gracefully by returning a score of `0`. ```typescript // From src/dependabot/verified_commits.ts:107-123 export async function getCompatibility (name: string, oldVersion: string, newVersion: string, ecosystem: string): Promise<number> { const svg = await new Promise<string>((resolve) => { https.get(`https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=${name}&package-manager=${ecosystem}&previous-version=${oldVersion}&new-version=${newVersion}`, res => { let data = '' res.on('data', chunk => { data += chunk.toString('utf8') }) res.on('end', () => { resolve(data) }) }).on('error', () => { resolve('') }) }) const scoreChunk = svg.match(/<title>compatibility: (?<score>\d+)%<\/title>/m) return scoreChunk?.groups ? parseInt(scoreChunk.groups.score) : 0 } ``` Sources: [src/dependabot/verified_commits.ts:107-123]() Compatibility Data Outputs provide a critical signal for automated dependency management. By enabling `compat-lookup`, users can distinguish between low-risk patch updates with high compatibility scores and potentially breaking major version changes, facilitating safer and more efficient CI/CD workflows.</article></body></html>

Relevant source files

The following files were used as context for generating this wiki page: - [action.yml](https://github.com/Trancendos/fetch-metadata/blob/main/action.yml) - [README.md](https://github.com/Trancendos/fetch-metadata/blob/main/README.md) - [src/dependabot/update_metadata.ts](https://github.com/Trancendos/fetch-metadata/blob/main/src/dependabot/update_metadata.ts) - [src/dependabot/verified_commits.ts](https://github.com/Trancendos/fetch-metadata/blob/main/src/dependabot/verified_commits.ts) - [src/main.test.ts](https://github.com/Trancendos/fetch-metadata/blob/main/src/main.test.ts) - [src/dependabot/output.test.ts](https://github.com/Trancendos/fetch-metadata/blob/main/src/dependabot/output.test.ts)

# Compatibility Data Outputs Compatibility Data Outputs refer to the specific metadata generated by the Fetch Metadata Action that informs users about the reliability and risk associated with a dependency update. The primary metric for this is the `compatibility-score`, which represents the success rate of the update across other projects on GitHub. This system allows developers to automate PR handling (such as auto-merging) based on the historical success of a specific version bump, reducing the manual effort required to vet routine updates. Sources: [README.md:9-14](), [README.md:162-177]() ## Compatibility Score Retrieval The compatibility score is fetched from an external Dependabot service that calculates scores based on CI results from other repositories. The action performs a GET request to a badge-generating endpoint and parses the resulting SVG to extract a numerical percentage. ### Data Flow for Score Lookup The following diagram illustrates how the action retrieves the compatibility score during the metadata parsing phase. ```mermaid flowchart TD Start[Parse Metadata] --> CheckInput{compat-lookup true?} CheckInput -- Yes --> CallService[Request Compatibility Badge] CallService --> FetchSVG[GET dependabot-badges service] FetchSVG --> ParseSVG[Regex Match Score from Title] ParseSVG --> ReturnScore[Return Integer Score] CheckInput -- No --> DefaultScore[Return 0] ReturnScore --> SetOutput[Set compatibility-score Output] DefaultScore --> SetOutput ``` The workflow logic ensures that external network calls for compatibility data only occur if the user has explicitly enabled the feature via action inputs. Sources: [src/dependabot/verified_commits.ts:107-123](), [action.yml:10-12]() ### Key Components * **`getCompatibility` function**: Responsible for executing the HTTPS request to `dependabot-badges.githubapp.com`. It uses a regular expression `/compatibility: (?<score>\d+)%<\/title>/m` to extract the score from the SVG response. Sources: [src/dependabot/verified_commits.ts:107-123]() * **`scoreLookup` interface**: A functional interface defining the parameters needed for the lookup: `dependencyName`, `previousVersion`, `newVersion`, and `ecosystem`. Sources: [src/dependabot/update_metadata.ts:32-34]() ## Configuration and Inputs To populate compatibility data, specific inputs must be configured in the GitHub Actions workflow. By default, these values are not fetched to minimize API overhead and requirements for elevated permissions. | Input | Type | Default | Description | | :--- | :--- | :--- | :--- | | `compat-lookup` | boolean | `false` | If true, the action populates the `compatibility-score` output. | | `github-token` | string | `${{github.token}}` | Required for API calls; must be a PAT if `compat-lookup` is true. | Sources: [action.yml:6-15](), [README.md:43-52]() ## Metadata Integration The compatibility score is integrated into the `updatedDependency` data structure alongside other versioning and alert information. This data is eventually serialized into the `updated-dependencies-json` output. ### Updated Dependency Schema The following table describes the fields relevant to compatibility and versioning within the metadata object: | Field | Type | Description | | :--- | :--- | :--- | | `compatScore` | number | The numerical compatibility score (0-100). | | `prevVersion` | string | The version the dependency is being updated from. | | `newVersion` | string | The version the dependency is being updated to. | | `updateType` | string | Calculated semver change (e.g., `version-update:semver-minor`). | Sources: [src/dependabot/update_metadata.ts:15-26](), [src/dependabot/output.test.ts:31-48]() ### Logic for Multi-Dependency PRs In cases where a PR updates multiple dependencies (e.g., grouped updates), the action handles compatibility scores for each individual item. However, the top-level `compatibility-score` output for the entire action run is typically derived from the highest-impact dependency or summarized across the set. ```mermaid sequenceDiagram participant Main as Action Main participant Parser as Metadata Parser participant Compat as Compatibility Service Main->>Parser: parse(commitMessage, branch) loop For Each Dependency Parser->>Compat: getCompatibility(name, versions, ecosystem) Compat-->>Parser: score (e.g., 85) end Parser-->>Main: Array of updatedDependency Main->>Main: Summarize Results Main->>Main: setOutput('compatibility-score', score) ``` Sources: [src/dependabot/update_metadata.ts:80-101](), [src/main.test.ts:255-300]() ## Implementation Example The retrieval logic utilizes the `https` module to perform the lookup. If the service is unavailable or returns an error, the system is designed to fail gracefully by returning a score of `0`. ```typescript // From src/dependabot/verified_commits.ts:107-123 export async function getCompatibility (name: string, oldVersion: string, newVersion: string, ecosystem: string): Promise<number> { const svg = await new Promise<string>((resolve) => { https.get(`https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=${name}&package-manager=${ecosystem}&previous-version=${oldVersion}&new-version=${newVersion}`, res => { let data = '' res.on('data', chunk => { data += chunk.toString('utf8') }) res.on('end', () => { resolve(data) }) }).on('error', () => { resolve('') }) }) const scoreChunk = svg.match(/<title>compatibility: (?<score>\d+)%<\/title>/m) return scoreChunk?.groups ? parseInt(scoreChunk.groups.score) : 0 } ``` Sources: [src/dependabot/verified_commits.ts:107-123]() Compatibility Data Outputs provide a critical signal for automated dependency management. By enabling `compat-lookup`, users can distinguish between low-risk patch updates with high compatibility scores and potentially breaking major version changes, facilitating safer and more efficient CI/CD workflows.</article></body></html>