Dependabot commit config include: "scope" output explainer

[janbrasna]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#commit-message

What part(s) of the article would you like to see updated?

include: "scope" specifies that any prefix is followed by a list of the dependencies updated in the commit.

There's nowhere a description what this "list of the dependencies updated" is, see #18302 (comment) — only with trial & error or checking the source at https://github.com/dependabot/dependabot-core/blob/3147bb1cd5ea7b5dd3835f0758e42e229ecf8245/common/lib/dependabot/pull_request_creator/pr_name_prefixer.rb#L164-L166:

      def scope
        dependencies.any?(&:production?) ? "deps" : "deps-dev"
      end

it's obvious it's only one of these two hard-coded strings (probably chosen from some angular1/2 habits of conventional commits where maybe these exact "token" values have a meaning?), but it's not explained in the docs these would be the only strings added.

Additional information

My additional issue would be that pip is being mentioned as supporting scopes, so somehow Dependabot should be able to select prod vs. dev scopes, but I wasn't able to find out how (as the requirements txt/in files can be named pretty arbitrarily…)

[nguyenalex836]

@janbrasna Thanks so much for opening an issue! I'll get this triaged for review ✨

[github-actions]

Thanks for opening an issue! We've triaged this issue for technical review by a subject matter expert 👀

[nguyenalex836]

@janbrasna Thank you for your patience while our SME team reviewed!

it's obvious it's only one of these two hard-coded strings (probably chosen from some angular1/2 habits of conventional commits where maybe these exact "token" values have a meaning?), but it's not explained in the docs these would be the only strings added.

The team agreed with you here, and would welcome an update to doc stating the only two values possible are those listed in the code you referenced 💛

My additional issue would be that pip is being mentioned as supporting scopes, so somehow Dependabot should be able to select prod vs. dev scopes, but I wasn't able to find out how (as the requirements txt/in files can be named pretty arbitrarily…)

The team agrees with you here as well, stating the confusion here is that pip is a package manager that doesn’t support dev dependencies, they place all dependencies in a requirements.txt file. However we refer to all Python package managers (pip-compile, poetry, pipenv) as pip. Some of those do support dev dependencies, so the example is understandably misleading.

We would welcome an update removing the mention of pip and instead reference another ecosystem that always has dev dependency support (npm) 💛

I've added the help wanted label so that you, or anyone else, may submit a PR with these updates. Thank you!