Allow array in target-branch

[skjnldsv]

That would prevent us to have lots of duplicate configs

- package-ecosystem: npm
  directory: "/"
  schedule:
    interval: weekly
    day: saturday
    time: "03:00"
    timezone: Europe/Paris
  target-branch:
    - stable19
    - stable18
    - stable17
  labels:
    - "3. to review"
    - "feature: dependencies"

[jkonecny12]

That would be a great help especially for github-actions ecosystem. Without that, you cover only the main branch which doesn't help much because you are still using the outdated GitHub action versions in the other branches.

[Y-LyN-10]

We are supporting multiple release lines for our package and it would be great to configure Dependabot to open PRs into each of these major branches (and checkout from the same branches).

[jablko]

I wish it supported glob patterns, like Actions workflow on.<push|pull_request>.<branches|tags>, e.g.

on:
  push:
    branches:    
      - releases/**

[Hackwar]

This would be of greate benefit for us as well. The Joomla project has somewhere around 200 repos, a large part of which has branches for 2 major development lines and each with its own dependencies. The limitation to only be able to check one branches dependencies is the reason we currently aren't using it. Especially since it seems the feature to support more than one branch was already part of dependabot before it was aquired by github. It would be really awesome for us if this would be adopted again.

[kaptcha0]

Any update on feature?

[mildred]

I believe the original issue does not describe correctly the problem. target-branch is the branch pull requests are made against, it's not the branch that is watched for its dependencies. The branch watched is the default branch configured in GitHub that also serves as the default branch to pull request against.

Instead, I believe the author wants to have a configurable watch-branch possibly watching multiple branches.

I´d need that feature too. Currently, I set the default branch to the production branch iN GitHub but the problem is that b default pull requests are created against production and not against develop which is very annoying and might makes us merge things in production instead of develop.

[skjnldsv]

@mildred Not really https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#target-branch

By default, Dependabot checks for manifest files on the default branch and raises pull requests for version updates against this branch. Use target-branch to specify a different branch for manifest files and for pull requests. When you use this option, the settings for this package manager will no longer affect any pull requests raised for security updates.

target-branch is for both the manifest files and the pull request

[noorul]

Is the target branch specific to GitHub dependabot? I was wondering how one can configure this as part of dependabot-core?

[nyetwurk]

Any progress on this?