Problem

When a directory containing dependency manifests is deleted from a repository, Dependabot alerts are properly closed, but associated pull requests remain open. When users attempt to refresh or rebase these PRs using commands like @dependabot rebase, the job fails with a dependency_file_not_found error because Dependabot tries to fetch files from the deleted directory.

This issue affects customers who:

• Delete entire directories containing dependency files
• Have existing Dependabot PRs for dependencies in those directories
• Cannot close or manage these orphaned PRs

Related to #10684.

Solution

Modified FileFetcherCommand to detect when a PR refresh operation fails due to missing directories or files, and automatically close the PR with reason :dependency_removed.

Key Changes

Added handle_missing_directory_for_pr_update method:

def handle_missing_directory_for_pr_update(error)
  dependencies = job.dependencies

  return unless job.updating_a_pull_request?
  return unless dependencies
  return unless error.is_a?(Dependabot::DependencyFileNotFound) ||
                error.is_a?(Dependabot::DirectoryNotFound)

  Dependabot.logger.info(
    "Closing pull request for #{dependencies.join(', ')} " \
    "as the directory or dependency files are no longer present"
  )
  service.close_pull_request(dependencies, :dependency_removed)
end

This method is called during error handling in perform_job, ensuring that when file fetching fails during a PR refresh:

1. The error is recorded (existing behavior)
2. If it's a PR update job and the error is directory/file-related, the PR is closed
3. Clear logging explains why the PR was closed

Impact

• ✅ Orphaned PRs are automatically closed when directories are deleted
• ✅ Clear logging provides visibility into why PRs are closed
• ✅ Works for all PR refresh types (version updates, security updates, group updates)
• ✅ No impact on regular dependency scans or non-PR operations
• ✅ Safely handles edge cases (nil dependencies, other error types)

Testing

Added comprehensive test coverage:

• PR update with DependencyFileNotFound → closes PR ✅
• PR update with DirectoryNotFound → closes PR ✅
• Non-PR update with directory errors → does NOT close PR ✅
• PR update with nil dependencies → does NOT close PR ✅

All tests pass, and the code passes rubocop and Sorbet type checking.

Example Scenario

Before this fix:

1. User has PR for users/evam/excel_jobs/poetry.lock
2. User deletes entire users/evam/excel_jobs/ directory
3. Alert closes automatically ✅
4. User runs @dependabot rebase on PR v0.171.4 #4678
5. Job fails with dependency_file_not_found error ❌
6. PR remains open indefinitely ❌

After this fix:

1. User has PR for users/evam/excel_jobs/poetry.lock
2. User deletes entire users/evam/excel_jobs/ directory
3. Alert closes automatically ✅
4. User runs @dependabot rebase
5. Job detects directory is missing ✅
6. PR is automatically closed with clear message ✅
7. Log shows: "Closing pull request for dummy-pkg as the directory or dependency files are no longer present" ✅

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.