Concurrent executions would race for global gitconfig

[honnix]

Package manager/ecosystem

Javascript, yarn and npm

Manifest contents prior to update

NA

Updated dependency

NA

What you expected to see, versus what you actually saw

We expect to see concurrent updating of dependencies for multiple repositories can succeed.

Instead we got exception complaining $HOME/.gitconfig does not exist when dependabot-core tries to move it to a backup.

Images of the diff or a link to the PR, issue or logs

NA

Some early investigation
The problem is probably around https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/shared_helpers.rb#L156 and

dependabot-core/common/lib/dependabot/shared_helpers.rb

Line 258 in 6f40826

FileUtils.mv(GIT_CONFIG_GLOBAL_PATH, backup_path)

when one process or thread tries to make a backup of $HOME/.gitconfig while the other process or thread is doing the same thing.

Is it possible to configure git locally instead of globally so multiple repositories can be handled in parallel?

Thanks.

[jurre]

We don't currently run dependabot-core in parallel and so the code has not really been designed with thread-safety in mind.

For many ecosystems we end up creating many temp directories for different steps in the update process, all of which need access to this config. In theory I think we could create one parent dir that holds the git config, and create all the tmp-dirs for the different steps in there. I am afraid that this would require changes to how updates are ran in many ecosystems, and we don't really have the bandwidth to tackle this right now. There might be a clean way to do it that I can't think of right now and either way I'd be happy to review a PR that adds this change though.

[honnix]

@jurre Thank you for the quick response and explanation. Now I understand the reasoning and design behind it. I will think about your suggestion and take a better look at the code. Please feel free to close this issue and perhaps give it a won't fix label. If later on I could come up with a PR I can reopen this for reference. Thanks again!

[honnix]

BTW maybe you can help me understand why using a local git configuration won't work in this case. Thanks.

NVM I see there would be no local git repo cloned, for example in case of yarn.

[jurre]

BTW maybe you can help me understand why using a local git configuration won't work in this case. Thanks.

NVM I see there would be no local git repo cloned, for example in case of yarn.

Yeah, we have some plans on eventually checking out a git repo for all ecosystems, but not sure on the timeline at this point

[jurre]

Going to close this out for now, but feel free to reach out if I there's anything I can do to help