Azure DevOps Dependabot-NuGet failing branch push when casing does not match between git and sln

[moerketh]

We are using dependabot-script against our Azure DevOps git repository to scan for NuGet updates. This repository has multiple outdated packages.

The run command we are using looks like:
docker run -v "$(pwd):/home/dependabot/dependabot-script" -w '/home/dependabot/dependabot-script' -e AZURE_HOSTNAME=dev.azure.com -e AZURE_ACCESS_TOKEN=mytoken -e PACKAGE_MANAGER='nuget' -e PROJECT_PATH='myorg/myproj/_git/myrepo' -e http_proxy="http://host.docker.internal:8888/" -e https_proxy="http://host.docker.internal:8888/" -e SSL_CERT_FILE="/home/dependabot/dependabot-script/fiddlerroot.cer" dependabot/dependabot-core bundle exec ruby ./generic-update-script.rb

Note that we extended this commandline to run with the Fiddler web debugger and we replaced values for privacy.

What you expected to see, versus what you actually saw
The output of the tool is as follows:

Fetching nuget dependency files for myorg/myproj/_git/myrepo
Parsing dependencies information
  - Updating MSTest.TestAdapter (from 2.1.0)… submitted
  - Updating MSTest.TestFramework (from 2.1.0)… submitted
  - Updating Newtonsoft.Json (from 12.0.3)… submitted
  - Updating WindowsAzure.ServiceBus (from 6.0.1)… submitted
  - Updating Moq (from 4.13.1)… submitted
  - Updating Microsoft.IdentityModel.Clients.ActiveDirectory (from 5.2.7)… submitted
  - Updating FluentAssertions (from 5.10.2)…

The output ended there because we hit a github rate limit. We did not include that log.
In reality where the output says "submitted" it actually failed, we see this with Fiddler.

Request:

POST https://dev.azure.com/myorg/myproj/_apis/git/repositories/myrepo/pushes?api-version=5.0 
<Data containing refUpdates>

Response:

HTTP 400 Bad Request
{"$id":"1","innerException":null,"message":"The path '/myproject/MyProject.csproj' does not exist at commit '5ab5737474372fb81d862b0c0b0a9d1b0c5e335a'\r\nParameter name: newPush","typeName":"Microsoft.TeamFoundation.SourceControl.WebServer.InvalidArgumentValueException, Microsoft.TeamFoundation.SourceControl.WebServer","typeKey":"InvalidArgumentValueException","errorCode":0,"eventId":0}

Looking more closely at the push request content we notice that one of the updates contains a file that differs in casing only. This is caused by the solutionfile containing a different casing than the file in git:

Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "MyProject", "myproject\MyProject.csproj", "{1F5294F6-FB97-42D5-91E0-10D6DCD54F8C}"
EndProject

Cause: The file in git is actually: MyProject\MyProject.csproj
Workaround: fix the casing in the solutionfile to match git

A clear and concise description of what you expected to happen
We would expect dependabot to use the correct filepath and filename when pushing a branch.
An error pointing us in the right direction would also be helpful as this took some time to find and fix.

Versions used
dependabot-core docker dependabot/dependabot-core:latest
DIGEST:sha256:c1bd128ed6b666da813321ac36d51a88e2b3b7e29d135cb0886fd786b2e701c3
dependabot/dependabot-script latest repository (commit caffdfe7818afd55b62a93c9c77febfebf43aae9 march 18)

Colleague tag: @maartengo

[feelepxyz]

@moerketh we'd appreciate any help fixing this in the azure pull request helpers as all azure code in dependabot are community contributions and we currently only maintain and support the github integration.

[jeffwidman]

@moerketh / @maartengo do either of you care to submit a PR? As mentioned ☝️ , this section of the code is all community driven, but we're happy to review/merge PR's...

[moerketh]

@jeffwidman , I attempted this last year but failed to get the codebase to build (both local and devcontainer). We have since moved on to other projects. It would be okay for me to close this.

[github-actions]

👋 This issue has been marked as stale because it has been open for 2 years with no activity. You can comment on the issue to hold stalebot off for a while, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.