Pass updated-dependencies-json to migration scripts

action.yml

@@ -516,6 +516,7 @@ runs:
       env:
         OLD_VERSION: ${{ steps.check-update.outputs.old_version }}
         NEW_VERSION: ${{ steps.check-update.outputs.new_version }}
+        UPDATED_DEPENDENCIES_JSON: ${{ steps.dependabot-metadata.outputs.updated-dependencies-json }}
         SCRIPT_URL_TEMPLATE: ${{ inputs.script-url-template }}
         MIGRATION_SCRIPT: ${{ inputs.migration-script }}
         ITERATE_V0_MINORS: ${{ inputs.iterate-v0-minors }}

scripts/run-migration.sh

@@ -8,6 +8,9 @@
 # Expected environment variables (set by the composite action):
 #   OLD_VERSION          – version being upgraded from (e.g. 0.13.1)
 #   NEW_VERSION          – version being upgraded to (e.g. 0.15.0)
+#   UPDATED_DEPENDENCIES_JSON – JSON array from dependabot/fetch-metadata
+#                          with full dependency update details; passed
+#                          through to migration scripts via the environment
 #   SCRIPT_URL_TEMPLATE  – URL template with {version} placeholder
 #                          (mutually exclusive with MIGRATION_SCRIPT)
 #   MIGRATION_SCRIPT     – inline migration script body
@@ -25,6 +28,8 @@ OLD_MAJOR=$(echo "$OLD_VERSION" | sed -E 's/^([0-9]+)\..*/\1/')
 NEW_MAJOR=$(echo "$NEW_VERSION" | sed -E 's/^([0-9]+)\..*/\1/')
 
 echo "Old: v${OLD_MAJOR}.${OLD_MINOR}, New: v${NEW_MAJOR}.${NEW_MINOR}"
+echo "Updated dependencies JSON:"
+echo "$UPDATED_DEPENDENCIES_JSON" | jq -C . 2>/dev/null || echo "$UPDATED_DEPENDENCIES_JSON"
 
 # Build the list of versions to migrate through.
 VERSIONS=()

tests/integration.bats

@@ -14,6 +14,7 @@ setup() {
   export GITHUB_SERVER_URL="https://github.com"
   export GITHUB_REPOSITORY="test-org/test-repo"
   export GITHUB_RUN_ID="12345"
+  export UPDATED_DEPENDENCIES_JSON='[{"dependencyName":"example","prevVersion":"0.5.0","newVersion":"0.6.0","updateType":"version-update:semver-minor"}]'
   export COMMIT_MADE="false"
   export AUTO_MERGE_ON_CHANGES="false"
   export TOKEN_PROVIDED="true"

tests/run-migration.bats

@@ -10,6 +10,7 @@ setup() {
   # Default environment — a simple v0.x minor bump with URL mode.
   export OLD_VERSION="0.13.1"
   export NEW_VERSION="0.15.0"
+  export UPDATED_DEPENDENCIES_JSON='[{"dependencyName":"example","prevVersion":"0.13.1","newVersion":"0.15.0","updateType":"version-update:semver-minor"}]'
   export SCRIPT_URL_TEMPLATE="https://example.com/migrate-{version}.py"
   export ITERATE_V0_MINORS="true"
   export MIGRATION_TOKEN_INPUT=""
@@ -475,3 +476,78 @@ teardown() {
   assert_success
   assert_output --partial "VER=v0.6.0"
 }
+
+# ── UPDATED_DEPENDENCIES_JSON passthrough ─────────────────────────
+
+@test "UPDATED_DEPENDENCIES_JSON is logged" {
+  export OLD_VERSION="0.5.0"
+  export NEW_VERSION="0.6.0"
+  export UPDATED_DEPENDENCIES_JSON='[{"dependencyName":"foo","prevVersion":"0.5.0","newVersion":"0.6.0"}]'
+
+  run bash "${REPO_ROOT}/scripts/run-migration.sh"
+  assert_success
+  assert_output --partial "Updated dependencies JSON:"
+  assert_output --partial "dependencyName"
+}
+
+@test "URL mode exposes UPDATED_DEPENDENCIES_JSON to migration script" {
+  export OLD_VERSION="0.5.0"
+  export NEW_VERSION="0.6.0"
+  export UPDATED_DEPENDENCIES_JSON='[{"dependencyName":"foo"}]'
+  export MOCK_CURL_SCRIPT_BODY='import os, json; d = json.loads(os.environ["UPDATED_DEPENDENCIES_JSON"]); print("DEP=" + d[0]["dependencyName"])'
+
+  run bash "${REPO_ROOT}/scripts/run-migration.sh"
+  assert_success
+  assert_output --partial "DEP=foo"
+}
+
+@test "inline script receives UPDATED_DEPENDENCIES_JSON" {
+  unset SCRIPT_URL_TEMPLATE
+  export MIGRATION_SCRIPT='import os, json; d = json.loads(os.environ["UPDATED_DEPENDENCIES_JSON"]); print("DEP=" + d[0]["dependencyName"])'
+  export OLD_VERSION="0.5.0"
+  export NEW_VERSION="0.6.0"
+  export UPDATED_DEPENDENCIES_JSON='[{"dependencyName":"bar"}]'
+
+  run bash "${REPO_ROOT}/scripts/run-migration.sh"
+  assert_success
+  assert_output --partial "DEP=bar"
+}
+
+@test "UPDATED_DEPENDENCIES_JSON is available with migration token" {
+  export OLD_VERSION="0.5.0"
+  export NEW_VERSION="0.6.0"
+  export MIGRATION_TOKEN_INPUT="test-token"
+  export UPDATED_DEPENDENCIES_JSON='[{"dependencyName":"tokenised"}]'
+  export MOCK_CURL_SCRIPT_BODY='import os, json; d = json.loads(os.environ["UPDATED_DEPENDENCIES_JSON"]); print("DEP=" + d[0]["dependencyName"])'
+
+  run bash "${REPO_ROOT}/scripts/run-migration.sh"
+  assert_success
+  assert_output --partial "DEP=tokenised"
+}
+
+@test "jq failure falls back to raw JSON output" {
+  export OLD_VERSION="0.5.0"
+  export NEW_VERSION="0.6.0"
+  export UPDATED_DEPENDENCIES_JSON='[{"dependencyName":"fallback"}]'
+
+  # Shadow jq with a script that always fails.
+  cat >"${MOCK_DIR}/jq" <<'MOCK_JQ'
+#!/usr/bin/env bash
+exit 1
+MOCK_JQ
+  chmod +x "${MOCK_DIR}/jq"
+
+  run bash "${REPO_ROOT}/scripts/run-migration.sh"
+  assert_success
+  assert_output --partial '[{"dependencyName":"fallback"}]'
+}
+
+@test "malformed JSON falls back to raw output" {
+  export OLD_VERSION="0.5.0"
+  export NEW_VERSION="0.6.0"
+  export UPDATED_DEPENDENCIES_JSON='not valid json'
+
+  run bash "${REPO_ROOT}/scripts/run-migration.sh"
+  assert_success
+  assert_output --partial "not valid json"
+}