Add additional information about the submodule to the PR created by Dependabot

[ctam]

If we can add these additional information to the PR, that would be great:

• Current tag (with commit hash) vs latest tag (with commit hash) of the submodule
• Current plugin's version vs new plugin's version in version.php
• Warn Code Reviewer if the update commit hash is not same as its latest tag's commit hash.

Examples on how to update PRs

1. Use a GitHub Action to modify Dependabot PRs (recommended)

You can trigger a workflow when Dependabot opens a PR and then edit the body or add a comment.

Example:

name: Customize Dependabot PR

on:
  pull_request:
    types: [opened]
    
jobs:
  update-pr:
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest

    steps:
      - name: Append text to PR body
        uses: actions/github-script@v7
        with:
          script: |
            const pr = context.payload.pull_request;
            const extraText = "\n\n---\n⚠️ Custom note: Please review submodule changes carefully.";
            
            await github.rest.pulls.update({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: pr.number,
              body: pr.body + extraText
            });

You can also:

• Add comments instead of modifying the body
• Add labels or reviewers
• Parse submodule names and add dynamic text

---

2. Use PR templates (limited effect)

A .github/pull_request_template.md won’t reliably apply to Dependabot PRs—they usually override it.

So this is not a reliable solution for your case.

---

3. Dependabot commit message config (not helpful here)

There is a commit-message option, but:

• It applies to commit titles/messages
• It does not affect PR descriptions
• And support for gitsubmodule is minimal

---

Bottom line

• ❌ No native way in dependabot.yml for gitsubmodule
• ✅ Best solution: GitHub Actions automation on Dependabot PRs