[ ← blog / drupal ](/) Dec 09, 2025  ·  \#drupal  ·  3 min read 

# Automating Drupal release notes in Dependabot PRs

I maintain drupal-mrn.dev, a tool widely used by maintainers to generate release notes for Drupal modules. It simplifies the changelog process, but consuming those notes has remained a manual step for site architects reviewing updates.



      ![PR overview with release notes from the Github Action](/sites/default/files/styles/large/public/2025-12/Screenshot%202025-12-03%20at%201.26.55%E2%80%AFPM.png?itok=ZEbODWUg) 

 

I maintain [drupal-mrn.dev](https://drupal-mrn.dev/), a tool widely used by maintainers to generate release notes for Drupal modules. It simplifies the changelog process, but consuming those notes has remained a manual step for site architects reviewing updates.

Recently, while reviewing Dependabot updates for this blog, I noticed a functional gap. When Dependabot bumps a package hosted on GitHub, it embeds the release notes directly into the Pull Request description. However, packages served from git.drupalcode.org lack this context. You see a version change, but no description of what changed, what was fixed, or what broke.

I decided to leverage the existing `drupal-mrn` APIs to solve this. I’ve released a new GitHub Action, `mglaman/dependabot-drupal-mrn`, which injects Drupal-specific release notes into your Dependabot PRs.

 [GitHub - mglaman/dependabot-drupal-mrn: Get Drupal release notes attached to Dependabot updates

Get Drupal release notes attached to Dependabot updates - mglaman/dependabot-drupal-mrn

https://github.com/mglaman/dependabot-drupal-mrn

 

 ![GitHub - mglaman/dependabot-drupal-mrn: Get Drupal release notes attached to Dependabot updates](https://opengraph.githubassets.com/f2bad47aa32fab09241410ecc0be3273a35e2a93c10d298ce880ed44d7fe7aff/mglaman/dependabot-drupal-mrn) 

 

 

 ](https://github.com/mglaman/dependabot-drupal-mrn) 

## Easy dependency updates, problematic reviews

Dependabot is excellent at parsing metadata from GitHub releases. It fails to provide context for Drupal modules because the upstream source isn't a GitHub repository with standard Release entities.

Without this automation, reviewing a module update requires:

- Noting the version change in the PR title or description.
- Navigate to the project page on Drupal.org.
- Locating the specific release notes.
- Parsing the issues – assuming the maintainer actually listed all the issues for the release.

This friction discourages thorough review.

## Automatically getting release notes to make reviews faster

I built [dependabot-drupal-mrn](https://github.com/mglaman/dependabot-drupal-mrn) to automate retrieving this data.

This action runs on Pull Requests opened by Dependabot. It parses the diff to identify updated Drupal packages, queries the `drupal-mrn` API for the relevant release note data, and appends the formatted notes to the PR description.

### How to use it in your workflow

To implement this, add a new workflow file (`.github/workflows/dependabot-drupal.yml`) to your repository.

The workflow should trigger on `pull_request` events and specifically target PRs created by the `dependabot[bot]` actor.

```yaml
name: Drupal Release Notes for Dependabot

on:
  pull_request:
    types: [opened, synchronize]

permissions:
  pull-requests: write
  contents: read

jobs:
  add-release-notes:
    runs-on: ubuntu-latest
    # Optimization: Only run for Dependabot PRs
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Add Drupal release notes
        uses: mglaman/dependabot-drupal-mrn@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
```

### How it works

The action operates on the following logic:

- Verifies it is running in a PR context.
- It checks the Dependabot metadata to determine which Drupal packages are being updated (`drupal/webform` from `6.1.0` to `6.2.0`).
- It sends a request to `drupal-mrn.dev` to fetch the release notes for the target version.
- It uses the GitHub API to update the PR body, appending the formatted notes.

Get the action on the [GitHub Marketplace: mglaman/dependabot-drupal-mrn](https://github.com/marketplace/actions/dependabot-drupal-release-notes).

 

  ![](/themes/custom/mglaman/images/headshot.webp)Thanks for reading

I write about Drupal, PHP, and the quiet infrastructure behind large sites — caching, config, and testing. New posts land every week or two.

 [Subscribe via RSS →](/rss.xml) [About me →](/about-me) 

 



 

  [← Older

Preventing a `drush updb` from clearing your caches

 ](/blog/preventing-drush-updb-clearing-your-caches) [Newer →

drupalorg-cli 0.8.0: GitLab issue fork and merge request commands

 ](/blog/drupalorg-cli-080-gitlab-issue-fork-and-merge-request-commands)