Correct PR body comparison

[CasperWA]

Fixes #995

Only compare the first 8 lines of the PR body when deciding whether the
permanent dependabot branch should be reset to master or have master
merged into it.

I've tested this locally, retrieving the PR body for PR #993 and it seems to work now.

[codecov]

Codecov Report

Merging #996 (95067c8) into master (8065f6f) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #996   +/-   ##
=======================================
  Coverage   92.91%   92.91%           
=======================================
  Files          67       67           
  Lines        3780     3780           
=======================================
  Hits         3512     3512           
  Misses        268      268           

Flag	Coverage Δ
project	92.91% <ø> (ø)
validator	92.91% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8065f6f...95067c8. Read the comment docs.

[JPBergsma]

I am not sure, I understand how this code works, but is it always guaranteed that the first 8 lines do not contain a checkbox?
Is the comparison only between the last PR in each branch? I only saw one PR in my "single_dependency_pr_body.txt". In that case you can be certain that if a PR contains a checkbox, the last update was not a Dependabot update, so the result should be false and there is no problem.

[CasperWA]

I am not sure, I understand how this code works, but is it always guaranteed that the first 8 lines do not contain a checkbox? (...)

The file being checked is this file.
It's not fool-proof for sure. If someone changes the created PR's body, specifically the first 8 lines, then this will obviously fail. But the first checkbox starts on line 9.

Is the comparison only between the last PR in each branch? I only saw one PR in my "single_dependency_pr_body.txt". In that case you can be certain that if a PR contains a checkbox, the last update was not a Dependabot update, so the result should be false and there is no problem.

I think that's too general of a constraint to make (checking for checkboxes, as we sometimes add checkboxes in other PR bodies as well).
It checks the latest PR that has been merged - since the workflow runs every time a new commit is pushed to master, it checks the latest PR that has been merged into master. Hence, it's effectively checking the PR body of the PR that has just been merged.
There is a caveat here, of course, namely that if someone merges several PRs in succession, then this will fail as the workflow might not read the PR body of its associated merge that caused the workflow to run to begin with.
Don't know if that made sense... I tried 😅

[CasperWA]

@JPBergsma @ml-evs can we get this in before Wednesday?

[ml-evs]

lgtm