Skip to content

Commit 70d519a

Browse files
unicornwareunicornware
committed
ci(workflows): dependabot-auto-fix
Signed-off-by: Lexus Drumgold <unicornware@flexdevelopment.llc>
1 parent 87574e4 commit 70d519a

File tree

2 files changed

+90
-49
lines changed

2 files changed

+90
-49
lines changed

‎.github/workflows/dependabot-auto-fix.yml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Dependabot Auto Fix
2+
#
3+
# @dependabot generates Yarn v1 lockfiles even though this project uses a different version of Yarn.
4+
# This corrupts the project lockfile in such a way that a new file must be generated. This workflow
5+
# fixes lockfile format and deduplicates dependencies.
6+
#
7+
# Check https://github.com/dependabot/dependabot-core/issues/1297 for details pertaining to the safe
8+
# removal of this workflow.
9+
#
10+
# References:
11+
#
12+
# - https://cli.github.com/manual/gh_pr_review
13+
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#push
14+
# - https://docs.github.com/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
15+
# - https://github.com/actions/checkout
16+
# - https://github.com/crazy-max/ghaction-import-gpg
17+
# - https://github.com/dependabot/fetch-metadata
18+
# - https://github.com/hmarr/debug-action
19+
20+
---
21+
name: dependabot-auto-fix
22+
on:
23+
push:
24+
branches:
25+
- dependabot/npm_and_yarn/**
26+
env:
27+
GITHUB_TOKEN: ${{ secrets.PAT_DEPENDABOT }}
28+
YARN_ENABLE_IMMUTABLE_INSTALLS: false
29+
jobs:
30+
dependabot-auto-fix:
31+
if: github.actor == 'dependabot[bot]'
32+
runs-on: ubuntu-latest
33+
steps:
34+
- id: debug
35+
name: Print environment variables and event payload
36+
uses: hmarr/debug-action@v2.0.1
37+
- id: metadata
38+
name: Fetch metadata
39+
uses: dependabot/fetch-metadata@v1.3.3
40+
with:
41+
skip-commit-verification: true
42+
- id: checkout
43+
name: Checkout ${{ github.head_ref }}
44+
uses: actions/checkout@v3.0.2
45+
with:
46+
ref: ${{ github.head_ref }}
47+
token: ${{ env.GITHUB_TOKEN }}
48+
- id: gpg-import
49+
name: Import GPG key
50+
uses: crazy-max/ghaction-import-gpg@v5.1.0
51+
with:
52+
git_commit_gpgsign: true
53+
git_config_global: true
54+
git_user_signingkey: true
55+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
56+
# todo: remove when https://github.com/crazy-max/ghaction-import-gpg/issues/118 is resolved
57+
- id: gpg-trust
58+
name: Set trust on GPG key
59+
run: |
60+
gpg --no-tty --command-fd 0 --edit-key ${{ steps.gpg-import.outputs.keyid }} << EOTRUST
61+
trust
62+
5
63+
y
64+
quit
65+
EOTRUST
66+
- id: lockfile-fix
67+
name: Fix yarn.lock
68+
run: yarn --mode=update-lockfile
69+
- id: dedupe
70+
name: Deduplicate dependencies
71+
run: yarn dedupe --mode=update-lockfile
72+
- id: lockfile-push
73+
name: Push yarn.lock
74+
run: |
75+
git add yarn.lock
76+
git status
77+
git diff-index --quiet HEAD || git commit -m "$COMMIT_MESSAGE" && git push -f
78+
env:
79+
GIT_AUTHOR_EMAIL: ${{ steps.gpg-import.outputs.email }}
80+
GIT_AUTHOR_NAME: ${{ steps.gpg-import.outputs.name }}
81+
GIT_COMMITTER_EMAIL: ${{ steps.gpg-import.outputs.email }}
82+
GIT_COMMITTER_NAME: ${{ steps.gpg-import.outputs.name }}
83+
COMMIT_MESSAGE: '[dependabot skip] fix lockfile for @dependabot'
84+
- id: approve-pr
85+
name: Approve pull request
86+
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
87+
run: gh pr review ${{ github.event.number }} --approve

‎.github/workflows/dependabot-auto.yml‎

Lines changed: 3 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,13 @@
22
#
33
# Automatically approve Dependabot pull requests and enable auto-merge.
44
#
5-
# Note: @dependabot generates Yarn v1 lockfiles despite this project using a different Yarn version.
6-
# This breaks the project lockfile. A workaround has been implemented to autofix lockfiles and
7-
# deduplicate dependencies. See https://github.com/dependabot/dependabot-core/issues/1297 to check
8-
# if the workaround is safe to remove.
9-
#
105
# References:
116
#
127
# - https://cli.github.com/manual/gh_pr_merge
138
# - https://cli.github.com/manual/gh_pr_review
149
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#pull_request
1510
# - https://docs.github.com/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
1611
# - https://github.com/actions/checkout
17-
# - https://github.com/actions/setup-node
18-
# - https://github.com/crazy-max/ghaction-import-gpg
1912
# - https://github.com/dependabot/fetch-metadata
2013
# - https://github.com/hmarr/debug-action
2114

@@ -42,52 +35,13 @@ jobs:
4235
name: Checkout ${{ github.head_ref }}
4336
uses: actions/checkout@v3.0.2
4437
with:
45-
persist-credentials: ${{ steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' }}
4638
ref: ${{ github.head_ref }}
4739
token: ${{ env.GITHUB_TOKEN }}
48-
- id: gpg-import
49-
name: Import GPG key
50-
if: steps.metadata.outputs.package-ecosystem == 'npm_and_yarn'
51-
uses: crazy-max/ghaction-import-gpg@v5.1.0
52-
with:
53-
git_commit_gpgsign: true
54-
git_config_global: true
55-
git_user_signingkey: true
56-
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
57-
# todo: remove when https://github.com/crazy-max/ghaction-import-gpg/issues/118 is resolved
58-
- id: gpg-trust
59-
name: Set trust on GPG key
60-
if: steps.metadata.outputs.package-ecosystem == 'npm_and_yarn'
61-
run: |
62-
gpg --no-tty --command-fd 0 --edit-key ${{ steps.gpg-import.outputs.keyid }} << EOTRUST
63-
trust
64-
5
65-
y
66-
quit
67-
EOTRUST
68-
- id: lockfile-fix
69-
name: Fix yarn.lock
70-
if: steps.metadata.outputs.package-ecosystem == 'npm_and_yarn'
71-
run: yarn --mode=update-lockfile
72-
- id: dedupe
73-
name: Deduplicate dependencies
74-
if: steps.metadata.outputs.package-ecosystem == 'npm_and_yarn'
75-
run: yarn dedupe --mode=update-lockfile
76-
- id: lockfile-push
77-
name: Push yarn.lock
78-
if: steps.metadata.outputs.package-ecosystem == 'npm_and_yarn'
79-
run: |
80-
git add yarn.lock
81-
git status
82-
git diff-index --quiet HEAD || git commit -m "$COMMIT_MESSAGE" && git push -f
83-
env:
84-
GIT_AUTHOR_EMAIL: ${{ steps.gpg-import.outputs.email }}
85-
GIT_AUTHOR_NAME: ${{ steps.gpg-import.outputs.name }}
86-
GIT_COMMITTER_EMAIL: ${{ steps.gpg-import.outputs.email }}
87-
GIT_COMMITTER_NAME: ${{ steps.gpg-import.outputs.name }}
88-
COMMIT_MESSAGE: '[dependabot skip] chore(yarn): fix lockfile for @dependabot'
8940
- id: approve-pr
9041
name: Approve pull request
42+
if: |
43+
steps.metadata.outputs.package-ecosystem == 'github_actions' ||
44+
steps.metadata.outputs.update-type != 'version-update:semver-major'
9145
run: gh pr review ${{ github.event.number }} --approve
9246
- id: enable-auto-merge
9347
name: Enable auto-merge

0 commit comments

Comments
 (0)