dependabot/npm_and_yarn/main/proc-log-7.0.0
@reggi/path-to-regexp
dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2
dependabot/npm_and_yarn/main/eslint-10.4.0
dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0
dependabot/npm_and_yarn/main/proc-log-7.0.0
dependabot/npm_and_yarn/npm_and_yarn-826852524d
dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2
deprecate-totp-2fa
dhei/classic-tokens
gat-bypass-2fa-docs
jpg619/fix-accessibility-content-flow
jpg619/version-bump-tar-2
kartykp/gat-bypass-2fa-docs
kartykp/upgrade-path-to-regex
main
maitxn/version-bump-tar
patch-1
reggi/cache-based-on-version
reggi/dev-engines
reggi/fix-transform-prettier
reggi/overrides
update-search-sensitivity
| 1 | # This file is automatically added by @npmcli/template-oss. Do not edit. |
| 2 | |
| 3 | name: Post Dependabot |
| 4 | |
| 5 | on: pull_request |
| 6 | |
| 7 | permissions: |
| 8 | contents: write |
| 9 | |
| 10 | jobs: |
| 11 | template-oss: |
| 12 | name: template-oss |
| 13 | if: github.repository_owner == 'npm' && github.actor == 'dependabot[bot]' |
| 14 | runs-on: ubuntu-latest |
| 15 | defaults: |
| 16 | run: |
| 17 | shell: bash |
| 18 | steps: |
| 19 | - name: Checkout |
| 20 | uses: actions/checkout@v6 |
| 21 | with: |
| 22 | ref: ${{ github.event.pull_request.head.ref }} |
| 23 | - name: Setup Git User |
| 24 | run: | |
| 25 | git config --global user.email "npm-cli+bot@github.com" |
| 26 | git config --global user.name "npm CLI robot" |
| 27 | - name: Setup Node |
| 28 | uses: actions/setup-node@v6 |
| 29 | id: node |
| 30 | with: |
| 31 | node-version: 22.x |
| 32 | check-latest: contains('22.x', '.x') |
| 33 | cache: npm |
| 34 | - name: Install Dependencies |
| 35 | run: npm i --no-audit --no-fund |
| 36 | - name: Fetch Dependabot Metadata |
| 37 | id: metadata |
| 38 | uses: dependabot/fetch-metadata@v1 |
| 39 | with: |
| 40 | github-token: ${{ secrets.GITHUB_TOKEN }} |
| 41 | |
| 42 | # Dependabot can update multiple directories so we output which directory |
| 43 | # it is acting on so we can run the command for the correct root or workspace |
| 44 | - name: Get Dependabot Directory |
| 45 | if: contains(steps.metadata.outputs.dependency-names, '@npmcli/template-oss') |
| 46 | id: flags |
| 47 | run: | |
| 48 | dependabot_dir="${{ steps.metadata.outputs.directory }}" |
| 49 | if [[ "$dependabot_dir" == "/" || "$dependabot_dir" == "/main" ]]; then |
| 50 | echo "workspace=-iwr" >> $GITHUB_OUTPUT |
| 51 | else |
| 52 | # strip leading slash from directory so it works as a |
| 53 | # a path to the workspace flag |
| 54 | echo "workspace=--workspace ${dependabot_dir#/}" >> $GITHUB_OUTPUT |
| 55 | fi |
| 56 | |
| 57 | - name: Apply Changes |
| 58 | if: steps.flags.outputs.workspace |
| 59 | id: apply |
| 60 | run: | |
| 61 | npm run template-oss-apply ${{ steps.flags.outputs.workspace }} |
| 62 | if [[ `git status --porcelain` ]]; then |
| 63 | echo "changes=true" >> $GITHUB_OUTPUT |
| 64 | fi |
| 65 | # This only sets the conventional commit prefix. This workflow can't reliably determine |
| 66 | # what the breaking change is though. If a BREAKING CHANGE message is required then |
| 67 | # this PR check will fail and the commit will be amended with stafftools |
| 68 | if [[ "${{ steps.metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then |
| 69 | prefix='feat!' |
| 70 | else |
| 71 | prefix='chore' |
| 72 | fi |
| 73 | echo "message=$prefix: postinstall for dependabot template-oss PR" >> $GITHUB_OUTPUT |
| 74 | |
| 75 | # This step will fail if template-oss has made any workflow updates. It is impossible |
| 76 | # for a workflow to update other workflows. In the case it does fail, we continue |
| 77 | # and then try to apply only a portion of the changes in the next step |
| 78 | - name: Push All Changes |
| 79 | if: steps.apply.outputs.changes |
| 80 | id: push |
| 81 | continue-on-error: true |
| 82 | env: |
| 83 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 84 | run: | |
| 85 | git commit -am "${{ steps.apply.outputs.message }}" |
| 86 | git push |
| 87 | |
| 88 | # If the previous step failed, then reset the commit and remove any workflow changes |
| 89 | # and attempt to commit and push again. This is helpful because we will have a commit |
| 90 | # with the correct prefix that we can then --amend with @npmcli/stafftools later. |
| 91 | - name: Push All Changes Except Workflows |
| 92 | if: steps.apply.outputs.changes && steps.push.outcome == 'failure' |
| 93 | env: |
| 94 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 95 | run: | |
| 96 | git reset HEAD~ |
| 97 | git checkout HEAD -- .github/workflows/ |
| 98 | git clean -fd .github/workflows/ |
| 99 | git commit -am "${{ steps.apply.outputs.message }}" |
| 100 | git push |
| 101 | |
| 102 | # Check if all the necessary template-oss changes were applied. Since we continued |
| 103 | # on errors in one of the previous steps, this check will fail if our follow up |
| 104 | # only applied a portion of the changes and we need to followup manually. |
| 105 | # |
| 106 | # Note that this used to run `lint` and `postlint` but that will fail this action |
| 107 | # if we've also shipped any linting changes separate from template-oss. We do |
| 108 | # linting in another action, so we want to fail this one only if there are |
| 109 | # template-oss changes that could not be applied. |
| 110 | - name: Check Changes |
| 111 | if: steps.apply.outputs.changes |
| 112 | run: | |
| 113 | npm exec --offline ${{ steps.flags.outputs.workspace }} -- template-oss-check |
| 114 | |
| 115 | - name: Fail on Breaking Change |
| 116 | if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, 'feat!') |
| 117 | run: | |
| 118 | echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'" |
| 119 | echo "for more information on how to fix this with a BREAKING CHANGE footer." |
| 120 | exit 1 |