6af74424d8Closes #2235. Switches the old dependency flow off now that #2232 landed the replacement. Removes the five npm ecosystem entries (root plus each client under clients/*) and, resolving the question #2229 left open, the github-actions entry as well — so .github/dependabot.yml goes away outright rather than being emptied, which its schema does not allow. The github-actions entry had exactly the property #2229 exists to remove: it opened a grouped monthly PR carrying no `Closes #N` and no board card, the one standing exception to "every PR references an issue". Deleting it unreplaced would have left 9 actions unwatched, and `npm outdated` says nothing about actions, so the monthly sweep now also checks every `uses:` ref under .github/workflows and renders the stale ones as one more section of the same tracking issue. Ranking comes from the release LIST, not `releases/latest`. That endpoint returns the release GitHub designates most recent, not the greatest version, so an action publishing a maintenance release for an older major (a v6.9.1 cut after v8.0.0) would make a workflow pinned to v7 compare against v6 and read as current — silently missing a whole major upgrade, the one thing this check exists to catch. Staleness is compared only to the precision the ref specifies. `v7` is a moving major tag that GitHub repoints at every v7.x release, so `v7` against a highest of `v7.0.1` is current and only `v8` makes it stale; an exactly-pinned `v7.0.0` is behind `v7.0.1`; a SHA pin is deliberately immovable and is never reported. A release lookup suppresses only a 404 — the legitimate "this action has never cut a release" answer — and throws on anything else. Treating a rate limit or an expired token as "no release" is indistinguishable from "not stale", and since every action here already sits on its latest major, the resulting empty section is byte-identical to a healthy run. `buildClearedBody` now speaks for both halves: once actions are in scope, its npm-only wording would assert a clean bill of health the sweep never checked. Dependabot security updates are unaffected — they are configured in repo settings, not in this file, and kept working while it was missing entirely (#1833, #1840). That note moves into the workflow header rather than dying with the file; #2233 is where they are turned off deliberately. The script header, the workflow header and the generated issue body all say version-update PRs rather than claiming Dependabot is replaced wholesale. Also renames the workflow's npm-outdated job to dependency-sweep now that the sweep is no longer npm-only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NGtzPg3UxMLszysQXXfqax Signed-off-by: cliffhall <cliff@futurescale.com>
58 lines
2.2 KiB
YAML
58 lines
2.2 KiB
YAML
# Monthly dependency sweep (#2229), replacing Dependabot's VERSION-UPDATE PRs.
|
|
#
|
|
# A Dependabot version-update PR carries no issue and no board card, so
|
|
# `.github/dependabot.yml` was removed outright in #2235 — npm and
|
|
# github-actions alike. This workflow is what replaced those PRs (security
|
|
# updates are a separate mechanism and stay on; see below): it runs
|
|
# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
|
|
# updates ONE tracking issue listing every outdated npm package across the root
|
|
# install and each client, plus any workflow `uses:` ref behind its action's
|
|
# highest released version. No PR is opened automatically. A maintainer
|
|
# reviews the
|
|
# issue, picks what to bump, and opens a normal PR against `v2/main`.
|
|
#
|
|
# Dependabot SECURITY updates are unaffected: they are enabled in repo
|
|
# settings, not in a config file, and kept working while `dependabot.yml` was
|
|
# missing entirely (see #1833, #1840). They are raised against the default
|
|
# branch and still need retargeting by hand.
|
|
#
|
|
# `GITHUB_TOKEN` is sufficient: it only needs to read milestones and the public
|
|
# release feeds of the actions we use, and to create/edit an issue
|
|
# (`issues: write`). Board placement is intentionally NOT attempted here — that
|
|
# needs an org-project PAT this token cannot have — so a filed-but-unboarded
|
|
# issue is picked up by the next `/issue-triage` sweep, same as any other
|
|
# maintainer-filed issue.
|
|
name: Dependency Refresh
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "23 6 1 * *" # 06:23 UTC on the 1st of every month
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
|
|
jobs:
|
|
dependency-sweep:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout v2/main
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: v2/main
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '22.x'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies (root + all clients)
|
|
run: npm install
|
|
|
|
- name: Run the dependency sweep (npm packages + workflow actions)
|
|
run: node scripts/dependency-refresh.mjs
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|