ee14a9fc1cThe npm-entry removal in `.github/dependabot.yml` is split out of this PR so that every change to that one file lands in a single reviewable piece — alongside the `github-actions` entry, which #2229 had declared out of scope but which opens the same issue-less, board-cardless PR the decision exists to remove. Reverts `.github/dependabot.yml` to its `v2/main` state, leaving this PR with the release-time `npm audit fix` and the monthly `npm outdated` sweep: the replacement flow, not the switch-off. Both new files' header comments claimed the switch-off had already happened, which is false until #2235 lands. They now say #2235 does it, and that until then Dependabot's npm PRs and this sweep overlap — duplicate signal rather than conflicting action. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RWMJENjs1mExXE5XPJTEei Signed-off-by: cliffhall <cliff@futurescale.com>
52 lines
1.8 KiB
YAML
52 lines
1.8 KiB
YAML
# Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
|
|
#
|
|
# A Dependabot version-update PR carries no issue and no board card, so npm
|
|
# version updates are being switched off in `.github/dependabot.yml`. That file
|
|
# is changed in #2235, not here — until it lands, Dependabot's npm PRs and this
|
|
# sweep overlap, which is duplicate signal rather than conflicting action.
|
|
#
|
|
# This workflow runs `scripts/dependency-refresh.mjs` against `v2/main` once a
|
|
# month and files or updates ONE tracking issue listing every outdated package
|
|
# across the root install and each client — no PR is opened automatically. A
|
|
# maintainer reviews the issue, picks what to bump, and opens a normal PR
|
|
# against `v2/main`.
|
|
#
|
|
# `GITHUB_TOKEN` is sufficient: it only needs to read milestones (public) and
|
|
# create/edit an issue (`issues: write`). Board placement is intentionally NOT
|
|
# attempted here — that needs an org-project PAT this token cannot have — so a
|
|
# filed-but-unboarded issue is picked up by the next `/issue-triage` sweep,
|
|
# same as any other maintainer-filed issue.
|
|
name: Dependency Refresh
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "23 6 1 * *" # 06:23 UTC on the 1st of every month
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
|
|
jobs:
|
|
npm-outdated:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout v2/main
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: v2/main
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '22.x'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies (root + all clients)
|
|
run: npm install
|
|
|
|
- name: Run the npm-outdated sweep
|
|
run: node scripts/dependency-refresh.mjs
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|