Skip to content

Commit fe500ed

Browse files
ksroda-saclaude
ksroda-sa
and
claude
committed
chore(ci): expand dependabot coverage and add test-java/test-android workflows
Close gaps where dep bumps were either never proposed or merged without a CI gate: - dependabot.yml: add npm entries for vue/* and node/*, maven entries for java/*, nuget entries for dotnet/* - test-java.yml: new workflow auto-discovers pom.xml, runs `mvn -B verify` on JDK 21 — gates maven bumps before auto-merge - test-android.yml: new workflow builds RN Android (assembleDebug) so RN bumps have a native build gate even though they're manual-review only - dependabot-auto-merge.yml: exclude /samples/react-native/* — RN bumps can change native autolinking that `tsc --noEmit` doesn't catch Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 62f960a commit fe500ed

4 files changed

Lines changed: 296 additions & 2 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,81 @@ updates:
4040
commit-message:
4141
prefix: "deps"
4242

43+
- package-ecosystem: "npm"
44+
directory: "/samples/vue/login-pkce"
45+
schedule:
46+
interval: "weekly"
47+
open-pull-requests-limit: 5
48+
labels:
49+
- "dependencies"
50+
commit-message:
51+
prefix: "deps"
52+
53+
- package-ecosystem: "npm"
54+
directory: "/samples/vue/token-refresh"
55+
schedule:
56+
interval: "weekly"
57+
open-pull-requests-limit: 5
58+
labels:
59+
- "dependencies"
60+
commit-message:
61+
prefix: "deps"
62+
63+
- package-ecosystem: "npm"
64+
directory: "/samples/node/login-auth-code"
65+
schedule:
66+
interval: "weekly"
67+
open-pull-requests-limit: 5
68+
labels:
69+
- "dependencies"
70+
commit-message:
71+
prefix: "deps"
72+
73+
- package-ecosystem: "npm"
74+
directory: "/samples/node/saml-sp-login"
75+
schedule:
76+
interval: "weekly"
77+
open-pull-requests-limit: 5
78+
labels:
79+
- "dependencies"
80+
commit-message:
81+
prefix: "deps"
82+
83+
- package-ecosystem: "npm"
84+
directory: "/samples/node/token-refresh"
85+
schedule:
86+
interval: "weekly"
87+
open-pull-requests-limit: 5
88+
labels:
89+
- "dependencies"
90+
commit-message:
91+
prefix: "deps"
92+
93+
# React Native samples — labelled "manual-review" so the auto-merge workflow
94+
# skips them. Dep bumps here can break native autolinking / API shapes that
95+
# `tsc --noEmit` doesn't catch; require human eyes on every update.
96+
- package-ecosystem: "npm"
97+
directory: "/samples/react-native/login-pkce"
98+
schedule:
99+
interval: "weekly"
100+
open-pull-requests-limit: 5
101+
labels:
102+
- "dependencies"
103+
- "manual-review"
104+
commit-message:
105+
prefix: "deps"
106+
107+
- package-ecosystem: "npm"
108+
directory: "/samples/react-native/token-refresh"
109+
schedule:
110+
interval: "weekly"
111+
open-pull-requests-limit: 5
112+
labels:
113+
- "dependencies"
114+
- "manual-review"
115+
commit-message:
116+
prefix: "deps"
117+
43118
- package-ecosystem: "npm"
44119
directory: "/scripts"
45120
schedule:
@@ -50,6 +125,66 @@ updates:
50125
commit-message:
51126
prefix: "deps"
52127

128+
- package-ecosystem: "maven"
129+
directory: "/samples/java/login-auth-code"
130+
schedule:
131+
interval: "weekly"
132+
open-pull-requests-limit: 5
133+
labels:
134+
- "dependencies"
135+
commit-message:
136+
prefix: "deps"
137+
138+
- package-ecosystem: "maven"
139+
directory: "/samples/java/saml-sp-login"
140+
schedule:
141+
interval: "weekly"
142+
open-pull-requests-limit: 5
143+
labels:
144+
- "dependencies"
145+
commit-message:
146+
prefix: "deps"
147+
148+
- package-ecosystem: "maven"
149+
directory: "/samples/java/token-refresh"
150+
schedule:
151+
interval: "weekly"
152+
open-pull-requests-limit: 5
153+
labels:
154+
- "dependencies"
155+
commit-message:
156+
prefix: "deps"
157+
158+
- package-ecosystem: "nuget"
159+
directory: "/samples/dotnet/login-auth-code"
160+
schedule:
161+
interval: "weekly"
162+
open-pull-requests-limit: 5
163+
labels:
164+
- "dependencies"
165+
commit-message:
166+
prefix: "deps"
167+
168+
- package-ecosystem: "nuget"
169+
directory: "/samples/dotnet/saml-sp-login"
170+
schedule:
171+
interval: "weekly"
172+
open-pull-requests-limit: 5
173+
labels:
174+
- "dependencies"
175+
commit-message:
176+
prefix: "deps"
177+
178+
- package-ecosystem: "nuget"
179+
directory: "/samples/dotnet/token-refresh"
180+
schedule:
181+
interval: "weekly"
182+
open-pull-requests-limit: 5
183+
labels:
184+
- "dependencies"
185+
commit-message:
186+
prefix: "deps"
187+
53188
- package-ecosystem: "github-actions"
54189
directory: "/"
55190
schedule:

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,22 @@ jobs:
1717
with:
1818
github-token: ${{ secrets.GITHUB_TOKEN }}
1919
- name: Approve PR
20-
if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
20+
# Auto-merge patch + minor updates EXCEPT for React Native samples.
21+
# RN dep bumps can change native autolinking / API shapes that
22+
# `tsc --noEmit` doesn't catch — require manual review.
23+
if: |
24+
(steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
25+
steps.metadata.outputs.update-type == 'version-update:semver-minor') &&
26+
!startsWith(steps.metadata.outputs.directory, '/samples/react-native')
2127
run: gh pr review --approve "$PR_URL"
2228
env:
2329
PR_URL: ${{ github.event.pull_request.html_url }}
2430
GH_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_1_PAT1 }}
2531
- name: Enable auto-merge
26-
if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
32+
if: |
33+
(steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
34+
steps.metadata.outputs.update-type == 'version-update:semver-minor') &&
35+
!startsWith(steps.metadata.outputs.directory, '/samples/react-native')
2736
run: gh pr merge --auto --squash "$PR_URL"
2837
env:
2938
PR_URL: ${{ github.event.pull_request.html_url }}

‎.github/workflows/test-android.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Test Android Builds
2+
3+
on:
4+
push:
5+
paths:
6+
- "samples/**/android/**"
7+
- "samples/**/package.json"
8+
- "samples/**/yarn.lock"
9+
- ".github/workflows/test-android.yml"
10+
pull_request:
11+
paths:
12+
- "samples/**/android/**"
13+
- "samples/**/package.json"
14+
- "samples/**/yarn.lock"
15+
- ".github/workflows/test-android.yml"
16+
schedule:
17+
- cron: "0 9 * * 1"
18+
workflow_dispatch:
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
find-projects:
25+
runs-on: ubuntu-latest
26+
outputs:
27+
matrix: ${{ steps.find.outputs.matrix }}
28+
steps:
29+
- uses: actions/checkout@v6
30+
- id: find
31+
# Discover any sample with an Android Gradle wrapper. Today: react-native
32+
# samples; future: native android samples will surface automatically.
33+
run: |
34+
DIRS=$(find samples -name "gradlew" -not -path "*/node_modules/*" -not -path "*/build/*" -exec dirname {} \; 2>/dev/null \
35+
| sort | jq -R -s -c 'split("\n") | map(select(. != ""))')
36+
echo "matrix=$DIRS" >> "$GITHUB_OUTPUT"
37+
38+
build:
39+
needs: find-projects
40+
if: ${{ needs.find-projects.outputs.matrix != '[]' }}
41+
runs-on: ubuntu-latest
42+
strategy:
43+
fail-fast: false
44+
matrix:
45+
android_dir: ${{ fromJson(needs.find-projects.outputs.matrix) }}
46+
steps:
47+
- uses: actions/checkout@v6
48+
49+
- name: Set up JDK 17
50+
uses: actions/setup-java@v5
51+
with:
52+
distribution: "temurin"
53+
java-version: "17"
54+
55+
- name: Set up Android SDK
56+
uses: android-actions/setup-android@v3
57+
with:
58+
packages: "platform-tools platforms;android-35 build-tools;35.0.0"
59+
60+
# React Native samples need their JS deps installed first so autolinking
61+
# can resolve native modules from node_modules. Detect by walking up to
62+
# the directory that owns package.json.
63+
- uses: actions/setup-node@v6
64+
with:
65+
node-version: "22"
66+
- name: Enable Corepack
67+
run: corepack enable
68+
69+
- name: Install JS dependencies (RN samples)
70+
run: |
71+
# ${{ matrix.android_dir }} is e.g. "samples/react-native/login-pkce/android".
72+
# Walk up until we find a package.json or hit the repo root.
73+
dir="${{ matrix.android_dir }}"
74+
while [ "$dir" != "." ] && [ "$dir" != "/" ]; do
75+
if [ -f "$dir/package.json" ]; then
76+
echo "Installing JS deps in $dir"
77+
(cd "$dir" && yarn install --immutable)
78+
break
79+
fi
80+
dir=$(dirname "$dir")
81+
done
82+
83+
- name: Generate debug keystore
84+
# The committed sample doesn't ship debug.keystore (gitignored).
85+
# Generate a throwaway one so Gradle's `validateSigningDebug` passes.
86+
run: |
87+
keytool -genkeypair -v \
88+
-keystore "${{ matrix.android_dir }}/app/debug.keystore" \
89+
-storepass android -alias androiddebugkey -keypass android \
90+
-keyalg RSA -keysize 2048 -validity 10000 \
91+
-dname "CN=Android Debug,O=Android,C=US"
92+
93+
- name: Cache Gradle
94+
uses: actions/cache@v4
95+
with:
96+
path: |
97+
~/.gradle/caches
98+
~/.gradle/wrapper
99+
key: gradle-${{ runner.os }}-${{ hashFiles(format('{0}/gradle/wrapper/gradle-wrapper.properties', matrix.android_dir), format('{0}/build.gradle*', matrix.android_dir), format('{0}/app/build.gradle*', matrix.android_dir)) }}
100+
restore-keys: gradle-${{ runner.os }}-
101+
102+
- name: assembleDebug
103+
working-directory: ${{ matrix.android_dir }}
104+
run: ./gradlew assembleDebug --no-daemon

‎.github/workflows/test-java.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Test Java Frameworks
2+
3+
on:
4+
push:
5+
paths:
6+
- "samples/**"
7+
pull_request:
8+
paths:
9+
- "samples/**"
10+
schedule:
11+
- cron: "0 8 * * 1"
12+
workflow_dispatch:
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
find-projects:
19+
runs-on: ubuntu-latest
20+
outputs:
21+
matrix: ${{ steps.find.outputs.matrix }}
22+
steps:
23+
- uses: actions/checkout@v6
24+
- id: find
25+
run: |
26+
DIRS=$(find samples -name "pom.xml" -not -path "*/target/*" -not -path "*/node_modules/*" -exec dirname {} \; 2>/dev/null | sort | jq -R -s -c 'split("\n") | map(select(. != ""))')
27+
echo "matrix=$DIRS" >> "$GITHUB_OUTPUT"
28+
29+
test:
30+
needs: find-projects
31+
if: ${{ needs.find-projects.outputs.matrix != '[]' }}
32+
runs-on: ubuntu-latest
33+
strategy:
34+
fail-fast: false
35+
matrix:
36+
project: ${{ fromJson(needs.find-projects.outputs.matrix) }}
37+
steps:
38+
- uses: actions/checkout@v6
39+
- uses: actions/setup-java@v5
40+
with:
41+
distribution: "temurin"
42+
java-version: "21"
43+
cache: "maven"
44+
- name: Build and test
45+
working-directory: ${{ matrix.project }}
46+
run: mvn -B verify

0 commit comments

Comments
 (0)