chore: version packages #2022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Dependencies | |
| on: | |
| pull_request: | |
| paths: | |
| - '**/package.json' | |
| - 'pnpm-lock.yaml' | |
| - '.changeset/config.json' | |
| - 'pnpm-workspace.yaml' | |
| - 'scripts/check-changeset-fixed.mjs' | |
| # Re-run when the workflow itself changes, so edits to these gates are | |
| # exercised on the PR that introduces them. | |
| - '.github/workflows/validate-deps.yml' | |
| schedule: | |
| # Run weekly on Monday at 03:00 UTC | |
| - cron: '0 3 * * 1' | |
| workflow_dispatch: | |
| jobs: | |
| validate: | |
| name: Validate Package Dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Verify pnpm version | |
| run: pnpm --version | |
| - name: Get pnpm store directory | |
| shell: bash | |
| run: | | |
| echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV | |
| - name: Setup pnpm cache | |
| uses: actions/cache@v6 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: ${{ runner.os }}-pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm-store-v3- | |
| - name: Verify lockfile is up to date | |
| run: | | |
| pnpm install --frozen-lockfile --prefer-offline | |
| - name: Verify Changesets "fixed" group covers every public package | |
| run: node scripts/check-changeset-fixed.mjs | |
| # Fail the workflow if known vulnerabilities are found — enforces | |
| # security compliance before merging. | |
| # | |
| # Previously this ran `pnpm audit --audit-level=high`, but npm retired the | |
| # audit endpoint (HTTP 410, "This endpoint is being retired. Use the bulk | |
| # advisory endpoint instead.") and pnpm has not migrated, so `pnpm audit` | |
| # now fails unconditionally on every branch (see issue #2974). OSV-Scanner | |
| # reads pnpm-lock.yaml directly against the OSV database and exits non-zero | |
| # when any advisory matches, restoring a working blocking gate. | |
| # | |
| # Note: OSV-Scanner blocks on any severity, not just high/critical. To | |
| # accept a specific advisory, add an osv-scanner.toml `[[IgnoredVulns]]` | |
| # entry rather than lowering the gate. | |
| - name: Audit dependencies for known vulnerabilities (OSV-Scanner) | |
| uses: google/osv-scanner-action/osv-scanner-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 | |
| with: | |
| scan-args: |- | |
| --lockfile=pnpm-lock.yaml | |
| - name: List outdated packages | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| run: | | |
| pnpm outdated --recursive || true |