|
| 1 | +name: Renovate Lockfiles |
| 2 | + |
| 3 | +# Renovate cannot refresh lockfiles itself: pnpm-workspace.yaml and Cargo.toml |
| 4 | +# reference the gitignored vite/ and rolldown/ checkouts (patched dependencies, |
| 5 | +# workspace importers, path crates), so artifact updates fail in Renovate's |
| 6 | +# clone. This workflow checks out the vendored repos at their pinned hashes and |
| 7 | +# regenerates the lockfiles on every Renovate branch push instead. Renovate |
| 8 | +# ignores the resulting commits via gitIgnoredAuthors in .github/renovate.json. |
| 9 | + |
| 10 | +permissions: {} |
| 11 | + |
| 12 | +on: |
| 13 | + push: |
| 14 | + branches: |
| 15 | + - renovate/** |
| 16 | + |
| 17 | +# Queue instead of cancel: this workflow's own lockfile push retriggers it in |
| 18 | +# the same group, and cancel-in-progress would cancel the effective run at its |
| 19 | +# final step, leaving a misleading "cancelled" conclusion. |
| 20 | +concurrency: |
| 21 | + group: ${{ github.workflow }}-${{ github.ref }} |
| 22 | + cancel-in-progress: false |
| 23 | + |
| 24 | +jobs: |
| 25 | + update-lockfiles: |
| 26 | + # Skip the retriggered run for this workflow's own lockfile commit. |
| 27 | + if: github.event.repository.fork == false && github.actor != 'voidzero-guard[bot]' |
| 28 | + runs-on: ubuntu-latest |
| 29 | + permissions: |
| 30 | + contents: read |
| 31 | + steps: |
| 32 | + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
| 33 | + with: |
| 34 | + persist-credentials: false |
| 35 | + |
| 36 | + - uses: ./.github/actions/clone |
| 37 | + |
| 38 | + - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 |
| 39 | + |
| 40 | + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 |
| 41 | + with: |
| 42 | + node-version-file: .node-version |
| 43 | + |
| 44 | + # Not oxc-project/setup-node: it runs `pnpm install --frozen-lockfile`, |
| 45 | + # which fails on Renovate branches because the lockfile is stale here. |
| 46 | + - name: Update pnpm lockfiles |
| 47 | + env: |
| 48 | + # Resolution does not need lifecycle scripts; keep dependency scripts |
| 49 | + # from running in a workflow that later pushes with a write token. |
| 50 | + npm_config_ignore_scripts: 'true' |
| 51 | + run: | |
| 52 | + pnpm install --lockfile-only --no-frozen-lockfile |
| 53 | + pnpm dedupe --check || pnpm dedupe |
| 54 | + pnpm -C docs install --lockfile-only --no-frozen-lockfile |
| 55 | +
|
| 56 | + # cargo metadata syncs Cargo.lock to the bumped manifests without |
| 57 | + # compiling or running build scripts. rustup auto-installs the pinned |
| 58 | + # toolchain from rust-toolchain.toml. |
| 59 | + - name: Update Cargo.lock |
| 60 | + run: cargo metadata --format-version=1 > /dev/null |
| 61 | + |
| 62 | + - name: Detect lockfile changes |
| 63 | + id: diff |
| 64 | + run: | |
| 65 | + git diff --stat -- pnpm-lock.yaml docs/pnpm-lock.yaml Cargo.lock |
| 66 | + if git diff --quiet -- pnpm-lock.yaml docs/pnpm-lock.yaml Cargo.lock; then |
| 67 | + echo "changed=false" >> "$GITHUB_OUTPUT" |
| 68 | + else |
| 69 | + echo "changed=true" >> "$GITHUB_OUTPUT" |
| 70 | + fi |
| 71 | +
|
| 72 | + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 |
| 73 | + if: steps.diff.outputs.changed == 'true' |
| 74 | + id: app-token |
| 75 | + with: |
| 76 | + client-id: ${{ secrets.APP_ID }} |
| 77 | + private-key: ${{ secrets.APP_PRIVATE_KEY }} |
| 78 | + |
| 79 | + - name: Commit and push lockfiles |
| 80 | + if: steps.diff.outputs.changed == 'true' |
| 81 | + env: |
| 82 | + APP_TOKEN: ${{ steps.app-token.outputs.token }} |
| 83 | + BRANCH: ${{ github.ref_name }} |
| 84 | + run: | |
| 85 | + # Identity must stay in sync with gitIgnoredAuthors in |
| 86 | + # .github/renovate.json so Renovate keeps managing the branch. |
| 87 | + git config user.name "voidzero-guard[bot]" |
| 88 | + git config user.email "278573678+voidzero-guard[bot]@users.noreply.github.com" |
| 89 | + git add pnpm-lock.yaml docs/pnpm-lock.yaml Cargo.lock |
| 90 | + git commit -m "chore: update lockfiles" |
| 91 | + git push "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:refs/heads/${BRANCH}" |
0 commit comments