f32b76f213
Replace peter-evans/create-pull-request with plain gh CLI commands to avoid third-party supply chain risk. Uses only GitHub's own tooling (GITHUB_TOKEN + gh CLI) to create the lockfile refresh PR. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
81 lines
2.4 KiB
YAML
81 lines
2.4 KiB
YAML
name: Refresh Lockfile
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: refresh-lockfile-master
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
refresh:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9.15.4
|
|
run_install: false
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: pnpm
|
|
|
|
- name: Refresh pnpm lockfile
|
|
run: pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
|
|
|
|
- name: Fail on unexpected file changes
|
|
run: |
|
|
changed="$(git status --porcelain)"
|
|
if [ -z "$changed" ]; then
|
|
echo "Lockfile is already up to date."
|
|
exit 0
|
|
fi
|
|
if printf '%s\n' "$changed" | grep -Fvq ' pnpm-lock.yaml'; then
|
|
echo "Unexpected files changed during lockfile refresh:"
|
|
echo "$changed"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Create or update pull request
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
if git diff --quiet -- pnpm-lock.yaml; then
|
|
echo "Lockfile unchanged, nothing to do."
|
|
exit 0
|
|
fi
|
|
|
|
BRANCH="chore/refresh-lockfile"
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git checkout -B "$BRANCH"
|
|
git add pnpm-lock.yaml
|
|
git commit -m "chore(lockfile): refresh pnpm-lock.yaml"
|
|
git push -f origin "$BRANCH"
|
|
|
|
# Create PR if one doesn't already exist for this branch
|
|
existing=$(gh pr list --head "$BRANCH" --json number --jq '.[0].number')
|
|
if [ -n "$existing" ]; then
|
|
echo "PR #$existing already exists for $BRANCH, updated branch."
|
|
else
|
|
gh pr create \
|
|
--head "$BRANCH" \
|
|
--title "chore(lockfile): refresh pnpm-lock.yaml" \
|
|
--body "Auto-generated lockfile refresh after dependencies changed on \`master\`.\n\nThis PR only updates \`pnpm-lock.yaml\` — no source changes."
|
|
echo "Created new PR."
|
|
fi
|