From 4fc4172db3416f513d643dad18afdc704f4324f0 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 19:19:53 -0600 Subject: [PATCH 01/14] add action to sync dependencies bumped by dependabot --- .github/workflows/dependabot-sync.yml | 23 ++++++++++++++++++ scripts/sync-dependencies.mjs | 35 +++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 .github/workflows/dependabot-sync.yml create mode 100644 scripts/sync-dependencies.mjs diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml new file mode 100644 index 00000000000..15cde3179bf --- /dev/null +++ b/.github/workflows/dependabot-sync.yml @@ -0,0 +1,23 @@ +name: Sync Dependabot Bump +on: + pull_request: + branches: dependabot/npm_and_yarn/** + +jobs: + sync: + name: Sync dependency files + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [16.x] + + steps: + - name: Checkout Repository + uses: actions/checkout@v3 + - name: Setup Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v3 + with: + node-version: ${{ matrix.node-version }} + - name: Run Sync Script + run: node ./scripts/sync-dependencies.mjs {{github.ref_name}} diff --git a/scripts/sync-dependencies.mjs b/scripts/sync-dependencies.mjs new file mode 100644 index 00000000000..58a905666f2 --- /dev/null +++ b/scripts/sync-dependencies.mjs @@ -0,0 +1,35 @@ +// when dependabot updates a dependency in a package.json, +// we want to update it in our dependencies.yaml so the update doesn't get clobbered +// This script is run by the github action in dependabot-sync.yml +import process from 'node:process' +import yaml from 'js-yaml' +import { readFileSync, writeFileSync } from 'fs' +import path from 'path' +import { fileURLToPath } from 'url' + +// when dependabot updates a dependency in a package.json, we want to update it in our dependencies.yaml +const __filename = fileURLToPath(import.meta.url) +const __dirname = path.dirname(__filename) + +const depsFile = path.join(__dirname, '..', 'config/dependencies.yaml') +const oldDepsRaw = readFileSync(depsFile, { encoding: 'utf8' }) + +// we get the branch name handed to us by the github action, +// and it has all the info we need about the dependency being updated +const branchName = process.argv[2] +const versionRgx = /\d+\.\d+\.\d+$/ +const dependencyVersion = branchName.match(versionRgx)[0] +const dependency = branchName + .replace(`-${dependencyVersion}`, '') + .replace('dependabot/npm_and_yarn/', '') + +// because this is from dependabot, +// and because we want all our versions synced +// we simply find and replace the version wherever it is specified +const rgx = new RegExp(`(?<='${dependency}':\\W{0,2}\\w*\\W?')\\d+\\.\\d+\\.\\d+(?=')`, 'g') +const newDepsRaw = oldDepsRaw.replace(rgx, dependencyVersion) +console.log(`Updating ${dependency} version to ${dependencyVersion} in config/dependencies.yaml`) + +// write the file +writeFileSync(depsFile, newDepsRaw) +console.log('Successfully updated config/dependencies.yaml') From ad4ae8851176e1affffb681421f3c3074417fc4a Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 19:26:14 -0600 Subject: [PATCH 02/14] lint fix --- scripts/sync-dependencies.mjs | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/sync-dependencies.mjs b/scripts/sync-dependencies.mjs index 58a905666f2..476c3091eef 100644 --- a/scripts/sync-dependencies.mjs +++ b/scripts/sync-dependencies.mjs @@ -2,7 +2,6 @@ // we want to update it in our dependencies.yaml so the update doesn't get clobbered // This script is run by the github action in dependabot-sync.yml import process from 'node:process' -import yaml from 'js-yaml' import { readFileSync, writeFileSync } from 'fs' import path from 'path' import { fileURLToPath } from 'url' From 03d532916aae9aea8444c389bf789a76200a3180 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 23:24:35 -0600 Subject: [PATCH 03/14] add step to commit changes made by action --- .github/workflows/dependabot-sync.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 15cde3179bf..66c051cc9a0 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -21,3 +21,10 @@ jobs: node-version: ${{ matrix.node-version }} - name: Run Sync Script run: node ./scripts/sync-dependencies.mjs {{github.ref_name}} + - name: Commit Changes + run: | + git config user.name github-actions + git config user.email github-actions@github.com + git add . + git commit -m "bumped {{github.ref_name}} changes in config/dependencies.yaml" + git push From 251785b5c0e74786010db42bba62fe44b37c30eb Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 23:34:23 -0600 Subject: [PATCH 04/14] changing filtering logic --- .github/workflows/dependabot-sync.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 66c051cc9a0..091555b5d97 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -1,10 +1,9 @@ name: Sync Dependabot Bump -on: - pull_request: - branches: dependabot/npm_and_yarn/** +on: pull_request jobs: sync: + if: ${{ github.actor == 'dependabot[bot]' }} name: Sync dependency files runs-on: ubuntu-latest From c36663364193a6c610f52a0faa119381a3bb018a Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 23:42:01 -0600 Subject: [PATCH 05/14] adding logging to debug issue --- scripts/sync-dependencies.mjs | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/sync-dependencies.mjs b/scripts/sync-dependencies.mjs index 476c3091eef..358bcbf9fe3 100644 --- a/scripts/sync-dependencies.mjs +++ b/scripts/sync-dependencies.mjs @@ -16,6 +16,7 @@ const oldDepsRaw = readFileSync(depsFile, { encoding: 'utf8' }) // we get the branch name handed to us by the github action, // and it has all the info we need about the dependency being updated const branchName = process.argv[2] +console.log('processing updates from ', branchName) const versionRgx = /\d+\.\d+\.\d+$/ const dependencyVersion = branchName.match(versionRgx)[0] const dependency = branchName From 1b352a49c0ff766da20b0f38ba1e322ad0693763 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 23:44:05 -0600 Subject: [PATCH 06/14] oops, interpolation --- .github/workflows/dependabot-sync.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 091555b5d97..66cb1a03202 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -19,7 +19,7 @@ jobs: with: node-version: ${{ matrix.node-version }} - name: Run Sync Script - run: node ./scripts/sync-dependencies.mjs {{github.ref_name}} + run: node ./scripts/sync-dependencies.mjs ${{github.ref_name}} - name: Commit Changes run: | git config user.name github-actions From 9d7de724651c0c223b681e56dcf8b5eafb2f6536 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 23:49:28 -0600 Subject: [PATCH 07/14] head_ref instead of ref_name --- .github/workflows/dependabot-sync.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 66cb1a03202..12ef625a199 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -19,11 +19,11 @@ jobs: with: node-version: ${{ matrix.node-version }} - name: Run Sync Script - run: node ./scripts/sync-dependencies.mjs ${{github.ref_name}} + run: node ./scripts/sync-dependencies.mjs ${{github.head_ref}} - name: Commit Changes run: | git config user.name github-actions git config user.email github-actions@github.com git add . - git commit -m "bumped {{github.ref_name}} changes in config/dependencies.yaml" + git commit -m "bumped {{github.head_ref}} changes in config/dependencies.yaml" git push From 930de60608e5c59c06ad52cfdd267e9ddc221694 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 23:54:52 -0600 Subject: [PATCH 08/14] troubleshooting git issues --- .github/workflows/dependabot-sync.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 12ef625a199..ba21f8f6d9b 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -22,8 +22,9 @@ jobs: run: node ./scripts/sync-dependencies.mjs ${{github.head_ref}} - name: Commit Changes run: | + git status git config user.name github-actions git config user.email github-actions@github.com - git add . - git commit -m "bumped {{github.head_ref}} changes in config/dependencies.yaml" + git add -A + git commit -m "bumped ${{github.head_ref}} changes in config/dependencies.yaml" git push From f74ecbcb4019085dd82a4330307ef3a94c690135 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Fri, 3 Feb 2023 23:57:35 -0600 Subject: [PATCH 09/14] fixing detached head issue --- .github/workflows/dependabot-sync.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index ba21f8f6d9b..ecea0140d52 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -14,17 +14,19 @@ jobs: steps: - name: Checkout Repository uses: actions/checkout@v3 + with: + ref: ${{ github.head_ref }} - name: Setup Node.js ${{ matrix.node-version }} uses: actions/setup-node@v3 with: node-version: ${{ matrix.node-version }} - name: Run Sync Script - run: node ./scripts/sync-dependencies.mjs ${{github.head_ref}} + run: node ./scripts/sync-dependencies.mjs ${{ github.head_ref }} - name: Commit Changes run: | git status git config user.name github-actions git config user.email github-actions@github.com git add -A - git commit -m "bumped ${{github.head_ref}} changes in config/dependencies.yaml" + git commit -m "bumped ${{ github.head_ref }} changes in config/dependencies.yaml" git push From e06331ef7e19376885a13c7673c5a689273028ae Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Sat, 4 Feb 2023 00:05:50 -0600 Subject: [PATCH 10/14] fix git command --- .github/workflows/dependabot-sync.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index ecea0140d52..5f5c7f64b97 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -27,6 +27,5 @@ jobs: git status git config user.name github-actions git config user.email github-actions@github.com - git add -A - git commit -m "bumped ${{ github.head_ref }} changes in config/dependencies.yaml" + git commit -am "bumped ${{ github.head_ref }} changes in config/dependencies.yaml" git push From cf9f86ec7a6df73172efff131e7026ffce05744b Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Sat, 4 Feb 2023 00:12:03 -0600 Subject: [PATCH 11/14] add dependabot skip to action commit message --- .github/workflows/dependabot-sync.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 5f5c7f64b97..412099deb9e 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -27,5 +27,5 @@ jobs: git status git config user.name github-actions git config user.email github-actions@github.com - git commit -am "bumped ${{ github.head_ref }} changes in config/dependencies.yaml" + git commit -am "[dependabot skip] bumped ${{ github.head_ref }} changes in config/dependencies.yaml" git push From 189bd651d416b2dc218afa1ca7ac63c263007d02 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Sat, 4 Feb 2023 00:21:12 -0600 Subject: [PATCH 12/14] remove logic filters for testing --- .github/workflows/dependabot-sync.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 412099deb9e..0f3d9601298 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -1,9 +1,11 @@ name: Sync Dependabot Bump -on: pull_request +on: + pull_request: + types: [opened, reopened, edited] + jobs: sync: - if: ${{ github.actor == 'dependabot[bot]' }} name: Sync dependency files runs-on: ubuntu-latest From b00b20c99bdb2a914a35e65fa9372f6e42685d65 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Sat, 4 Feb 2023 00:25:59 -0600 Subject: [PATCH 13/14] give action write permission for pull requests --- .github/workflows/dependabot-sync.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 0f3d9601298..349a63a908a 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -2,6 +2,8 @@ name: Sync Dependabot Bump on: pull_request: types: [opened, reopened, edited] +permissions: + pull-requests: write jobs: From 00ffc69b4a102f3fc8f4cb5dfcf9c8ea2b373d09 Mon Sep 17 00:00:00 2001 From: Enoch Riese Date: Sat, 4 Feb 2023 08:37:14 -0600 Subject: [PATCH 14/14] put dependabot filter back in --- .github/workflows/dependabot-sync.yml | 14 ++++++-------- scripts/sync-dependencies.mjs | 2 +- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 349a63a908a..5bd33c9397b 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -1,20 +1,17 @@ name: Sync Dependabot Bump on: pull_request: - types: [opened, reopened, edited] -permissions: - pull-requests: write + types: [opened, synchronize] +permissions: + contents: write jobs: sync: + if: ${{ github.actor == 'dependabot[bot]' }} name: Sync dependency files runs-on: ubuntu-latest - strategy: - matrix: - node-version: [16.x] - steps: - name: Checkout Repository uses: actions/checkout@v3 @@ -28,8 +25,9 @@ jobs: run: node ./scripts/sync-dependencies.mjs ${{ github.head_ref }} - name: Commit Changes run: | + git add . git status git config user.name github-actions git config user.email github-actions@github.com - git commit -am "[dependabot skip] bumped ${{ github.head_ref }} changes in config/dependencies.yaml" + git commit -m "[dependabot skip] bumped ${{ github.head_ref }} changes in config/dependencies.yaml" git push diff --git a/scripts/sync-dependencies.mjs b/scripts/sync-dependencies.mjs index 358bcbf9fe3..38b06d12838 100644 --- a/scripts/sync-dependencies.mjs +++ b/scripts/sync-dependencies.mjs @@ -26,7 +26,7 @@ const dependency = branchName // because this is from dependabot, // and because we want all our versions synced // we simply find and replace the version wherever it is specified -const rgx = new RegExp(`(?<='${dependency}':\\W{0,2}\\w*\\W?')\\d+\\.\\d+\\.\\d+(?=')`, 'g') +const rgx = new RegExp(`(?<='@?${dependency}':\\W{0,2}\\w*\\W?')\\d+\\.\\d+\\.\\d+(?=')`, 'g') const newDepsRaw = oldDepsRaw.replace(rgx, dependencyVersion) console.log(`Updating ${dependency} version to ${dependencyVersion} in config/dependencies.yaml`)