Zoltan KochanandClaude Fable 5
078d4be193
Bump pnpm/update to the release that adds the update-pnpm-minimum-release-age input, and set it to 0. pnpm 12 defaults minimumReleaseAge to 24 hours and self-update deliberately ignores the repo's minimumReleaseAgeExclude, so the job could never bump the pin to a pnpm release published the same day: the next-12 dist-tag silently resolved to the newest mature version instead. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
72 lines
3.0 KiB
YAML
72 lines
3.0 KiB
YAML
name: Update Lockfile
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 6 * * *' # Daily at 6 AM UTC
|
|
workflow_dispatch: {} # Allow manual triggering
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
# Serialize runs so a manual dispatch and the daily schedule can't reset and
|
|
# force-push the chore/update-lockfile branch at the same time.
|
|
concurrency:
|
|
group: update-lockfile
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
update-lockfile:
|
|
if: github.repository == 'pnpm/pnpm' # Only run on the main repository, not forks
|
|
runs-on: blacksmith-4vcpu-ubuntu-2404
|
|
timeout-minutes: 30
|
|
env:
|
|
# The husky hooks are a developer safety net; CI has its own gates. Without
|
|
# this, the full install wires the hooks and the pre-push hook runs the TS
|
|
# compile/lint (and, when the remote branch doesn't exist yet, the Rust
|
|
# clippy/doc sweep) during the action's push.
|
|
HUSKY: 0
|
|
steps:
|
|
- name: Checkout Commit
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
# Don't persist the write-scoped token in .git/config. The full install
|
|
# below runs third-party lifecycle scripts from freshly-bumped
|
|
# dependencies; the token is only needed to push, which pnpm/update does
|
|
# through a single-use credential helper.
|
|
persist-credentials: false
|
|
|
|
# pnpm/update runs the install itself, so the action's auto-install would
|
|
# be wasted work.
|
|
- name: Install pnpm
|
|
uses: pnpm/setup@6523ce966bcf7a1061ce6401e5c6e0b60466bd31
|
|
with:
|
|
install: false
|
|
|
|
- name: Update dependencies, Node.js, pnpm, and GitHub Actions
|
|
uses: pnpm/update@9a256174a439f3447aa0a6b9ca3c971428b1d617 #v0.0.0 v0
|
|
with:
|
|
update-deps: latest
|
|
refresh-lockfile: true
|
|
github-actions: true
|
|
update-pnpm: next-12
|
|
# Follow next-12 as soon as a release is published: pnpm 12's default
|
|
# 24-hour minimumReleaseAge would otherwise hold a same-day release
|
|
# back from self-update (the repo's minimumReleaseAgeExclude is
|
|
# deliberately ignored there).
|
|
update-pnpm-minimum-release-age: 0
|
|
post-update: pnpm update-manifests
|
|
branch: chore/update-lockfile
|
|
token: ${{ secrets.UPDATE_LOCKFILE_TOKEN }}
|
|
commit-message: 'chore: update dependencies, Node.js, pnpm, and GitHub Actions'
|
|
pr-title: 'chore: update dependencies, Node.js, pnpm, and GitHub Actions'
|
|
pr-body: |
|
|
This automated PR bumps the project's dependencies and pinned versions:
|
|
|
|
- Updates all dependencies to their latest versions and refreshes the lockfile.
|
|
- Bumps Node.js to the latest 26.x release, propagated into the CI, release, and benchmark workflows via the meta-updater.
|
|
- Bumps pnpm to the latest `next-12` release (`packageManager` and `devEngines.packageManager`).
|
|
- Updates the GitHub Actions pinned in the workflow files.
|
|
|
|
Created by the [pnpm/update](https://github.com/pnpm/update) action.
|