mirror of
https://github.com/openobserve/openobserve.git
synced 2026-11-06 00:09:22 +00:00
Bhargav
3fb35f2dc1
Restrict npm-check-updates to in-major upgrades (--target minor --peer). Unrestricted major bumps pushed typescript from 5.9.x to 7.0.x, which drops the ./lib/tsc export that vue-tsc still resolves, failing the type check with ERR_PACKAGE_PATH_NOT_EXPORTED. Majors held back are now listed in the PR body so they stay visible for a deliberate manual upgrade. Rename the branch to chore/npm-update-<date> and the PR title to chore(deps): update web npm dependencies, matching the repo convention used by update-translations.yml instead of the automated/ prefix. Also fix along the way: - npm ci before checking for updates, so reported current versions are real - gate has_updates on ncu output instead of npm outdated, so the job no longer runs a full build cycle only to find nothing to commit - write scratch files to RUNNER_TEMP so an untracked outdated.json cannot make the commit step think dependencies changed - scope the change check to web/package.json and web/package-lock.json - split the commit message into separate -m flags to drop YAML indentation
197 lines
7.6 KiB
YAML
197 lines
7.6 KiB
YAML
name: Weekly NPM Update
|
|
|
|
on:
|
|
schedule:
|
|
# Run every Monday at 9:00 AM UTC
|
|
- cron: '0 9 * * 1'
|
|
workflow_dispatch: # Allow manual trigger
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
update-dependencies:
|
|
name: Update NPM Dependencies
|
|
# This job only bumps the manifest and opens the PR. Type check, unit tests
|
|
# and build all run as normal PR checks on the resulting pull request, so
|
|
# nothing here needs to install node_modules or compile anything.
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Clone the current repo
|
|
uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
# A PAT, not GITHUB_TOKEN. Pushes made with GITHUB_TOKEN do not start
|
|
# workflow runs, so the resulting PR would sit there with zero checks —
|
|
# and the whole point of this job is to hand verification to PR CI.
|
|
token: ${{ secrets.ORG_ADMIN_TOKEN }}
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Configure Git
|
|
run: |
|
|
# Commit as one of the user rather than the bot, so the commit and the PR share
|
|
# one author and the PR shows up under his own filters.
|
|
|
|
- name: Create update branch
|
|
run: |
|
|
BRANCH_NAME="chore/npm-update-$(date +%Y%m%d)"
|
|
git checkout -b "$BRANCH_NAME"
|
|
echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
|
|
|
|
- name: Check for available updates
|
|
id: check_updates
|
|
run: |
|
|
cd web
|
|
|
|
# Snapshot the pre-update manifest so the PR body can show old → new.
|
|
cp package.json "$RUNNER_TEMP/package.json.before"
|
|
|
|
npx --yes npm-check-updates --target latest --peer --jsonUpgraded \
|
|
> "$RUNNER_TEMP/upgrades.json"
|
|
|
|
if ! jq -e 'type == "object"' "$RUNNER_TEMP/upgrades.json" > /dev/null; then
|
|
echo "npm-check-updates did not return valid JSON:"
|
|
cat "$RUNNER_TEMP/upgrades.json"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$(jq 'length' "$RUNNER_TEMP/upgrades.json")" -gt 0 ]; then
|
|
echo "has_updates=true" >> $GITHUB_OUTPUT
|
|
echo "Packages to upgrade:"
|
|
jq '.' "$RUNNER_TEMP/upgrades.json"
|
|
else
|
|
echo "has_updates=false" >> $GITHUB_OUTPUT
|
|
echo "No updates available"
|
|
fi
|
|
|
|
- name: Update dependencies
|
|
if: steps.check_updates.outputs.has_updates == 'true'
|
|
run: |
|
|
cd web
|
|
echo "Updating dependencies..."
|
|
|
|
# Apply the same upgrades that were just reported.
|
|
npx --yes npm-check-updates -u --target latest --peer
|
|
|
|
# Regenerate package-lock.json only — node_modules is never needed
|
|
# here, and skipping the install keeps this job to well under a minute.
|
|
npm install --package-lock-only
|
|
|
|
echo "Dependencies updated successfully"
|
|
|
|
- name: Generate update summary
|
|
if: steps.check_updates.outputs.has_updates == 'true'
|
|
id: summary
|
|
run: |
|
|
# Map of package -> previous range, from the pre-update manifest.
|
|
BEFORE=$(jq -c '(.dependencies // {}) + (.devDependencies // {})' \
|
|
"$RUNNER_TEMP/package.json.before")
|
|
|
|
UPDATED_PACKAGES=$(jq -r --argjson before "$BEFORE" \
|
|
'to_entries[] | "- **\(.key)**: \($before[.key] // "n/a") → \(.value)"' \
|
|
"$RUNNER_TEMP/upgrades.json")
|
|
|
|
cat > "$RUNNER_TEMP/pr_body.md" <<EOF
|
|
## 📦 Weekly NPM Dependencies Update
|
|
|
|
This automated PR updates \`web/\` npm packages to their latest versions
|
|
and regenerates \`package-lock.json\`.
|
|
|
|
### Updated Packages
|
|
|
|
$UPDATED_PACKAGES
|
|
|
|
### Validation
|
|
|
|
This workflow does **not** run any checks — type check, unit tests and
|
|
build all run as normal PR checks below. Review the results there before
|
|
merging; a red check usually means one of the upgrades above needs to be
|
|
pinned back or accompanied by a code change.
|
|
|
|
---
|
|
|
|
🤖 This PR was automatically created by the Weekly NPM Update workflow
|
|
EOF
|
|
|
|
echo "summary_created=true" >> $GITHUB_OUTPUT
|
|
|
|
- name: Commit changes
|
|
if: steps.check_updates.outputs.has_updates == 'true'
|
|
run: |
|
|
# Scope the check to the manifest files so stray artifacts never
|
|
# trigger an empty dependency PR.
|
|
if git diff --quiet -- web/package.json web/package-lock.json; then
|
|
echo "No dependency changes to commit"
|
|
echo "changes_committed=false" >> $GITHUB_ENV
|
|
else
|
|
git add web/package.json web/package-lock.json
|
|
git commit \
|
|
-m "chore(deps): update web npm dependencies ($(date +%Y-%m-%d))" \
|
|
-m "- Updated packages to their latest versions" \
|
|
-m "- Regenerated package-lock.json" \
|
|
-m "🤖 Automated update by GitHub Actions"
|
|
|
|
# The branch name is date-stamped, so a second run on the same day
|
|
# (a re-run, or a manual dispatch after the scheduled one) finds the
|
|
# earlier run's branch already on the remote. This branch is entirely
|
|
# machine-owned and rebuilt from main every run, so replacing it is
|
|
# correct — a plain push would just fail non-fast-forward.
|
|
if git ls-remote --exit-code --heads origin "$BRANCH_NAME" > /dev/null 2>&1; then
|
|
echo "Branch $BRANCH_NAME already exists on the remote — replacing it"
|
|
git fetch origin "+refs/heads/$BRANCH_NAME:refs/remotes/origin/$BRANCH_NAME"
|
|
git push --force-with-lease origin "$BRANCH_NAME"
|
|
else
|
|
git push origin "$BRANCH_NAME"
|
|
fi
|
|
|
|
echo "changes_committed=true" >> $GITHUB_ENV
|
|
fi
|
|
|
|
- name: Create Pull Request
|
|
if: steps.check_updates.outputs.has_updates == 'true' && env.changes_committed == 'true'
|
|
env:
|
|
# Same PAT as the checkout — the PR author is whoever owns this token.
|
|
GH_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}
|
|
run: |
|
|
TITLE="chore(deps): update web npm dependencies ($(date +%Y-%m-%d))"
|
|
|
|
# If an earlier run today already opened a PR for this branch, the
|
|
# force-push above updated it in place — `gh pr create` would fail with
|
|
# "a pull request for branch ... already exists". Refresh it instead.
|
|
PR_URL=$(gh pr list --head "$BRANCH_NAME" --state open \
|
|
--json url --jq '.[0].url // empty')
|
|
|
|
if [ -n "$PR_URL" ]; then
|
|
gh pr edit "$PR_URL" \
|
|
--title "$TITLE" \
|
|
--body-file "$RUNNER_TEMP/pr_body.md"
|
|
echo "Refreshed existing $PR_URL"
|
|
else
|
|
PR_URL=$(gh pr create \
|
|
--title "$TITLE" \
|
|
--body-file "$RUNNER_TEMP/pr_body.md" \
|
|
--base main \
|
|
--head "$BRANCH_NAME")
|
|
echo "Opened $PR_URL"
|
|
fi
|
|
|
|
# Labels and assignee are applied separately and best-effort. Passing
|
|
# them to `gh pr create` makes a single bad value abort the whole
|
|
# command, leaving the already-pushed branch behind with no PR at all.
|
|
gh pr edit "$PR_URL" \
|
|
--add-assignee "bjp232004" \
|
|
--add-label "dependencies" \
|
|
--add-label "auto-generated" \
|
|
|| echo "::warning::Could not apply assignee/labels to $PR_URL"
|
|
|
|
- name: No updates needed
|
|
if: steps.check_updates.outputs.has_updates == 'false'
|
|
run: |
|
|
echo "✅ All npm packages are up to date. No PR needed."
|