sibling-released #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sibling dependency instant update | |
| # Triggered the moment a sibling ExaDev package this repo depends on publishes a new version -- the publishing repo own ci.yml sends this repository_dispatch event right after semantic-release completes, instead of waiting for Dependabot own daily scheduled scan to notice. Bumps the named dependency, opens a PR, and requests auto-merge -- the branch push and PR creation use the default GITHUB_TOKEN (an ordinary same-repo operation), but the final merge step mints and uses a GitHub App installation token instead, since GITHUB_TOKEN-authenticated pushes do not cascade into further workflow runs and that merge needs to trigger ci.yml and release normally. This workflow never pushes directly to main -- the PR still only merges once this repo own CI genuinely passes on it. Note: every repo in this family also enforces a minimumReleaseAge pnpm supply-chain gate (see pnpm-workspace.yaml) that CI own pnpm install --frozen-lockfile step respects unconditionally, with no per-package exceptions -- so a same-day sibling release still cannot actually pass CI (and therefore cannot merge) until that gate window has elapsed, regardless of how quickly this workflow opens the PR. | |
| on: | |
| repository_dispatch: | |
| types: [sibling-released] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| bump-and-open-pr: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: pnpm | |
| - name: Bump the released dependency | |
| env: | |
| PACKAGE: ${{ github.event.client_payload.package }} | |
| VERSION: ${{ github.event.client_payload.version }} | |
| run: pnpm add "$PACKAGE@$VERSION" | |
| - name: Check whether anything actually changed | |
| id: diff | |
| run: | | |
| if git diff --quiet -- package.json pnpm-lock.yaml; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Commit and open a PR | |
| if: steps.diff.outputs.changed == 'true' | |
| id: pr | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PACKAGE: ${{ github.event.client_payload.package }} | |
| VERSION: ${{ github.event.client_payload.version }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| branch="sibling-update/${PACKAGE}-${VERSION}" | |
| git checkout -b "$branch" | |
| git add package.json pnpm-lock.yaml | |
| git commit -m "build(deps): bump ${PACKAGE} to ${VERSION}" -m "Triggered instantly by the ${PACKAGE} release, via repository_dispatch, rather than waiting for the next daily Dependabot scan." | |
| git push origin "$branch" | |
| pr_url=$(gh pr create --title "build(deps): bump ${PACKAGE} to ${VERSION}" --body "Automatic dependency bump triggered instantly by the ${PACKAGE} release." --base main --head "$branch") | |
| echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT" | |
| - name: Generate a token for the merge | |
| if: steps.diff.outputs.changed == 'true' | |
| id: app-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: "4473709" | |
| private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }} | |
| - name: Enable auto-merge | |
| if: steps.diff.outputs.changed == 'true' | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: gh pr merge --auto --rebase "${{ steps.pr.outputs.pr_url }}" |