Skip to content

ci: dependabot fixes, lockfile linting #20344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
GirlBossRush wants to merge 13 commits into
base: main
Choose a base branch
from
Open

ci: dependabot fixes, lockfile linting #20344

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
390c73e
Revert "root: do not rely on npm cli for version bump (#20276)"
GirlBossRush Feb 16, 2026
f0759cd
Flesh out lockfile linting script.
GirlBossRush Feb 17, 2026
78b714b
Flesh out.
GirlBossRush Feb 17, 2026
f22cc47
Flesh out dependabot action.
GirlBossRush Feb 17, 2026
adedec8
Revise.
GirlBossRush Feb 17, 2026
112b5ed
Bump package.json
GirlBossRush Feb 17, 2026
4a41e65
Clarify logs.
GirlBossRush Feb 17, 2026
a946b93
Add dev engines.
GirlBossRush Feb 17, 2026
4778113
Log NPM version.
GirlBossRush Feb 17, 2026
49ed3fe
Install latest NPM
GirlBossRush Feb 17, 2026
5acb401
Fix newlines.
GirlBossRush Feb 17, 2026
51ea88b
Apply suggestions from code review
GirlBossRush Feb 17, 2026
204db0c
Remove comments.
GirlBossRush Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions .github/workflows/ci-web.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ on:
- main
- version-*

env:
NPM_VERSION: "11.10.0"
Comment on lines +15 to +16
Copy link
Member

@rissson rissson Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How do we plan on automating upgrading this when a new version is released?


jobs:
lint:
runs-on: ubuntu-latest
Expand All @@ -37,9 +40,10 @@ jobs:
node-version-file: ${{ matrix.project }}/package.json
cache: "npm"
cache-dependency-path: ${{ matrix.project }}/package-lock.json
- name: Install NPM
run: npm install -g npm@${{ env.NPM_VERSION }}
Comment on lines +43 to +44
Copy link
Member

@rissson rissson Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are plenty of places where we rely on npm packages being installed, not only in ci-web.yml. How do we plan on handling those?

- working-directory: ${{ matrix.project }}/
run: |
npm ci
run: npm ci
- name: Generate API
run: make gen-client-ts
- name: Lint
Expand All @@ -54,13 +58,16 @@ jobs:
node-version-file: web/package.json
cache: "npm"
cache-dependency-path: web/package-lock.json
- name: Install npm
run: npm install -g npm@${{ env.NPM_VERSION }}
- working-directory: web/
run: npm ci
- name: Generate API
run: make gen-client-ts
- name: build
working-directory: web/
run: npm run build

Copy link
Member

@rissson rissson Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

ci-web-mark:
if: always()
needs:
Expand All @@ -71,6 +78,7 @@ jobs:
- uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # release/v1
with:
jobs: ${{ toJSON(needs) }}

Copy link
Member

@rissson rissson Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

test:
needs:
- ci-web-mark
Expand All @@ -82,6 +90,8 @@ jobs:
node-version-file: web/package.json
cache: "npm"
cache-dependency-path: web/package-lock.json
- name: Install NPM
run: npm install -g npm@${{ env.NPM_VERSION }}
- working-directory: web/
run: npm ci
- name: Generate API
Expand Down
72 changes: 72 additions & 0 deletions .github/workflows/dependabot-lockfile-reconciliation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
---
name: Dependabot - Lockfile Reconciliation

on:
pull_request:
branches:
- main
- version-*

permissions:
contents: write

env:
NPM_VERSION: "11.10.0"

jobs:
fix-lockfile:
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- id: app-token
name: Generate app token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- id: get-user-id
name: Get GitHub app user ID
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
env:
GH_TOKEN: "${{ steps.app-token.outputs.token }}"

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
with:
ref: ${{ github.event.pull_request.head.ref }}
fetch-depth: 0
token: "${{ steps.app-token.outputs.token }}"
- name: Detect changed lockfiles
id: detect
run: |
changed=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD)

npm_matches=$(echo "$changed" | grep -E 'package(-lock)?\.json$' || true)
npm_dirs=$(echo "$npm_matches" | xargs -I{} dirname {} | sort -u)

echo "npm_dirs=$(echo "$npm_dirs" | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
Comment on lines +39 to +47
Copy link
Member

@rissson rissson Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can use tj-actions/changed-files like in packages-npm-publish.yml


- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v5
if: steps.detect.outputs.npm_dirs != ''
with:
node-version-file: package.json

- name: Install NPM
if: steps.detect.outputs.npm_dirs != ''
run: npm install -g npm@${{ env.NPM_VERSION }}

- name: Fix npm lockfiles
if: steps.detect.outputs.npm_dirs != ''
run: |
for dir in ${{ steps.detect.outputs.npm_dirs }}; do
echo "::group::npm - $dir"
node scripts/lint-lockfile.mjs --warn "$dir/" || true
echo "::endgroup::"
done
- name: Commit fixes
run: |
git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
git add -A
git diff --staged --quiet || git commit -m "fix: regenerate lockfiles [dependabot skip]"
git push
8 changes: 4 additions & 4 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,11 +148,11 @@ bump: ## Bump authentik version. Usage: make bump version=20xx.xx.xx
ifndef version
$(error Usage: make bump version=20xx.xx.xx )
endif
$(eval current_version := $(shell cat ${PWD}/internal/constants/VERSION))
$(SED_INPLACE) 's/^version = ".*"/version = "$(version)"/' ${PWD}/pyproject.toml
$(SED_INPLACE) 's/^VERSION = ".*"/VERSION = "$(version)"/' ${PWD}/authentik/__init__.py
$(SED_INPLACE) 's/^version = ".*"/version = "$(version)"/' pyproject.toml
$(SED_INPLACE) 's/^VERSION = ".*"/VERSION = "$(version)"/' authentik/__init__.py
$(MAKE) gen-build gen-compose aws-cfn
$(SED_INPLACE) "s/\"${current_version}\"/\"$(version)\"/" ${PWD}/package.json ${PWD}/package-lock.json ${PWD}/web/package.json ${PWD}/web/package-lock.json
npm version --no-git-tag-version --allow-same-version $(version)
cd ${PWD}/web && npm version --no-git-tag-version --allow-same-version $(version)
Comment on lines +151 to +155
Copy link
Member

@rissson rissson Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't change this.

Copy link
Contributor Author

@GirlBossRush GirlBossRush Feb 17, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Replacing the version string without npm version can break workspace packages which reference their parent or siblings.

echo -n $(version) > ${PWD}/internal/constants/VERSION

#########################
Expand Down
Loading
Loading