|
| 1 | +name: Dependabot |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + branches: [ dependabot/npm_and_yarn/** ] |
| 6 | + |
| 7 | +jobs: |
| 8 | + build: |
| 9 | + runs-on: ubuntu-latest |
| 10 | + if: github.actor == 'dependabot[bot]' |
| 11 | + |
| 12 | + steps: |
| 13 | + - uses: actions/checkout@v2 |
| 14 | + with: |
| 15 | + fetch-depth: 2 |
| 16 | + persist-credentials: false # minimize exposure |
| 17 | + - name: Use Node.js 12.x |
| 18 | + uses: actions/setup-node@v1 |
| 19 | + with: |
| 20 | + node-version: '12' |
| 21 | + - name: Autofix lockfile |
| 22 | + run: | |
| 23 | + # change directory |
| 24 | + cd .`git log -1 --pretty=%s | awk '{ print $9 }'` |
| 25 | +
|
| 26 | + # restore yarn.lock from the previous commit |
| 27 | + git checkout HEAD^ -- yarn.lock |
| 28 | +
|
| 29 | + # install yarn-plugin-deduplicate |
| 30 | + yarn plugin import https://raw.githubusercontent.com/eps1lon/yarn-plugin-deduplicate/latest/bin/%40yarnpkg/plugin-deduplicate.js |
| 31 | +
|
| 32 | + # if package.json was not updated, upgrade the dependency |
| 33 | + git diff --name-only HEAD^ HEAD | grep -q 'package.json' || yarn up `git log -1 --pretty=%s | awk '{ print $3 }'` |
| 34 | +
|
| 35 | + # restore package.json from the last commit |
| 36 | + git checkout HEAD -- package.json |
| 37 | +
|
| 38 | + yarn install # disable post-install scripts |
| 39 | +
|
| 40 | + # deduplicate lockfile |
| 41 | + yarn deduplicate |
| 42 | + env: |
| 43 | + YARN_ENABLE_SCRIPTS: 0 |
| 44 | + - name: Config Git |
| 45 | + run: | |
| 46 | + # use personal access token to allow triggering new workflow |
| 47 | + BASIC_AUTH=$(echo -n "x-access-token:${{ secrets.GH_TOKEN }}" | base64) |
| 48 | + echo "::add-mask::$BASIC_AUTH" |
| 49 | + git config --global user.name '${{ github.event.commits[0].author.name }}' |
| 50 | + git config --global user.email '${{ github.event.commits[0].author.email }}' |
| 51 | + git config --local http.$GITHUB_SERVER_URL/.extraheader "AUTHORIZATION: basic $BASIC_AUTH" |
| 52 | + - name: Commit changes |
| 53 | + run: | |
| 54 | + cd .`git log -1 --pretty=%s | awk '{ print $9 }'` |
| 55 | + git add yarn.lock .yarn/cache .pnp.* |
| 56 | + git commit -m "Dependabot autofix" |
| 57 | + git push |
0 commit comments