Repository navigation
Conversation
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR introduces a comprehensive automated dependency management system for the GitHub Actions Runner, including workflows for Node.js, NPM, .NET SDK, and Docker/Buildx version updates, along with a dependency status checking workflow and accompanying documentation.
Key changes include:
- Addition of 6 new GitHub Actions workflows for automated dependency management
- Creation of comprehensive dependency management documentation
- Minor adjustment to Node.js versions in externals.sh
Reviewed Changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Misc/externals.sh | Updates Node.js version numbers (downgrade for compatibility) |
| docs/dependency-management.md | New comprehensive documentation for dependency management process |
| .github/workflows/setup-labels.yml | Workflow to create necessary labels for dependency management |
| .github/workflows/npm-upgrade.yml | Automated NPM audit fix workflow |
| .github/workflows/npm-audit-ts-fix.yml | Enhanced NPM audit workflow with TypeScript auto-repair |
| .github/workflows/node-upgrade.yml | Automated Node.js version update workflow |
| .github/workflows/dotnet-upgrade.yml | Updates to existing .NET SDK upgrade workflow |
| .github/workflows/docker-buildx-upgrade.yml | Updates to existing Docker/Buildx upgrade workflow |
| .github/workflows/dependency-check.yml | New comprehensive dependency status check workflow |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+22
to
+196
| runs-on: ubuntu-latest | ||
| outputs: | ||
| node20-status: ${{ steps.check-versions.outputs.node20-status }} | ||
| node24-status: ${{ steps.check-versions.outputs.node24-status }} | ||
| dotnet-status: ${{ steps.check-versions.outputs.dotnet-status }} | ||
| docker-status: ${{ steps.check-versions.outputs.docker-status }} | ||
| buildx-status: ${{ steps.check-versions.outputs.buildx-status }} | ||
| npm-vulnerabilities: ${{ steps.check-versions.outputs.npm-vulnerabilities }} | ||
| open-dependency-prs: ${{ steps.check-prs.outputs.open-dependency-prs }} | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20" | ||
|
|
||
| - name: Check dependency versions | ||
| id: check-versions | ||
| run: | | ||
| echo "## Dependency Status Report" >> $GITHUB_STEP_SUMMARY | ||
| echo "Generated on: $(date)" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| # Check Node versions | ||
| if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "node" ]]; then | ||
| echo "### Node.js Versions" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| VERSIONS_JSON=$(curl -s https://raw.githubusercontent.com/actions/node-versions/main/versions-manifest.json) | ||
| LATEST_NODE20=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("20.")) | .version' | head -1) | ||
| LATEST_NODE24=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("24.")) | .version' | head -1) | ||
|
|
||
| CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2) | ||
| CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2) | ||
|
|
||
| NODE20_STATUS="✅ up-to-date" | ||
| NODE24_STATUS="✅ up-to-date" | ||
|
|
||
| if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then | ||
| NODE20_STATUS="⚠️ outdated" | ||
| fi | ||
|
|
||
| if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then | ||
| NODE24_STATUS="⚠️ outdated" | ||
| fi | ||
|
|
||
| echo "| Version | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY | ||
| echo "|---------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Node 20 | $CURRENT_NODE20 | $LATEST_NODE20 | $NODE20_STATUS |" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Node 24 | $CURRENT_NODE24 | $LATEST_NODE24 | $NODE24_STATUS |" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| echo "node20-status=$NODE20_STATUS" >> $GITHUB_OUTPUT | ||
| echo "node24-status=$NODE24_STATUS" >> $GITHUB_OUTPUT | ||
| fi | ||
|
|
||
| # Check .NET version | ||
| if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "dotnet" ]]; then | ||
| echo "### .NET SDK Version" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| current_dotnet_version=$(jq -r .sdk.version ./src/global.json) | ||
| current_major_minor=$(echo "$current_dotnet_version" | cut -d '.' -f 1,2) | ||
| latest_dotnet_version=$(curl -sb -H "Accept: application/json" "https://dotnetcli.blob.core.windows.net/dotnet/Sdk/$current_major_minor/latest.version") | ||
|
|
||
| DOTNET_STATUS="✅ up-to-date" | ||
| if [ "$current_dotnet_version" != "$latest_dotnet_version" ]; then | ||
| DOTNET_STATUS="⚠️ outdated" | ||
| fi | ||
|
|
||
| echo "| Component | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY | ||
| echo "|-----------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY | ||
| echo "| .NET SDK | $current_dotnet_version | $latest_dotnet_version | $DOTNET_STATUS |" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| echo "dotnet-status=$DOTNET_STATUS" >> $GITHUB_OUTPUT | ||
| fi | ||
|
|
||
| # Check Docker versions | ||
| if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "docker" ]]; then | ||
| echo "### Docker Versions" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| current_docker=$(grep "ARG DOCKER_VERSION=" ./images/Dockerfile | cut -d'=' -f2) | ||
| current_buildx=$(grep "ARG BUILDX_VERSION=" ./images/Dockerfile | cut -d'=' -f2) | ||
|
|
||
| latest_docker=$(curl -s https://download.docker.com/linux/static/stable/x86_64/ | grep -o 'docker-[0-9]*\.[0-9]*\.[0-9]*\.tgz' | sort -V | tail -n 1 | sed 's/docker-\(.*\)\.tgz/\1/') | ||
| latest_buildx=$(curl -s https://api.github.com/repos/docker/buildx/releases/latest | jq -r '.tag_name' | sed 's/^v//') | ||
|
|
||
| DOCKER_STATUS="✅ up-to-date" | ||
| BUILDX_STATUS="✅ up-to-date" | ||
|
|
||
| if [ "$current_docker" != "$latest_docker" ]; then | ||
| DOCKER_STATUS="⚠️ outdated" | ||
| fi | ||
|
|
||
| if [ "$current_buildx" != "$latest_buildx" ]; then | ||
| BUILDX_STATUS="⚠️ outdated" | ||
| fi | ||
|
|
||
| echo "| Component | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY | ||
| echo "|-----------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Docker | $current_docker | $latest_docker | $DOCKER_STATUS |" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Docker Buildx | $current_buildx | $latest_buildx | $BUILDX_STATUS |" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| echo "docker-status=$DOCKER_STATUS" >> $GITHUB_OUTPUT | ||
| echo "buildx-status=$BUILDX_STATUS" >> $GITHUB_OUTPUT | ||
| fi | ||
|
|
||
| # Check npm vulnerabilities | ||
| if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "npm" ]]; then | ||
| echo "### NPM Security Audit" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| cd src/Misc/expressionFunc/hashFiles | ||
| npm install --silent | ||
| AUDIT_OUTPUT=$(npm audit --json 2>/dev/null || echo '{"metadata":{"vulnerabilities":{"total":0}}}') | ||
| VULN_COUNT=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.total // 0') | ||
|
|
||
| # Ensure VULN_COUNT is a number | ||
| VULN_COUNT=$(echo "$VULN_COUNT" | grep -o '[0-9]*' | head -1) | ||
| VULN_COUNT=${VULN_COUNT:-0} | ||
|
|
||
| NPM_STATUS="✅ no vulnerabilities" | ||
| if [ "$VULN_COUNT" -gt 0 ] 2>/dev/null; then | ||
| NPM_STATUS="⚠️ $VULN_COUNT vulnerabilities found" | ||
|
|
||
| # Get vulnerability details | ||
| HIGH_VULNS=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.high // 0') | ||
| CRITICAL_VULNS=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.critical // 0') | ||
|
|
||
| echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY | ||
| echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Critical | $CRITICAL_VULNS |" >> $GITHUB_STEP_SUMMARY | ||
| echo "| High | $HIGH_VULNS |" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| else | ||
| echo "No npm vulnerabilities found ✅" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| fi | ||
|
|
||
| echo "npm-vulnerabilities=$NPM_STATUS" >> $GITHUB_OUTPUT | ||
| fi | ||
|
|
||
| - name: Check for open dependency PRs | ||
| id: check-prs | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| echo "### Open Dependency PRs" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| # Get open PRs with dependency label | ||
| OPEN_PRS=$(gh pr list --label "dependency" --state open --json number,title,url) | ||
| PR_COUNT=$(echo "$OPEN_PRS" | jq '. | length') | ||
|
|
||
| if [ "$PR_COUNT" -gt 0 ]; then | ||
| echo "Found $PR_COUNT open dependency PR(s):" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "$OPEN_PRS" | jq -r '.[] | "- [#\(.number)](\(.url)) \(.title)"' >> $GITHUB_STEP_SUMMARY | ||
| else | ||
| echo "No open dependency PRs found ✅" >> $GITHUB_STEP_SUMMARY | ||
| fi | ||
|
|
||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "open-dependency-prs=$PR_COUNT" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Summary | ||
| run: | | ||
| echo "### Summary" >> $GITHUB_STEP_SUMMARY | ||
| echo "- Check for open PRs with the \`dependency\` label before releases" >> $GITHUB_STEP_SUMMARY | ||
| echo "- Review and merge dependency updates regularly" >> $GITHUB_STEP_SUMMARY | ||
| echo "- Critical vulnerabilities should be addressed immediately" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "**Automated workflows run weekly to check for updates:**" >> $GITHUB_STEP_SUMMARY | ||
| echo "- Node.js versions (Mondays at 6 AM)" >> $GITHUB_STEP_SUMMARY | ||
| echo "- NPM audit fix (Mondays at 7 AM)" >> $GITHUB_STEP_SUMMARY | ||
| echo "- .NET SDK updates (Mondays at midnight)" >> $GITHUB_STEP_SUMMARY | ||
| echo "- Docker/Buildx updates (Mondays at midnight)" >> $GITHUB_STEP_SUMMARY |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
Comment on lines
+10
to
+92
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - name: Get latest Node versions | ||
| id: node-versions | ||
| run: | | ||
| # Get latest versions from the versions manifest | ||
| VERSIONS_JSON=$(curl -s https://raw.githubusercontent.com/actions/node-versions/main/versions-manifest.json) | ||
|
|
||
| # Get latest v20 and v24 versions | ||
| LATEST_NODE20=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("20.")) | .version' | head -1) | ||
| LATEST_NODE24=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("24.")) | .version' | head -1) | ||
|
|
||
| echo "latest_node20=$LATEST_NODE20" >> $GITHUB_OUTPUT | ||
| echo "latest_node24=$LATEST_NODE24" >> $GITHUB_OUTPUT | ||
|
|
||
| # Check current versions in externals.sh | ||
| CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2) | ||
| CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2) | ||
|
|
||
| echo "current_node20=$CURRENT_NODE20" >> $GITHUB_OUTPUT | ||
| echo "current_node24=$CURRENT_NODE24" >> $GITHUB_OUTPUT | ||
|
|
||
| # Determine if updates are needed | ||
| NEEDS_UPDATE20="false" | ||
| NEEDS_UPDATE24="false" | ||
|
|
||
| if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then | ||
| NEEDS_UPDATE20="true" | ||
| fi | ||
|
|
||
| if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then | ||
| NEEDS_UPDATE24="true" | ||
| fi | ||
|
|
||
| echo "needs_update20=$NEEDS_UPDATE20" >> $GITHUB_OUTPUT | ||
| echo "needs_update24=$NEEDS_UPDATE24" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Update externals.sh and create PR | ||
| if: steps.node-versions.outputs.needs_update20 == 'true' || steps.node-versions.outputs.needs_update24 == 'true' | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| # Update the files | ||
| if [ "${{ steps.node-versions.outputs.needs_update20 }}" == "true" ]; then | ||
| sed -i 's/NODE20_VERSION="[^"]*"/NODE20_VERSION="${{ steps.node-versions.outputs.latest_node20 }}"/' src/Misc/externals.sh | ||
| fi | ||
|
|
||
| if [ "${{ steps.node-versions.outputs.needs_update24 }}" == "true" ]; then | ||
| sed -i 's/NODE24_VERSION="[^"]*"/NODE24_VERSION="${{ steps.node-versions.outputs.latest_node24 }}"/' src/Misc/externals.sh | ||
| fi | ||
|
|
||
| # Configure git | ||
| git config --global user.name "github-actions[bot]" | ||
| git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>" | ||
|
|
||
| # Create branch and commit changes | ||
| branch_name="chore/update-node" | ||
| git checkout -b "$branch_name" | ||
| git commit -a -m "chore: update Node versions (20: ${{ steps.node-versions.outputs.latest_node20 }}, 24: ${{ steps.node-versions.outputs.latest_node24 }})" | ||
| git push --force origin "$branch_name" | ||
|
|
||
| # Create PR body using here-doc for proper formatting | ||
| cat > pr_body.txt << 'EOF' | ||
| Automated Node.js version update: | ||
|
|
||
| - Node 20: ${{ steps.node-versions.outputs.current_node20 }} → ${{ steps.node-versions.outputs.latest_node20 }} | ||
| - Node 24: ${{ steps.node-versions.outputs.current_node24 }} → ${{ steps.node-versions.outputs.latest_node24 }} | ||
|
|
||
| This update ensures we're using the latest stable Node.js versions for security and performance improvements. | ||
|
|
||
| **Note**: When updating Node versions, remember to also create a new release of alpine_nodejs at the updated version following the instructions at: https://github.com/actions/alpine_nodejs | ||
|
|
||
| --- | ||
|
|
||
| Autogenerated by [Node Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/node-upgrade.yml) | ||
| EOF | ||
|
|
||
| # Create PR | ||
| gh pr create -B main -H "$branch_name" \ | ||
| --title "chore: update Node versions" \ | ||
| --label "dependency" \ | ||
| --body-file pr_body.txt No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
Comment on lines
+10
to
+176
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20" | ||
| - name: NPM install and audit fix with TypeScript auto-repair | ||
| working-directory: src/Misc/expressionFunc/hashFiles | ||
| run: | | ||
| npm install | ||
| npm audit fix || true | ||
|
|
||
| # Try to fix TypeScript issues automatically | ||
| echo "Attempting to fix TypeScript compatibility issues..." | ||
|
|
||
| # Check if build fails | ||
| if ! npm run build 2>/dev/null; then | ||
| echo "Build failed, attempting automated fixes..." | ||
|
|
||
| # Common fix 1: Update @types/node to latest compatible version | ||
| echo "Trying to update @types/node to latest version..." | ||
| npm update @types/node || true | ||
|
|
||
| # Common fix 2: If that doesn't work, try installing a specific known-good version | ||
| if ! npm run build 2>/dev/null; then | ||
| echo "Trying specific @types/node version..." | ||
| # Try Node 20 compatible version | ||
| npm install --save-dev @types/node@^20.0.0 || true | ||
| fi | ||
|
|
||
| # Common fix 3: Clear node_modules and reinstall if still failing | ||
| if ! npm run build 2>/dev/null; then | ||
| echo "Clearing node_modules and reinstalling..." | ||
| rm -rf node_modules package-lock.json | ||
| npm install | ||
| npm audit fix || true | ||
| fi | ||
|
|
||
| # Common fix 4: Try updating TypeScript itself | ||
| if ! npm run build 2>/dev/null; then | ||
| echo "Trying to update TypeScript..." | ||
| npm update typescript || true | ||
| fi | ||
|
|
||
| # Final check | ||
| if npm run build 2>/dev/null; then | ||
| echo "✅ Successfully fixed TypeScript issues automatically" | ||
| else | ||
| echo "⚠️ Could not automatically fix TypeScript issues" | ||
| fi | ||
| else | ||
| echo "✅ Build passes after audit fix" | ||
| fi | ||
|
|
||
| - name: Create PR if changes exist | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| HUSKY: 0 # Disable husky hooks for automated commits | ||
| run: | | ||
| # Check if there are any changes | ||
| if [ -n "$(git status --porcelain)" ]; then | ||
| # Configure git | ||
| git config --global user.name "github-actions[bot]" | ||
| git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>" | ||
|
|
||
| # Create branch and commit changes | ||
| branch_name="chore/npm-audit-fix-with-ts-repair" | ||
| git checkout -b "$branch_name" | ||
|
|
||
| # Commit with --no-verify to skip husky hooks | ||
| git commit -a -m "chore: npm audit fix with automated TypeScript compatibility fixes" --no-verify | ||
| git push --force origin "$branch_name" | ||
|
|
||
| # Check final build status and gather info about what was changed | ||
| build_status="✅ Build passes" | ||
| fixes_applied="" | ||
| cd src/Misc/expressionFunc/hashFiles | ||
|
|
||
| # Check what packages were updated | ||
| if git diff HEAD~1 package.json | grep -q "@types/node"; then | ||
| fixes_applied+="\n- Updated @types/node version for TypeScript compatibility" | ||
| fi | ||
| if git diff HEAD~1 package.json | grep -q "typescript"; then | ||
| fixes_applied+="\n- Updated TypeScript version" | ||
| fi | ||
| if git diff HEAD~1 package-lock.json | grep -q "resolved"; then | ||
| fixes_applied+="\n- Updated package dependencies via npm audit fix" | ||
| fi | ||
|
|
||
| if ! npm run build 2>/dev/null; then | ||
| build_status="⚠️ Build fails - manual review required" | ||
| fi | ||
| cd - > /dev/null | ||
|
|
||
| # Create enhanced PR body using here-doc for proper formatting | ||
| if [[ "$build_status" == *"fails"* ]]; then | ||
| cat > pr_body.txt << 'EOF' | ||
| Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies. | ||
|
|
||
| **Build Status**: ⚠️ Build fails - manual review required | ||
|
|
||
| This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes. | ||
|
|
||
| ⚠️ **Manual Review Required**: The build is currently failing after automated fixes were attempted. | ||
|
|
||
| Common issues and solutions: | ||
| - Check for TypeScript version compatibility with Node.js types | ||
| - Review breaking changes in updated dependencies | ||
| - Consider pinning problematic dependency versions temporarily | ||
| - Review tsconfig.json for compatibility settings | ||
|
|
||
| **Automated Fix Strategy**: | ||
| 1. Run npm audit fix | ||
| 2. Update @types/node to latest compatible version | ||
| 3. Try Node 20 specific @types/node version if needed | ||
| 4. Clean reinstall dependencies if conflicts persist | ||
| 5. Update TypeScript compiler if necessary | ||
|
|
||
| --- | ||
|
|
||
| Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml) | ||
| EOF | ||
| else | ||
| cat > pr_body.txt << 'EOF' | ||
| Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies. | ||
|
|
||
| **Build Status**: ✅ Build passes | ||
|
|
||
| This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes. | ||
|
|
||
| ✅ **Ready to Merge**: All automated fixes were successful and the build passes. | ||
|
|
||
| **Automated Fix Strategy**: | ||
| 1. Run npm audit fix | ||
| 2. Update @types/node to latest compatible version | ||
| 3. Try Node 20 specific @types/node version if needed | ||
| 4. Clean reinstall dependencies if conflicts persist | ||
| 5. Update TypeScript compiler if necessary | ||
|
|
||
| --- | ||
|
|
||
| Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml) | ||
| EOF | ||
| fi | ||
|
|
||
| if [ -n "$fixes_applied" ]; then | ||
| # Add the fixes applied section to the file | ||
| sed -i "/This workflow attempts/a\\ | ||
| \\ | ||
| **Automated Fixes Applied**:$fixes_applied" pr_body.txt | ||
| fi | ||
|
|
||
| # Create PR with appropriate labels | ||
| labels="dependency,typescript" | ||
| if [[ "$build_status" == *"fails"* ]]; then | ||
| labels="dependency,typescript,needs-manual-review" | ||
| fi | ||
|
|
||
| # Create PR | ||
| gh pr create -B main -H "$branch_name" \ | ||
| --title "chore: npm audit fix with TypeScript auto-repair" \ | ||
| --label "$labels" \ | ||
| --body-file pr_body.txt | ||
| else | ||
| echo "No changes to commit" | ||
| fi |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
Comment on lines
+8
to
+32
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Create necessary labels | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| # Create dependency label | ||
| gh label create "dependency" \ | ||
| --description "Dependency updates and security fixes" \ | ||
| --color "0366d6" \ | ||
| --repo ${{ github.repository }} || echo "dependency label already exists" | ||
|
|
||
| # Create typescript label | ||
| gh label create "typescript" \ | ||
| --description "TypeScript related changes" \ | ||
| --color "3178C6" \ | ||
| --repo ${{ github.repository }} || echo "typescript label already exists" | ||
|
|
||
| # Create needs-manual-review label | ||
| gh label create "needs-manual-review" \ | ||
| --description "Requires manual review and intervention" \ | ||
| --color "D93F0B" \ | ||
| --repo ${{ github.repository }} || echo "needs-manual-review label already exists" | ||
|
|
||
| echo "✅ Labels created successfully" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add workflows for updating npm and node, also add a dependency review check to give a summary on all the vulnerabilities.
Example dependency summary
see: https://github.com/salmanmkc/runner/actions/runs/17564083794
Example updating node versions
Example updating npm packages