ci: auto-sync bun.lock on Dependabot PRs - #190
Merged
Merged
Conversation
Dependabot bumps package.json but not bun.lock, so Test's frozen install fails on every Dependabot PR and automerge never fires. Add a pull_request_target workflow (scoped to dependabot[bot], --ignore-scripts) that regenerates bun.lock and commits it back to the PR branch.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
3 tasks
arzafran
added a commit
that referenced
this pull request
Jun 4, 2026
Bring docs in line with main as it stands now (post-marketing-removal, post-useReveal) and apply the CSS-vs-JS animation philosophy consistently: - components/effects/README: rewrite — drop deleted split-text/animated-gradient/ liquid-drip; document only gsap.tsx + progress-text; point reveals at useReveal. - components/README, app/README: remove stale effect imports/rows + the (marketing) tree refs and cleanup command. - lib/hooks/README: add useReveal (row + example); fix useMediaQuery import (from hamo); replace the framer-motion reduced-motion example with a CSS one. - ARCHITECTURE: trim sections that duplicate AGENTS.md to pointers; add an Animation summary. lib/styles + lib/utils READMEs: note the global.css [data-reveal] contract and the spring()→CSS linear() steer. - CHANGELOG: [Unreleased] entries for #188 / #189 / #190. Supersedes the in-flight docs/* branches; README/PROD-README left untouched (website-facing OSS shape preserved).
Replaces the pull_request_target approach (which CodeQL flagged as a privileged checkout) with a normal pull_request workflow that pushes the regenerated bun.lock using a PAT. The PAT push retriggers Test, so automerge fires hands-off. No-ops gracefully until DEPENDABOT_PAT is set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Every Dependabot PR fails CI with
lockfile had changes, but lockfile is frozen— Dependabot bumpspackage.jsonbut never updatesbun.lock, and Test installs--frozen-lockfile. Since auto-merge gates on Test passing, no Dependabot PR can merge without a manual lockfile fix. This adds a workflow that regeneratesbun.lockon Dependabot PRs and commits it back, so the bump passes CI and lands the correct lockfile onmain.Approach (PAT, no
pull_request_target)pull_requestworkflow, scoped todependabot[bot].bun.lockusing a PAT, because (a) Dependabotpull_requestruns get a read-onlyGITHUB_TOKENthat can't push, and (b) aGITHUB_TOKENpush wouldn't retrigger Test — so auto-merge would never fire. A PAT push has write access and retriggers Test → fully hands-off auto-merge.pull_request(notpull_request_target) keeps it off CodeQL's privileged-checkout radar (the previous revision failed CodeQL for exactly that).--ignore-scripts; no-ops gracefully (with a warning, not a failure) until the secret is configured.Create a fine-grained PAT scoped to this repo with Contents: Read and write, then add it under Settings → Secrets and variables → Dependabot (the Dependabot secrets store, not Actions) as
DEPENDABOT_PAT. Dependabot-triggered runs can only read Dependabot secrets.Test Plan
DEPENDABOT_PAT, then confirm the next Dependabot PR auto-syncsbun.lock, Test goes green, and auto-merge firespull_request_target)dependabot[bot])