fix: work around Dependabot not supporting pnpm lockfileVersion 9.0#56
fix: work around Dependabot not supporting pnpm lockfileVersion 9.0#56MidnightDesign merged 6 commits intomasterfrom
Conversation
Dependabot can't parse pnpm-lock.yaml with lockfileVersion 9.0 (dependabot/dependabot-core#13920), so it updates package.json but not the lockfile, causing CI to fail on --frozen-lockfile. Add a workflow that regenerates pnpm-lock.yaml on Dependabot PRs, and a weekly check that creates a reminder issue once the upstream bug is resolved. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds GitHub Actions workflows to work around Dependabot’s inability to parse pnpm-lock.yaml with lockfileVersion: 9.0, by regenerating and committing the lockfile on Dependabot PRs and creating a weekly reminder issue once the upstream bug is resolved.
Changes:
- Add a Dependabot-only PR workflow that runs
pnpm installto regeneratepnpm-lock.yamland pushes the update back to the PR branch. - Add a scheduled workflow that checks dependabot/dependabot-core#13920 weekly and opens a reminder issue (assigned to
MidnightDesign) when the upstream issue closes.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/dependabot-lockfile.yml | Regenerates and commits pnpm-lock.yaml on Dependabot PRs. |
| .github/workflows/check-dependabot-fix.yml | Weekly check that opens a reminder issue when the upstream Dependabot bug is resolved. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Add `issues: write` permission to the check workflow so `gh issue create` works on scheduled runs - Filter duplicate check to open issues only (`--state open`) - Use `pnpm install --lockfile-only` to avoid executing dependency lifecycle scripts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Check `github.event.pull_request.user.login` instead of `github.actor` so the workflow runs reliably even if a maintainer pushes to the branch - Use printf to build the issue body without leading whitespace Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Unset GH_TOKEN when querying the upstream dependabot-core issue so it uses an unauthenticated public API request instead of the repo-scoped GITHUB_TOKEN. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Push to `origin HEAD:<head_ref>` explicitly instead of relying on upstream tracking, and only push when a commit was actually created. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Prevent false reminder issues when the upstream API call fails by adding `set -euo pipefail`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
pnpm-lock.yamlon Dependabot PRs, working around dependabot/dependabot-core#13920 (Dependabot can't parse lockfileVersion 9.0)Affected PRs
The following Dependabot PRs are currently failing because of this issue:
Test plan
pnpm-lock.yaml🤖 Generated with Claude Code