add scheduled dependency autoupdate workflow#12
Merged
Conversation
Two new workflows under .github/workflows/:
- autoupdate.yml runs every 6h (and on-demand via workflow_dispatch).
Adapted from the keycloak-radius-plugin pattern but driven by
scripts/update-dependencies.sh instead of an ad-hoc shell script:
* Checkout main with AUTOUPDATE_PAT so the PR creator is the same
identity that authored prior PRs (passes branch-protection rules
around required reviewers).
* Set up Temurin JDK 21 with Maven cache; deliberately *no*
actions/setup-node — frontend-maven-plugin downloads Node + npm
into target/ from our pom, so the runner stays minimal.
* Maintain a 'dependencies_updated' label, close superseded PRs,
and sweep orphan dependencies/auto-* branches from prior failed
runs.
* Run the existing update-dependencies.sh end-to-end (library
reactor via versions-maven-plugin, sample frontend via the
frontend-maven-plugin npm-upgrade-deps goal).
* If anything changed, branch dependencies/auto-YYYY-MM-DD, commit
with SKIP_HOOKS=1 (CI re-runs the build anyway), force-push, open
PR with the auto-merge label.
- automerge.yml enables GitHub auto-merge on any PR opened by
dependabot[bot] or labelled dependencies_updated, so the autoupdate
PR self-merges as soon as required checks pass.
Also tightens scripts/update-dependencies.sh: the frontend npm leg
now invokes `mvn initialize com.github.eirslett:frontend-maven-plugin:npm@npm-upgrade-deps`
in one chained command, ensuring install-node-and-npm and npm-install
run before npm-upgrade-deps (without this, ncu was not yet on the
PATH from a fresh checkout and the goal failed at the first command).
Manual prerequisites in the repository (outside this commit):
- Add an AUTOUPDATE_PAT repository secret with `repo` + `workflow`
scopes, owned by a maintainer who can satisfy branch-protection.
- Allow GitHub Actions to create PRs (Settings → Actions → General).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two new workflows under .github/workflows/:
autoupdate.yml runs every 6h (and on-demand via workflow_dispatch). Adapted from the keycloak-radius-plugin pattern but driven by scripts/update-dependencies.sh instead of an ad-hoc shell script:
automerge.yml enables GitHub auto-merge on any PR opened by dependabot[bot] or labelled dependencies_updated, so the autoupdate PR self-merges as soon as required checks pass.
Also tightens scripts/update-dependencies.sh: the frontend npm leg now invokes
mvn initialize com.github.eirslett:frontend-maven-plugin:npm@npm-upgrade-depsin one chained command, ensuring install-node-and-npm and npm-install run before npm-upgrade-deps (without this, ncu was not yet on the PATH from a fresh checkout and the goal failed at the first command).Manual prerequisites in the repository (outside this commit):
repo+workflowscopes, owned by a maintainer who can satisfy branch-protection.