ci(deps): Bump the github-actions group with 4 updates #123
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update dist on label | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: [labeled] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: update-dist-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| env: | |
| NODE_VERSION: "24" | |
| jobs: | |
| update-dist: | |
| name: Rebuild and commit dist/ | |
| runs-on: ubuntu-latest | |
| # Maintainers opt in by applying the label. Keep this to same-repo | |
| # Dependabot PRs so the write token is not exposed to arbitrary PR code. | |
| # User id 49699333 is dependabot[bot]. | |
| if: > | |
| github.event.label.name == 'update-dist' && | |
| github.event.pull_request.user.id == 49699333 && | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| with: | |
| run_install: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| package-manager-cache: false | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Rebuild bundle | |
| run: pnpm run build | |
| - name: Validate generated changes | |
| id: validate | |
| run: | | |
| changed_files="" | |
| non_dist_files="" | |
| while IFS= read -r -d '' entry; do | |
| path="${entry:3}" | |
| changed_files+="${path}"$'\n' | |
| case "$path" in | |
| dist/*) ;; | |
| *) non_dist_files+="${path}"$'\n' ;; | |
| esac | |
| done < <(git status --porcelain=v1 -z --untracked-files=all --no-renames) | |
| if [ -n "$non_dist_files" ]; then | |
| echo "::error::The dist update changed files outside dist/:" | |
| printf '%s\n' "$non_dist_files" | |
| exit 1 | |
| fi | |
| if [ -z "$changed_files" ]; then | |
| echo "has_changes=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "has_changes=true" >> "$GITHUB_OUTPUT" | |
| - name: Commit dist update | |
| if: steps.validate.outputs.has_changes == 'true' | |
| env: | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| git fetch origin "$HEAD_REF" | |
| current_head="$(git rev-parse FETCH_HEAD)" | |
| if [ "$current_head" != "$HEAD_SHA" ]; then | |
| echo "::error::PR head moved while rebuilding dist/. Reapply the label to retry." | |
| exit 1 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add dist | |
| git commit --no-verify -m "chore(deps): update dist" | |
| - name: Push dist update | |
| if: steps.validate.outputs.has_changes == 'true' | |
| env: | |
| DIST_UPDATE_PAT: ${{ secrets.DIST_UPDATE_PAT }} | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| run: | | |
| if [ -z "$DIST_UPDATE_PAT" ]; then | |
| echo "::error::Missing DIST_UPDATE_PAT secret. Use a classic PAT with public_repo scope." | |
| exit 1 | |
| fi | |
| git push "https://x-access-token:${DIST_UPDATE_PAT}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${HEAD_REF}" |