Repository navigation
fix(deps): consolidate dependency updates, bump @actions/exec to v3 - #325
Closed
RonaldPhilipsen wants to merge 37 commits into
Closed
RonaldPhilipsen wants to merge 37 commits into
RonaldPhilipsen wants to merge 37 commits into
Conversation
feat: republish local-action and add node26 support
Updates the fork's .node-version pin to 26 so CI exercises the new engines range. Triggers the pending v7.1.0 release (engines + republish already in main via #2).
Adds id-token: write and lets setup-node handle npm auth via the publishing profile. Removes NPM_PUBLISH_TOKEN (delete the repo secret after merge).
Fixes the GPR publish (setup-node must be scoped to npm.pkg.github.com to write its auth) and makes the npm publish step idempotent (skip if the version already exists on the registry). Completes the pending v7.1.0 release: 7.1.0 is already on npm (published during #6's run, which then failed at GPR auth); this run will skip the npm publish and add the GPR publish + v7.1.0 tag + GitHub release.
Consolidates all open dependabot dependency updates into a single PR. The transitive npm updates (undici, fast-xml-parser, fast-xml-builder, lodash, browserslist, baseline-browser-mapping, brace-expansion, flatted, handlebars, @babel/core, js-yaml, yaml) and the GitHub Actions updates (checkout v7, setup-node v7, pnpm/action-setup v6, codeql v4.37.3+) are already present on main via the octokit monorepo lockfile regeneration and the SHA-pinned workflows, so the only remaining update is the @actions/exec v2 -> v3 major bump. Test fix: @actions/exec v3 ships a nested @actions/io v3 that the ESM mock does not intercept; io v3 destructures fs.promises at module load, which the fs fixture does not provide. Mock @actions/exec in cacheUtils.test.ts, matching the existing pattern in tar.test.ts and platform.test.ts.
Author
|
accidentally created a PR to the upstream repo, apologies for the noise |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates all open dependabot dependency updates into a single PR.
Why most dependabot PRs are already in main
The transitive npm updates and the GitHub Actions updates have already landed on
main:package-lock.json, pulling in undici 8.12.3, fast-xml-parser 5.11.2, fast-xml-builder 1.3.1, lodash 4.18.1, browserslist 4.29.5, baseline-browser-mapping 2.11.34, brace-expansion 1.1.21, flatted 3.4.4, handlebars 4.7.10, @babel/core 7.29.7, js-yaml 4.3.2, yaml 2.9.1, and @actions/artifact 6.3.1.What this PR changes
The only genuinely unapplied update is the @actions/exec v2 → v3 major bump (#267):
package.json:@actions/exec^2.0.0→^3.0.0package-lock.json: regenerated (exec 3.0.0, nested@actions/io3.0.2)Test fix
@actions/exec v3 ships a nested
@actions/iov3 (node_modules/@actions/exec/node_modules/@actions/io) that the ESM mock incacheUtils.test.tsdoes not intercept.@actions/iov3 destructuresfs.promisesat module load, which thefsfixture does not provide, so the suite failed to run:Fix: mock
@actions/execincacheUtils.test.ts, matching the existing pattern intar.test.tsandplatform.test.ts.Verification
npm test— 30/30 suites, 278 tests passing, 100% coverage thresholds metnpm run format:check— passingnpm run lint— passingCloses #267 #268 #278 #283 #287 #297 #301 #302 #305 #308 #309 #312 #313 #314 #318 #321 #323 #324