ci: auto-rebuild dist on dependabot PRs #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: rebuild-dist | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| jobs: | |
| # Rebuilds the bundled dist/ on Dependabot PRs and pushes it back to the PR | |
| # branch, so a dependency bump and its matching dist/ land in a single PR and | |
| # the validate workflow stays green. | |
| # | |
| # Dependabot runs get a read-only GITHUB_TOKEN, and commits pushed with it do | |
| # not re-trigger checks. Pushing the dist commit therefore uses GH_PAT, which | |
| # can re-run workflows. Note: Dependabot runs only expose Dependabot secrets, | |
| # so GH_PAT must exist as a Dependabot secret (org or repo) with contents:write | |
| # on this repo. Until it does this job is a no-op. | |
| rebuild-dist: | |
| if: github.actor == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check token | |
| id: token | |
| env: | |
| GH_PAT: ${{ secrets.GH_PAT }} | |
| run: | | |
| if [ -n "$GH_PAT" ]; then | |
| echo "available=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "available=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::GH_PAT Dependabot secret is not set; skipping automatic dist rebuild." | |
| fi | |
| - name: Checkout | |
| if: steps.token.outputs.available == 'true' | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| token: ${{ secrets.GH_PAT }} | |
| - name: Setup Node.js | |
| if: steps.token.outputs.available == 'true' | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: '.node-version' | |
| cache: npm | |
| - name: Install dependencies | |
| if: steps.token.outputs.available == 'true' | |
| run: npm ci --ignore-scripts | |
| - name: Rebuild dist | |
| if: steps.token.outputs.available == 'true' | |
| run: npm run build | |
| - name: Commit and push dist if changed | |
| if: steps.token.outputs.available == 'true' | |
| env: | |
| HEAD_REF: ${{ github.head_ref }} | |
| run: | | |
| if [ -z "$(git status --porcelain -- dist)" ]; then | |
| echo "dist is already up to date." | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add dist | |
| git commit -m "build: rebuild dist" | |
| git push origin "HEAD:${HEAD_REF}" |