Skip to content

Commit ca47705

Browse files
hashtagchrishashtagchris
authored
fix: Use include-workspace-root for /main in Post Dependabot (#462)
<!-- What / Why --> <!-- Describe the request in detail. What it does and why it's being changed. --> `steps.metadata.outputs.directory` is set to `/main`, not `/`, when `package.json` is at the root of the repository. I suspect adding `target-branch` to `dependabot.yml` (#330) added a `main` segment to Dependabot PR branch names, which changed the value of `steps.metadata.outputs.directory`. By fixing this issue, we shouldn't need to routinely use stafftools to fix up template-oss Dependabot PRs. 🤞🏼 I couldn't quickly find a `bump @npmcli/template-oss` Dependabot PR for a workspace to inspect `steps.metadata.outputs.directory` and fix workspaces support. If that's important, we may want to either enable Dependabot for `npm/cli` or create a separate `template-oss-test` repo. It's not clear if Dependabot will create a PR for `workspace/test-workspace` upon our next release. ### Example Dependabot PR branch names The first PR updates just `@npmcli/template-oss`. The second updates multiple dependencies including `@npmcli/template-oss`. PR | branch name | segments | steps.metadata.outputs.directory -|-|-|- npm/agent#110 | `dependabot/npm_and_yarn/main/npmcli/template-oss-4.23.0` | 5 | `/main` npm/statusboard#877 | `dependabot/npm_and_yarn/main/dependency-updates-4de8b5bfcf` | 4 | `/` ## References <!-- Examples: Related to #0 Depends on #0 Blocked by #0 Fixes #0 Closes #0 --> Failed "Post Dependabot" run: https://github.com/npm/agent/actions/runs/9963674341/job/27530225303 Fix manually tested here: npm/agent@ef85b08 [branchNameToDirectoryName](https://github.com/dependabot/fetch-metadata/blob/ffa2dc8ffecf17d26f6a81b83f9ef5edd33ba93a/src/dependabot/update_metadata.ts#L31) Bug report: dependabot/fetch-metadata#540
1 parent 9acf69e commit ca47705

File tree

10 files changed

+21
-22
lines changed

10 files changed

+21
-22
lines changed

‎.github/actions/create-check/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ runs:
2525
with:
2626
result-encoding: string
2727
script: |
28-
const { repo: { owner, repo}, runId, serverUrl } = context
28+
const { repo: { owner, repo}, runId, serverUrl } = context
2929
const { JOB_NAME, SHA } = process.env
3030
3131
const job = await github.rest.actions.listJobsForWorkflowRun({

‎.github/actions/install-latest-npm/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ runs:
4444
MATCH=$SPEC
4545
echo "Found compatible version: npm@$MATCH"
4646
break
47-
fi
47+
fi
4848
done
4949
5050
if [ -z $MATCH ]; then

‎.github/workflows/post-dependabot.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ jobs:
4949
id: flags
5050
run: |
5151
dependabot_dir="${{ steps.metadata.outputs.directory }}"
52-
if [[ "$dependabot_dir" == "/" ]]; then
52+
if [[ "$dependabot_dir" == "/" || "$dependabot_dir" == "/main" ]]; then
5353
echo "workspace=-iwr" >> $GITHUB_OUTPUT
5454
else
5555
# strip leading slash from directory so it works as a

‎SECURITY.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).
44

5-
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
5+
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
66

77
If the vulnerability you have found is *not* [in scope for the GitHub Bug Bounty Program](https://bounty.github.com/#scope) or if you do not wish to be considered for a bounty reward, please report the issue to us directly through [[email protected]](mailto:[email protected]).
88

‎lib/content/SECURITY-md.hbs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).
22

3-
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
3+
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
44

55
If the vulnerability you have found is *not* [in scope for the GitHub Bug Bounty Program](https://bounty.github.com/#scope) or if you do not wish to be considered for a bounty reward, please report the issue to us directly through [[email protected]](mailto:[email protected]).
66

‎lib/content/action-create-check-yml.hbs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ runs:
2323
with:
2424
result-encoding: string
2525
script: |
26-
const { repo: { owner, repo}, runId, serverUrl } = context
26+
const { repo: { owner, repo}, runId, serverUrl } = context
2727
const { JOB_NAME, SHA } = process.env
2828

2929
const job = await github.rest.actions.listJobsForWorkflowRun({

‎lib/content/action-install-latest-npm-yml.hbs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ runs:
4242
MATCH=$SPEC
4343
echo "Found compatible version: npm@$MATCH"
4444
break
45-
fi
45+
fi
4646
done
4747

4848
if [ -z $MATCH ]; then

‎lib/content/post-dependabot-yml.hbs

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
id: flags
2727
run: |
2828
dependabot_dir="$\{{ steps.metadata.outputs.directory }}"
29-
if [[ "$dependabot_dir" == "/" ]]; then
29+
if [[ "$dependabot_dir" == "/" || "$dependabot_dir" == "/{{ releaseBranch }}" ]]; then
3030
echo "workspace=-iwr" >> $GITHUB_OUTPUT
3131
else
3232
# strip leading slash from directory so it works as a
@@ -64,7 +64,7 @@ jobs:
6464
run: |
6565
git commit -am "$\{{ steps.apply.outputs.message }}"
6666
git push
67-
67+
6868
# If the previous step failed, then reset the commit and remove any workflow changes
6969
# and attempt to commit and push again. This is helpful because we will have a commit
7070
# with the correct prefix that we can then --amend with @npmcli/stafftools later.
@@ -98,4 +98,3 @@ jobs:
9898
echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
9999
echo "for more information on how to fix this with a BREAKING CHANGE footer."
100100
exit 1
101-

‎lib/util/dependabot.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
const { name: NAME } = require('../../package.json')
22
const { minimatch } = require('minimatch')
33

4-
const parseDependabotConfig = v => (typeof v === 'string' ? { strategy: v } : v ?? {})
4+
const parseDependabotConfig = v => (typeof v === 'string' ? { strategy: v } : (v ?? {}))
55

66
module.exports = (config, defaultConfig, branches) => {
77
const { dependabot } = config

‎tap-snapshots/test/apply/source-snapshots.js.test.cjs

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ runs:
7272
with:
7373
result-encoding: string
7474
script: |
75-
const { repo: { owner, repo}, runId, serverUrl } = context
75+
const { repo: { owner, repo}, runId, serverUrl } = context
7676
const { JOB_NAME, SHA } = process.env
7777
7878
const job = await github.rest.actions.listJobsForWorkflowRun({
@@ -146,7 +146,7 @@ runs:
146146
MATCH=$SPEC
147147
echo "Found compatible version: npm@$MATCH"
148148
break
149-
fi
149+
fi
150150
done
151151
152152
if [ -z $MATCH ]; then
@@ -725,7 +725,7 @@ jobs:
725725
id: flags
726726
run: |
727727
dependabot_dir="\${{ steps.metadata.outputs.directory }}"
728-
if [[ "$dependabot_dir" == "/" ]]; then
728+
if [[ "$dependabot_dir" == "/" || "$dependabot_dir" == "/main" ]]; then
729729
echo "workspace=-iwr" >> $GITHUB_OUTPUT
730730
else
731731
# strip leading slash from directory so it works as a
@@ -1414,7 +1414,7 @@ SECURITY.md
14141414
14151415
GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).
14161416
1417-
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
1417+
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
14181418
14191419
If the vulnerability you have found is *not* [in scope for the GitHub Bug Bounty Program](https://bounty.github.com/#scope) or if you do not wish to be considered for a bounty reward, please report the issue to us directly through [[email protected]](mailto:[email protected]).
14201420
@@ -1512,7 +1512,7 @@ runs:
15121512
with:
15131513
result-encoding: string
15141514
script: |
1515-
const { repo: { owner, repo}, runId, serverUrl } = context
1515+
const { repo: { owner, repo}, runId, serverUrl } = context
15161516
const { JOB_NAME, SHA } = process.env
15171517
15181518
const job = await github.rest.actions.listJobsForWorkflowRun({
@@ -1586,7 +1586,7 @@ runs:
15861586
MATCH=$SPEC
15871587
echo "Found compatible version: npm@$MATCH"
15881588
break
1589-
fi
1589+
fi
15901590
done
15911591
15921592
if [ -z $MATCH ]; then
@@ -2383,7 +2383,7 @@ jobs:
23832383
id: flags
23842384
run: |
23852385
dependabot_dir="\${{ steps.metadata.outputs.directory }}"
2386-
if [[ "$dependabot_dir" == "/" ]]; then
2386+
if [[ "$dependabot_dir" == "/" || "$dependabot_dir" == "/main" ]]; then
23872387
echo "workspace=-iwr" >> $GITHUB_OUTPUT
23882388
else
23892389
# strip leading slash from directory so it works as a
@@ -3099,7 +3099,7 @@ SECURITY.md
30993099
31003100
GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).
31013101
3102-
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
3102+
If you believe you have found a security vulnerability in this GitHub-owned open source repository, you can report it to us in one of two ways.
31033103
31043104
If the vulnerability you have found is *not* [in scope for the GitHub Bug Bounty Program](https://bounty.github.com/#scope) or if you do not wish to be considered for a bounty reward, please report the issue to us directly through [[email protected]](mailto:[email protected]).
31053105
@@ -3300,7 +3300,7 @@ runs:
33003300
with:
33013301
result-encoding: string
33023302
script: |
3303-
const { repo: { owner, repo}, runId, serverUrl } = context
3303+
const { repo: { owner, repo}, runId, serverUrl } = context
33043304
const { JOB_NAME, SHA } = process.env
33053305
33063306
const job = await github.rest.actions.listJobsForWorkflowRun({
@@ -3374,7 +3374,7 @@ runs:
33743374
MATCH=$SPEC
33753375
echo "Found compatible version: npm@$MATCH"
33763376
break
3377-
fi
3377+
fi
33783378
done
33793379
33803380
if [ -z $MATCH ]; then
@@ -3907,7 +3907,7 @@ jobs:
39073907
id: flags
39083908
run: |
39093909
dependabot_dir="\${{ steps.metadata.outputs.directory }}"
3910-
if [[ "$dependabot_dir" == "/" ]]; then
3910+
if [[ "$dependabot_dir" == "/" || "$dependabot_dir" == "/main" ]]; then
39113911
echo "workspace=-iwr" >> $GITHUB_OUTPUT
39123912
else
39133913
# strip leading slash from directory so it works as a

0 commit comments

Comments
 (0)