Template Dependency Check #117
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Template Dependency Check | |
| # The scheduled bot run: scans the dependency Catalog (internal/deps) and opens | |
| # a Rollup PR, one Migration PR per constraint-breaking update, and an issue per | |
| # deprecation. See ADR-0002. | |
| # | |
| # The PR-facing half (scan + step summary) lives in ci.yml's dep-scan job. This | |
| # workflow has no PR-review purpose, so it stays out of the PR check graph. | |
| on: | |
| schedule: | |
| # Wednesdays — offset from Dependabot (Monday) so the two don't pile up. | |
| - cron: "0 9 * * 3" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan: | |
| name: Scan the Catalog | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: ./.github/actions/dep-scan-core | |
| - name: Upload scan report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dep-report | |
| path: dep-report.json | |
| retention-days: 7 | |
| propose: | |
| name: Open Rollup, Migrations and deprecation issues | |
| runs-on: ubuntu-latest | |
| needs: scan | |
| environment: ci | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.BOT_TOKEN }} | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Build dep-checker | |
| run: make build ARGS="-t dep-checker" | |
| - name: Download scan report | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: dep-report | |
| - name: Ensure labels exist | |
| env: | |
| GH_TOKEN: ${{ secrets.BOT_TOKEN }} | |
| run: | | |
| gh label create "dependencies" --color "0075ca" --description "Dependency updates" --repo "$GITHUB_REPOSITORY" 2>/dev/null || true | |
| gh label create "deprecated" --color "e4e669" --description "Deprecated package" --repo "$GITHUB_REPOSITORY" 2>/dev/null || true | |
| - name: Propose updates | |
| env: | |
| GH_TOKEN: ${{ secrets.BOT_TOKEN }} | |
| run: .github/scripts/dep-bot.sh dep-report.json |