This repository was archived by the owner on Aug 17, 2026. It is now read-only.
chore(deps): update all dependencies to latest #87
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update bun.lock for Dependabot PRs | |
| # Dependabot uses the npm ecosystem updater which only modifies package.json. | |
| # It does not know how to regenerate bun.lock. CI then fails with | |
| # --frozen-lockfile because the lockfile is out of sync with package.json. | |
| # | |
| # This workflow detects every Dependabot push, runs `bun install` to | |
| # regenerate the lockfile, and commits the result back to the PR branch so | |
| # subsequent CI runs see a consistent lockfile. | |
| # | |
| # pull_request_target is used (instead of pull_request) so the workflow has | |
| # write access to the repository contents. Dependabot PRs always originate | |
| # from within the same repo (not a fork), so this is safe. | |
| # | |
| # After pushing the lockfile commit, the workflow explicitly dispatches CI on | |
| # the updated branch, because GITHUB_TOKEN pushes do not re-trigger | |
| # pull_request events (GitHub security feature to prevent recursive loops). | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize] | |
| permissions: | |
| contents: write | |
| actions: write | |
| jobs: | |
| update-lockfile: | |
| if: github.actor == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event.pull_request.head.ref }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Regenerate bun.lock | |
| run: bun install | |
| - name: Commit updated lockfile | |
| id: commit | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add bun.lock | |
| if git diff --staged --quiet; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| git commit -m "chore: regenerate bun.lock for dependabot bump" | |
| git push | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Trigger CI on updated branch | |
| if: steps.commit.outputs.changed == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh workflow run ci.yml --ref "${{ github.event.pull_request.head.ref }}" |