dependabot.yml

name: update node_modules
on:
  pull_request_target:
    types: [opened, reopened, synchronize, labeled]

jobs:
  dependabot:
    environment: npm-update
    permissions:
      contents: read
      pull-requests: write
    timeout-minutes: 5
    # 22.04's podman has issues with piping and causes tar errors
    runs-on: ubuntu-20.04
    if: ${{ contains(github.event.pull_request.labels.*.name, 'node_modules') }}

    steps:
      - name: Clone repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          fetch-depth: 0

      - name: Clear node_modules label
        uses: actions/github-script@v7
        with:
          script: |
            try {
              await github.rest.issues.removeLabel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                name: 'node_modules'
              });
            } catch (e) {
              if (e.name == 'HttpError' && e.status == 404) {
                /* expected: 404 if label is unset */
              } else {
                throw e;
              }
            }

      - name: Update node_modules for package.json changes
        run: |
          make tools/node-modules
          git config --global user.name "GitHub Workflow"
          git config --global user.email "cockpituous@cockpit-project.org"
          eval $(ssh-agent)
          ssh-add - <<< '${{ secrets.NODE_CACHE_DEPLOY_KEY }}'
          ./tools/node-modules install
          ./tools/node-modules push
          git add node_modules
          ssh-add -D
          ssh-agent -k

      - name: Clear [no-test] prefix from PR title
        if: ${{ contains(github.event.pull_request.title, '[no-test]') }}
        uses: actions/github-script@v7
        env:
          TITLE: '${{ github.event.pull_request.title }}'
        with:
          script: |
            const title = process.env['TITLE'].replace(/\[no-test\]\W+ /, '')
            await github.rest.pulls.update({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
              title,
            });

      - name: Force push node_modules update
        run: |
          # Dependabot prefixes the commit with [no-test] which we don't want to keep in the commit
          title=$(git show --pretty="%s" -s | sed -E "s/\[no-test\]\W+ //")
          body=$(git show -s --pretty="%b")
          git commit --amend -m "${title}" -m "${body}" --no-edit node_modules
          eval $(ssh-agent)
          ssh-add - <<< '${{ secrets.SELF_DEPLOY_KEY }}'
          git push --force 'git@github.com:${{ github.repository }}' '${{ github.head_ref }}'
          ssh-add -D
          ssh-agent -k