ci: fix yarn deduping working for any PR (#7364)

This adds a new CI job to sign deduping commits and that commit is
added to any opened PR.

In addition, husky is added with a manual install to install a
pre-commit hook to run dedupe while committing locally.

Author: BridgeAR

.github/chainguard/yarn-dedupe.sts.yaml

@@ -0,0 +1,12 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-js:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  ref: refs/pull/[0-9]+/merge
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/project.yml@refs/pull/[0-9]+/merge
+
+permissions:
+  contents: write
+

.github/scripts/yarn-dedupe.sh

@@ -117,14 +117,15 @@ jobs:
   yarn-dedupe:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: read
+      contents: read
+    outputs:
+      has_changes: ${{ steps.diff.outputs.has_changes }}
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: ./.github/actions/node/latest
@@ -135,9 +136,93 @@ jobs:
       - name: Run yarn dependencies:dedupe
         run: yarn dependencies:dedupe
 
-      - name: Run yarn dedupe check
-        run: ./.github/scripts/yarn-dedupe.sh
+      - name: Prepare yarn.lock update (same-repo PRs only; restricted paths)
+        id: diff
+        run: |
+          set -euo pipefail
+
+          if git diff --quiet; then
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          fail_message() { cat <<'EOF'
+          ❌ The yarn.lock file needs deduplication!
+
+          The yarn dedupe command has modified your yarn.lock file.
+          This means there were duplicate dependencies that could be optimized.
+
+          To fix this issue:
+          1. Run 'yarn dependencies:dedupe' locally
+          2. Commit the updated yarn.lock file
+          3. Push your changes
+
+          This helps keep the dependency tree clean.
+          EOF
+          }
+
+          changes="$(git diff --name-only)"
+          if [ "$changes" != "yarn.lock" ]; then
+            echo "Unexpected changed paths during yarn dedupe:"
+            echo "$changes"
+            exit 1
+          fi
+
+          # Never push updates to fork PR branches, and don't auto-fix outside PRs.
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            fail_message
+            exit 1
+          fi
+          if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
+            fail_message
+            exit 1
+          fi
+
+          cp yarn.lock "${RUNNER_TEMP}/yarn.lock"
+          echo "has_changes=true" >> $GITHUB_OUTPUT
+
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        if: steps.diff.outputs.has_changes == 'true'
+        with:
+          name: yarn-lock
+          path: ${{ runner.temp }}/yarn.lock
+          if-no-files-found: error
+
+  yarn-dedupe-push:
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.yarn-dedupe.outputs.has_changes == 'true'
+    runs-on: ubuntu-latest
+    needs: yarn-dedupe
+    # Security: this job has an STS-minted token, but never runs installs/builds.
+    # It only updates yarn.lock via the GitHub API.
+    permissions:
+      id-token: write
+    steps:
+      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-js
+          policy: yarn-dedupe
+
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: yarn-lock
+          path: ${{ runner.temp }}/yarn-lock-artifact
+
+      - name: Update yarn.lock via GitHub API (server-created verified commit)
         env:
-          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
-          PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
-          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
+          OWNER: ${{ github.repository_owner }}
+          REPO: ${{ github.event.repository.name }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+        run: |
+          set -euo pipefail
+
+          test -f "${{ runner.temp }}/yarn-lock-artifact/yarn.lock"
+          sha="$(gh api -q '.sha' "repos/${OWNER}/${REPO}/contents/yarn.lock?ref=${BRANCH}")"
+          content="$(base64 -w 0 "${{ runner.temp }}/yarn-lock-artifact/yarn.lock")"
+
+          gh api -X PUT "repos/${OWNER}/${REPO}/contents/yarn.lock" \
+            -f message="chore: deduplicate yarn.lock" \
+            -f content="${content}" \
+            -f sha="${sha}" \
+            -f branch="${BRANCH}"

.github/workflows/project.yml

@@ -141,3 +141,6 @@ __queuestorage__/AzuriteConfig
 
 # ignore claude settings
 .claude/
+
+# Husky generates a helper dir under .husky/_ (including husky.sh). Don't commit it.
+.husky/_/

.gitignore

@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+if [ ! -e "node_modules/.bin/yarn-deduplicate" ]; then
+  echo "yarn-deduplicate is not installed. Run 'yarn install' (with devDependencies) and try again."
+  exit 1
+fi
+
+yarn dependencies:dedupe
+git add yarn.lock

.husky/pre-commit

@@ -188,6 +188,7 @@
     "typescript": "^5.9.2",
     "workerpool": "^10.0.0",
     "yaml": "^2.8.0",
+    "husky": "^9.1.7",
     "yarn-deduplicate": "^6.0.2"
   }
 }

package.json

@@ -2275,6 +2275,11 @@ http-errors@^2.0.0, http-errors@~2.0.1:
     statuses "~2.0.2"
     toidentifier "~1.0.1"
 
+husky@^9.1.7:
+  version "9.1.7"
+  resolved "https://registry.yarnpkg.com/husky/-/husky-9.1.7.tgz#d46a38035d101b46a70456a850ff4201344c0b2d"
+  integrity sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA==
+
 iconv-lite@^0.7.0, iconv-lite@~0.7.0:
   version "0.7.1"
   resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.7.1.tgz#d4af1d2092f2bb05aab6296e5e7cd286d2f15432"