VertexChain/infrastructure/ci/dependency-updates.yml at 9d80bb77ea4c59cb33f161942ad9f4ea4b9575c8 · MicD746/VertexChain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: Dependency Update Automation (deprecated)

# Issue #34: This workflow is superseded by Dependabot at `.github/dependabot.yml`.
# Both would run on the same weekly cadence, producing duplicate PRs.
# Disabled by default; manual `workflow_dispatch` is retained for emergencies
# (e.g. when Dependabot is paused or fails for a given ecosystem).
on:
  schedule: []
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  update-dependencies:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install dependencies
        run: |
          npm install
          [ -f Frontend/package.json ] && (cd Frontend && npm install) || true
          [ -f Backend/package.json ] && (cd Backend && npm install) || true
          [ -f analytics/package.json ] && (cd analytics && npm install) || true

      - name: Check and update dependencies + run tests
        run: bash infrastructure/scripts/check-deps.sh

      - name: Create dependency update PR
        id: cpr
        uses: peter-evans/create-pull-request@v7
        with:
          branch: chore/deps/weekly-updates
          commit-message: "chore(deps): weekly dependency updates"
          title: "chore(deps): weekly dependency updates"
          body: |
            Automated weekly dependency updates.

            Grouping:
            - major updates
            - minor updates
            - patch updates

            Includes dependency checks and test execution.
          labels: |
            dependencies
            automation

      - name: Enable auto-merge on green
        if: ${{ steps.cpr.outputs.pull-request-number != '' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh pr merge --auto --squash "${{ steps.cpr.outputs.pull-request-number }}" || true