yarn-deduplicate.yml

name: yarn-deduplicate

on:
  pull_request:
    paths:
      - "yarn.lock"

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: true

permissions:
  contents: write
  deployments: read
  pull-requests: write # needed to write comment in PR

jobs:
  dedupe:
    runs-on: ubuntu-latest
    name: Deduplicate
    environment: pull_request_unsafe

    steps:
      - name: Checkout sources
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
        with:
          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token
          fetch-depth: 0 # otherwise, you will failed to push refs to dest repo

      - name: Use Node.js
        uses: ./.github/actions/setup-node

      - name: yarn-deduplicate
        id: deduplicate
        run: |
          yarn install --frozen-lockfile --ignore-scripts
          yarn yarn-deduplicate
          echo "::set-output name=diff::$(git status --short yarn.lock)"
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Commit dedupe
        if: steps.deduplicate.outputs.diff
        uses: actions-js/push@5a7cbd780d82c0c937b5977586e641b2fd94acc5 #1.5
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          message: "chore: yarn-deduplicate"
          branch: ${{ github.head_ref }}