Harden Dependabot workflow metadata handling

Co-authored-by: TylerJDev <26746305+TylerJDev@users.noreply.github.com>

Author: Copilot

.github/workflows/check-for-changeset.yml

@@ -28,7 +28,7 @@ jobs:
             exit 0
           fi
 
-          changesets=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename' | grep -E '^\.changeset/[^/]+\.md$' | grep -Ev '^\.changeset/(README\.md|dependabot-[0-9]+\.md)$' || true)
+          changesets=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename' | grep -E '^\.changeset/[^/]+\.md$' | grep -Ev '^\.changeset/(README\.md|dependabot-[0-9]+\.md|auto-release-[^.]+\.md)$' || true)
           if [ -n "$changesets" ]; then
             echo 'The ".changeset/*.md" file pattern matched the changed files of the pull request.'
             exit 0

.github/workflows/dependabot-changeset.yml

@@ -56,4 +56,10 @@ jobs:
         run: node scripts/dependabot-changeset.mjs
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          DEPENDABOT_METADATA_JSON: ${{ toJson(steps.metadata.outputs) }}
+          DEPENDABOT_DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+          DEPENDABOT_DEPENDENCY_TYPE: ${{ steps.metadata.outputs.dependency-type }}
+          DEPENDABOT_UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
+          DEPENDABOT_UPDATED_DEPENDENCIES_JSON: ${{ steps.metadata.outputs.updated-dependencies-json }}
+          DEPENDABOT_ALERT_STATE: ${{ steps.metadata.outputs.alert-state }}
+          DEPENDABOT_GHSA_ID: ${{ steps.metadata.outputs.ghsa-id }}
+          DEPENDABOT_CVSS: ${{ steps.metadata.outputs.cvss }}

scripts/dependabot-changeset.mjs

@@ -190,9 +190,23 @@ export async function applyDependabotChangeset({event, metadata, token}) {
   return {action: existing ? 'updated' : 'created', path: changesetPath, policy}
 }
 
+function metadataFromEnv(env) {
+  if (env.DEPENDABOT_METADATA_JSON) return JSON.parse(env.DEPENDABOT_METADATA_JSON)
+
+  return {
+    'dependency-names': env.DEPENDABOT_DEPENDENCY_NAMES ?? '',
+    'dependency-type': env.DEPENDABOT_DEPENDENCY_TYPE ?? '',
+    'update-type': env.DEPENDABOT_UPDATE_TYPE ?? '',
+    'updated-dependencies-json': env.DEPENDABOT_UPDATED_DEPENDENCIES_JSON ?? '',
+    'alert-state': env.DEPENDABOT_ALERT_STATE ?? '',
+    'ghsa-id': env.DEPENDABOT_GHSA_ID ?? '',
+    cvss: env.DEPENDABOT_CVSS ?? '',
+  }
+}
+
 if (import.meta.url === `file://${process.argv[1]}`) {
   const event = JSON.parse(process.env.GITHUB_EVENT_JSON ?? readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))
-  const metadata = JSON.parse(process.env.DEPENDABOT_METADATA_JSON)
+  const metadata = metadataFromEnv(process.env)
   const token = process.env.GITHUB_TOKEN
   if (!token) throw new Error('GITHUB_TOKEN is required.')