commit from snyk

Author: jgbernalp

.github/workflows/ci.yml

@@ -1,5 +1,12 @@
 name: ci
 on:
+  workflow_run:
+    workflows: ['snyk']
+    types:
+      - completed
+    branches:
+      - snyk-fix-*
+      - snyk-upgrade-*
   push:
     branches:
       - main
@@ -11,8 +18,9 @@ on:
 
 jobs:
   build:
-    name: "build"
+    name: 'build'
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -22,11 +30,11 @@ jobs:
           enable_npm: true
           enable_go: true
           enable_cue: true
-          cue_version: "v0.12.0"
+          cue_version: 'v0.12.0'
       - name: install percli
         uses: perses/cli-actions/actions/[email protected]
         with:
-          cli-version: "v0.51.1"
+          cli-version: 'v0.51.1'
       - name: cache cue deps
         uses: actions/cache@v4
         with:
@@ -52,8 +60,9 @@ jobs:
             !node_modules
 
   lint-npm:
-    name: "lint-npm"
+    name: 'lint-npm'
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -65,8 +74,9 @@ jobs:
       - run: npm run lint
 
   test-npm:
-    name: "test-npm"
+    name: 'test-npm'
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -78,8 +88,9 @@ jobs:
       - run: npm run test
 
   type-check:
-    name: "type-check"
+    name: 'type-check'
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -91,8 +102,9 @@ jobs:
       - run: npm run type-check
 
   lint-schemas:
-    name: "Validate plugin schemas"
+    name: 'Validate plugin schemas'
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -101,11 +113,11 @@ jobs:
         with:
           enable_go: true
           enable_cue: true
-          cue_version: "v0.12.0"
+          cue_version: 'v0.12.0'
       - name: Install percli
         uses: perses/cli-actions/actions/[email protected]
         with:
-          cli-version: "v0.51.1"
+          cli-version: 'v0.51.1'
       - uses: actions/cache@v4
         id: cache
         with:
@@ -117,6 +129,7 @@ jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -133,8 +146,9 @@ jobs:
           version: v2.3.0
       - run: make golangci-lint
   module-check:
-    name: "Check plugin modules"
+    name: 'Check plugin modules'
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -143,7 +157,7 @@ jobs:
         with:
           enable_go: true
           enable_cue: true
-          cue_version: "v0.12.0"
+          cue_version: 'v0.12.0'
       - uses: actions/cache@v4
         id: cache
         with:
@@ -157,8 +171,8 @@ jobs:
         run: git diff --exit-code -- */cue.mod
 
   release:
-    name: "release"
-    needs: "build"
+    name: 'release'
+    needs: 'build'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -174,8 +188,8 @@ jobs:
           enable_npm: true
           enable_go: true
           enable_cue: true
-          cue_version: "v0.12.0"
-          nvmrc_path: "./.nvmrc"
+          cue_version: 'v0.12.0'
+          nvmrc_path: './.nvmrc'
       - name: Download archive
         uses: actions/download-artifact@v4
         with:

.github/workflows/doc.yml

@@ -1,5 +1,12 @@
 name: doc
 on:
+  workflow_run:
+    workflows: ['snyk']
+    types:
+      - completed
+    branches:
+      - snyk-fix-*
+      - snyk-upgrade-*
   push:
     branches:
       - main
@@ -12,8 +19,9 @@ on:
 
 jobs:
   docs-fmt:
-    name: "Check docs format"
+    name: 'Check docs format'
     runs-on: ubuntu-latest
+    if: ${{ !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-')) }}
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -25,5 +33,3 @@ jobs:
         run: go install github.com/bwplotka/mdox@latest
       - name: check docs
         run: make checkdocs
-
-

.github/workflows/snyk.yml

@@ -0,0 +1,52 @@
+name: snyk
+on:
+  pull_request:
+    branches:
+      - main
+  merge_group:
+
+jobs:
+  lockfile-update:
+    name: 'regenerate lockfile'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    if: startsWith(github.head_ref, 'snyk-')
+    outputs:
+      lockfile-updated: ${{ steps.lockfile-changes.outputs.has_changes }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          ref: ${{ github.head_ref }}
+          fetch-depth: 2
+
+      - uses: perses/[email protected]
+      - uses: ./.github/perses-ci/actions/setup_environment
+        with:
+          enable_npm: true
+      - name: install dependencies
+        run: npm install
+
+      - name: check for lockfile changes
+        id: lockfile-changes
+        run: |
+          if git diff --quiet package-lock.json; then
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Get last commit message
+        id: last-commit
+        run: |
+          echo "message=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
+
+      - uses: stefanzweifel/git-auto-commit-action@v6
+        if: steps.lockfile-changes.outputs.has_changes == 'true'
+        with:
+          commit_message: '[IGNORE] ${{ steps.last-commit.outputs.message }}'
+          file_pattern: 'package-lock.json'
+          commit_options: '--no-verify --signoff --amend'
+          push_options: '--force-with-lease'

tempo/package.json

@@ -26,7 +26,7 @@
   "dependencies": {
     "@codemirror/autocomplete": "^6.18.4",
     "@lezer/highlight": "^1.2.1x",
-    "@grafana/lezer-traceql": "^0.0.20"
+    "@grafana/lezer-traceql": "^0.0.22"
   },
   "peerDependencies": {
     "@emotion/react": "^11.7.1",