commit from snyk

Author: jgbernalp

.github/workflows/ci.yml

@@ -1,5 +1,12 @@
 name: ci
 on:
+  workflow_run:
+    workflows: ['snyk']
+    types:
+      - completed
+    branches:
+      - snyk-fix-*
+      - snyk-upgrade-*
   push:
     branches:
       - main
@@ -9,10 +16,14 @@ on:
     types:
       - published
 
+env:
+  SKIP_SNYK_PRS: ${{ github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-') }}
+
 jobs:
   build:
     name: "build"
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -54,6 +65,7 @@ jobs:
   lint-npm:
     name: "lint-npm"
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -67,6 +79,7 @@ jobs:
   test-npm:
     name: "test-npm"
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -80,6 +93,7 @@ jobs:
   type-check:
     name: "type-check"
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -93,6 +107,7 @@ jobs:
   lint-schemas:
     name: "Validate plugin schemas"
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -117,6 +132,7 @@ jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -135,6 +151,7 @@ jobs:
   module-check:
     name: "Check plugin modules"
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4

.github/workflows/doc.yml

@@ -1,5 +1,12 @@
 name: doc
 on:
+  workflow_run:
+    workflows: ['snyk']
+    types:
+      - completed
+    branches:
+      - snyk-fix-*
+      - snyk-upgrade-*
   push:
     branches:
       - main
@@ -10,10 +17,14 @@ on:
   pull_request:
   merge_group:
 
+env:
+  SKIP_SNYK_PRS: ${{ github.event_name == 'pull_request' && startsWith(github.head_ref, 'snyk-') }}
+
 jobs:
   docs-fmt:
     name: "Check docs format"
     runs-on: ubuntu-latest
+    if: env.SKIP_SNYK_PRS != 'true'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -25,5 +36,3 @@ jobs:
         run: go install github.com/bwplotka/mdox@latest
       - name: check docs
         run: make checkdocs
-
-

.github/workflows/snyk.yml

@@ -0,0 +1,52 @@
+name: snyk
+on:
+  pull_request:
+    branches:
+      - main
+  merge_group:
+
+jobs:
+  lockfile-update:
+    name: 'regenerate lockfile'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    if: startsWith(github.head_ref, 'snyk-')
+    outputs:
+      lockfile-updated: ${{ steps.lockfile-changes.outputs.has_changes }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 2
+
+      - uses: perses/[email protected]
+      - uses: ./.github/perses-ci/actions/setup_environment
+        with:
+          enable_npm: true
+      - name: install dependencies
+        run: npm install
+
+      - name: check for lockfile changes
+        id: lockfile-changes
+        run: |
+          if git diff --quiet package-lock.json; then
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Get last commit message
+        id: last-commit
+        run: |
+          echo "message=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
+          echo "author=$(git log -1 --pretty=\"%an <%ae>\")" >> $GITHUB_OUTPUT
+
+      - uses: stefanzweifel/git-auto-commit-action@v6
+        if: steps.lockfile-changes.outputs.has_changes == 'true'
+        with:
+          commit_message: "[IGNORE] ${{ steps.last-commit.outputs.message }}
+          file_pattern: 'package-lock.json'
+          commit_options: '--no-verify --signoff --amend'
+          push_options: '--force-with-lease'

tempo/package.json

@@ -26,7 +26,7 @@
   "dependencies": {
     "@codemirror/autocomplete": "^6.18.4",
     "@lezer/highlight": "^1.2.1x",
-    "@grafana/lezer-traceql": "^0.0.20"
+    "@grafana/lezer-traceql": "^0.0.22"
   },
   "peerDependencies": {
     "@emotion/react": "^11.7.1",