chore(deps-dev): bump the development-dependencies group across 1 directory with 2 updates #171
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs on the same ref (rapid pushes / PR force-pushes) so the | |
| # matrix doesn't pile up. Pushes to main get a per-ref group too, which is fine: | |
| # only the newest main commit needs the full matrix. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: test (node ${{ matrix.node-version }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: | |
| - "22" | |
| - "24" | |
| - "26" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: "pnpm" | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm check | |
| # Repo policy gate, deliberately its own job so a missing changeset surfaces | |
| # as "changeset", not as a confusing failure on one leg of the node matrix. | |
| changeset: | |
| name: changeset | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # Full history so `changeset status --since=origin/<base>` can resolve | |
| # the base ref. | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "24" | |
| cache: "pnpm" | |
| - run: pnpm install --frozen-lockfile | |
| - name: Verify changeset is present | |
| # Two PR kinds legitimately carry no changeset and would otherwise fail | |
| # this required check (and, with branch protection on main, sit stuck): | |
| # - Dependabot bumps the github-actions group only (CI-only, no | |
| # published-package impact). | |
| # - The changesets "Version Packages" PR (head `changeset-release/<base>`) | |
| # has already consumed its changesets, so `changeset status` errors on | |
| # it (changed package, zero changesets present). | |
| # Both still run the job and exit 0, satisfying the check. Actor/refs go | |
| # through env to keep the values out of the shell-command string. | |
| env: | |
| ACTOR: ${{ github.actor }} | |
| HEAD_REF: ${{ github.head_ref }} | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| if [ "$ACTOR" = "dependabot[bot]" ] || [ "$HEAD_REF" = "changeset-release/$BASE_REF" ]; then | |
| echo "Dependabot or release PR: changeset not required." | |
| exit 0 | |
| fi | |
| pnpm changeset status --since="origin/$BASE_REF" |