From c5817310a5fb8f98d22eabc79d2a58a27f0fb94c Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Wed, 12 Aug 2026 22:30:01 +0900 Subject: [PATCH 1/3] ci: refactor script for resolving lockfile versions --- .github/workflows/version-bump.yml | 72 ++++++++++++++++++++++-------- 1 file changed, 53 insertions(+), 19 deletions(-) diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml index b21b52bbb..664015c95 100644 --- a/.github/workflows/version-bump.yml +++ b/.github/workflows/version-bump.yml @@ -68,35 +68,69 @@ jobs: exit 1 fi - - name: Bump root package + - name: Bump package versions env: VERSION: ${{ steps.version.outputs.version }} - run: npm version "$VERSION" --no-git-tag-version --allow-same-version - - - name: Bump git-proxy-cli package - working-directory: packages/git-proxy-cli - env: - VERSION: ${{ steps.version.outputs.version }} - run: npm version "$VERSION" --no-git-tag-version --allow-same-version + run: | + npm pkg set "version=$VERSION" + npm pkg set "version=$VERSION" --workspace @finos/git-proxy-cli + npm pkg set "dependencies.@finos/git-proxy=$VERSION" --workspace @finos/git-proxy-cli - - name: Sync git-proxy-cli's pin on the root package + - name: Patch lockfile versions env: VERSION: ${{ steps.version.outputs.version }} run: | node -e ' const fs = require("fs"); - const p = "packages/git-proxy-cli/package.json"; - const pkg = JSON.parse(fs.readFileSync(p, "utf8")); - if (!pkg.dependencies || !pkg.dependencies["@finos/git-proxy"]) { - console.error("::error::Expected @finos/git-proxy in git-proxy-cli dependencies."); - process.exit(1); + const VERSION = process.env.VERSION; + const ROOT = "@finos/git-proxy"; + const CLI_PATH = "packages/git-proxy-cli"; + const LOCK = "package-lock.json"; + const fail = (m) => { console.error("::error::" + m); process.exit(1); }; + + const lock = JSON.parse(fs.readFileSync(LOCK, "utf8")); + if (lock.lockfileVersion !== 3) fail("Expected lockfileVersion 3, got " + lock.lockfileVersion + "."); + + const rootEntry = lock.packages[""]; + const cliEntry = lock.packages[CLI_PATH]; + if (!rootEntry) fail("Lockfile has no root package entry."); + if (!cliEntry) fail("Lockfile has no \"" + CLI_PATH + "\" entry."); + if (!(lock.packages["node_modules/" + ROOT] || {}).link) { + fail("Lockfile is missing the workspace link entry for " + ROOT + ". Something has already re-resolved the tree."); } - pkg.dependencies["@finos/git-proxy"] = process.env.VERSION; - fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + "\n"); + if (!cliEntry.dependencies || cliEntry.dependencies[ROOT] === undefined) { + fail(CLI_PATH + " no longer pins " + ROOT + "; this workflow needs updating."); + } + + lock.version = VERSION; + rootEntry.version = VERSION; + cliEntry.version = VERSION; + cliEntry.dependencies[ROOT] = VERSION; + + fs.writeFileSync(LOCK, JSON.stringify(lock, null, 2) + "\n"); + console.log("Patched " + LOCK + " to " + VERSION + "."); ' - - name: Refresh the lockfile - run: npm install --package-lock-only --no-audit --no-fund + - name: Guard against unexpected changes + run: | + UNEXPECTED=$(git diff --name-only | grep -vE '^(package\.json|package-lock\.json|packages/git-proxy-cli/package\.json)$' || true) + if [ -n "$UNEXPECTED" ]; then + echo "::error::A version bump modified files it shouldn't have:" + echo "$UNEXPECTED" + exit 1 + fi + + CHANGED=$(git diff --numstat -- package-lock.json | awk '{print $1 + $2}') + CHANGED=${CHANGED:-0} + echo "package-lock.json changed lines: $CHANGED" + if [ "$CHANGED" -gt 12 ]; then + echo "::error::package-lock.json changed $CHANGED lines; a version bump should touch eight. Refusing to open the PR." + git --no-pager diff --stat -- package-lock.json + git --no-pager diff -- package-lock.json | head -n 120 + exit 1 + fi + + git --no-pager diff -- package.json package-lock.json packages/git-proxy-cli/package.json - name: Open version bump PR env: @@ -122,7 +156,7 @@ jobs: SOURCE_LINE="Triggered manually for version $VERSION." fi - BODY=$(printf '%s\n\nBumps:\n- `package.json`, `package-lock.json`\n- `packages/git-proxy-cli/package.json` (including its pin on `@finos/git-proxy`)\n\nOnce merged, cut `%s` from `main` per our [release process](https://git-proxy.finos.org/docs/development/releases) in order to generate a GitHub draft release.\n' "$SOURCE_LINE" "$RELEASE_BRANCH") + BODY=$(printf '%s\n\nBumps:\n- `package.json`, `package-lock.json`\n- `packages/git-proxy-cli/package.json`, including its pin on `@finos/git-proxy`\n\nOnce merged, cut `%s` from `main` per our [release process](https://git-proxy.finos.org/docs/development/releases) in order to generate a GitHub draft release.\n' "$SOURCE_LINE" "$RELEASE_BRANCH") if gh pr view "$BRANCH" >/dev/null 2>&1; then echo "PR for $BRANCH already exists. Branch updated, no new PR opened." From 0c66fc6de1435a64a02cc8ffe96c8ce5f68442f7 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Wed, 12 Aug 2026 22:50:53 +0900 Subject: [PATCH 2/3] ci: generate unique PRs on workflow reruns --- .github/workflows/version-bump.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml index 664015c95..5eea5f64a 100644 --- a/.github/workflows/version-bump.yml +++ b/.github/workflows/version-bump.yml @@ -132,14 +132,14 @@ jobs: git --no-pager diff -- package.json package-lock.json packages/git-proxy-cli/package.json - - name: Open version bump PR +- name: Open version bump PR env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} VERSION: ${{ steps.version.outputs.version }} MILESTONE_TITLE: ${{ github.event.milestone.title }} MILESTONE_URL: ${{ github.event.milestone.html_url }} run: | - BRANCH="chore/bump-version-$VERSION" + BRANCH="chore/bump-version-$VERSION-$GITHUB_RUN_ID" RELEASE_BRANCH="release/${VERSION%.*}" git config user.name "github-actions[bot]" @@ -148,7 +148,7 @@ jobs: git checkout -b "$BRANCH" git add package.json package-lock.json packages/git-proxy-cli/package.json git commit -m "chore: bump git-proxy and git-proxy-cli to $VERSION" - git push -u origin "$BRANCH" --force-with-lease + git push -u origin "$BRANCH" if [ -n "$MILESTONE_URL" ]; then SOURCE_LINE="Triggered by closing milestone **$MILESTONE_TITLE** ($MILESTONE_URL)." @@ -158,8 +158,5 @@ jobs: BODY=$(printf '%s\n\nBumps:\n- `package.json`, `package-lock.json`\n- `packages/git-proxy-cli/package.json`, including its pin on `@finos/git-proxy`\n\nOnce merged, cut `%s` from `main` per our [release process](https://git-proxy.finos.org/docs/development/releases) in order to generate a GitHub draft release.\n' "$SOURCE_LINE" "$RELEASE_BRANCH") - if gh pr view "$BRANCH" >/dev/null 2>&1; then - echo "PR for $BRANCH already exists. Branch updated, no new PR opened." - else - gh pr create --base main --head "$BRANCH" --title "chore: bump version to $VERSION" --body "$BODY" - fi + gh pr create --base main --head "$BRANCH" \ + --title "chore: bump version to $VERSION" --body "$BODY" From aaca109911b4f64594a69b53decc34959e766f02 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Wed, 12 Aug 2026 23:09:27 +0900 Subject: [PATCH 3/3] ci: npm run fornat --- .github/workflows/version-bump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml index 5eea5f64a..fe6e58827 100644 --- a/.github/workflows/version-bump.yml +++ b/.github/workflows/version-bump.yml @@ -132,7 +132,7 @@ jobs: git --no-pager diff -- package.json package-lock.json packages/git-proxy-cli/package.json -- name: Open version bump PR + - name: Open version bump PR env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} VERSION: ${{ steps.version.outputs.version }}