dependabot.yml

# Automatically save updated `pnpm-lock.yaml` file for dependabot PRs.
# This is necessary because dependabot doesn't support pnpm yet:
# https://github.com/dependabot/dependabot-core/issues/1736
#
# Note: We use the `pull_request_target` event due to GitHub security measures.
#       It is important to ensure we don't execute any untrusted PR code in this context.
# See: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
#      https://securitylab.github.com/research/github-actions-preventing-pwn-requests

name: Dependabot
on:
  - pull_request_target

jobs:
  fix-lockfile:
    runs-on: ubuntu-latest
    if: |
      github.actor == 'dependabot[bot]' &&
      contains(github.event.pull_request.head.ref, 'dependabot/npm_and_yarn/')

    steps:
      - uses: actions/checkout@v2.3.5
        with:
          # Using a Personal Access Token here is required to trigger workflows on our new commit.
          # The default GitHub token doesn't trigger any workflows.
          # See: https://github.community/t/push-from-action-does-not-trigger-subsequent-action/16854/2
          token: ${{ secrets.BOT_GITHUB_TOKEN }}
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 2

      - uses: pnpm/action-setup@v2.0.1
        with:
          version: 6.10.0
      - uses: actions/setup-node@v2.4.1
        with:
          node-version: "14"
          cache: "pnpm"

      - run: git checkout HEAD^ -- pnpm-lock.yaml
      - run: pnpm install --ignore-scripts --lockfile-only

      - name: Configure git
        run: |
          # use personal access token to allow triggering new workflow
          BASIC_AUTH=$(echo -n "x-access-token:${{ secrets.BOT_GITHUB_TOKEN }}" | base64)
          echo "::add-mask::$BASIC_AUTH"
          git config --global user.name 'dependabot[bot]'
          git config --global user.email '49699333+dependabot[bot]@users.noreply.github.com'
          git config --local http.$GITHUB_SERVER_URL/.extraheader "AUTHORIZATION: basic $BASIC_AUTH"
      - name: Commit changes
        run: |
          git add pnpm-lock.yaml
          git commit -m "[dependabot skip] Fix pnpm-lock.yaml"
          git push