From e82493da2577b1a3217986c4c54d78e776201172 Mon Sep 17 00:00:00 2001 From: Aniket Singh Yadav Date: Sat, 18 Jul 2026 08:11:36 +0000 Subject: [PATCH 1/3] Fix dependabot PRs: auto-regenerate yarn.lock and group updates --- .github/dependabot.yml | 41 ++++++++++++++++ .github/workflows/dependabot-lockfile.yml | 59 +++++++++++++++++++++++ 2 files changed, 100 insertions(+) create mode 100644 .github/workflows/dependabot-lockfile.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7bec22842b4..1df0cb316b7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,44 @@ updates: directory: '/' schedule: interval: 'weekly' + - package-ecosystem: 'npm' + directory: '/' + schedule: + interval: 'weekly' + open-pull-requests-limit: 10 + versioning-strategy: increase + groups: + babel: + patterns: + - '@babel/*' + jupyterlab: + patterns: + - '@jupyterlab/*' + - '@lumino/*' + typescript: + patterns: + - 'typescript' + - '@types/*' + - 'ts-*' + lint-and-format: + patterns: + - 'eslint*' + - '@typescript-eslint/*' + - 'prettier*' + - 'stylelint*' + dev-dependencies: + dependency-type: 'development' + minor-and-patch: + update-types: + - 'minor' + - 'patch' + + - package-ecosystem: 'npm' + directory: '/ui-tests' + schedule: + interval: 'weekly' + open-pull-requests-limit: 5 + groups: + ui-tests-deps: + patterns: + - '*' diff --git a/.github/workflows/dependabot-lockfile.yml b/.github/workflows/dependabot-lockfile.yml new file mode 100644 index 00000000000..c5d818b562d --- /dev/null +++ b/.github/workflows/dependabot-lockfile.yml @@ -0,0 +1,59 @@ +name: Dependabot lockfile fix + +on: + pull_request_target: + branches: [main] + +permissions: + contents: write + +concurrency: + group: dependabot-lockfile-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + fix-lockfile: + if: >- + github.actor == 'dependabot[bot]' && + startsWith(github.head_ref, 'dependabot/npm_and_yarn/') + runs-on: ubuntu-latest + + env: + YARN_ENABLE_SCRIPTS: 'false' + YARN_ENABLE_IMMUTABLE_INSTALLS: 'false' + + steps: + - name: Checkout PR branch + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.event.pull_request.head.ref }} + repository: ${{ github.event.pull_request.head.repo.full_name }} + token: ${{ secrets.DEPENDABOT_LOCKFILE_TOKEN || secrets.GITHUB_TOKEN }} + fetch-depth: 0 + + - name: Setup Node + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + with: + node-version: '20.x' + + - name: Enable corepack + run: corepack enable + + - name: Regenerate root yarn.lock + run: yarn install --mode=update-lockfile + + - name: Regenerate ui-tests yarn.lock + working-directory: ui-tests + run: yarn install --mode=update-lockfile + + - name: Commit and push if changed + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + if [[ -n "$(git status --porcelain)" ]]; then + git add yarn.lock ui-tests/yarn.lock + git commit -m "Regenerate yarn.lock [dependabot skip]" + git push + else + echo "Lockfiles already in sync — nothing to do." + fi From d1b263342929d0b22f1e5090b3f71496ce4e0b76 Mon Sep 17 00:00:00 2001 From: Aniket Singh Yadav Date: Sat, 18 Jul 2026 08:33:55 +0000 Subject: [PATCH 2/3] fix - ci fails --- .github/dependabot.yml | 4 ++++ .github/workflows/dependabot-lockfile.yml | 12 +++++++----- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1df0cb316b7..8cf46185c9b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,6 +18,8 @@ updates: interval: 'weekly' open-pull-requests-limit: 10 versioning-strategy: increase + cooldown: + default-days: 3 groups: babel: patterns: @@ -49,6 +51,8 @@ updates: schedule: interval: 'weekly' open-pull-requests-limit: 5 + cooldown: + default-days: 3 groups: ui-tests-deps: patterns: diff --git a/.github/workflows/dependabot-lockfile.yml b/.github/workflows/dependabot-lockfile.yml index c5d818b562d..13b440f2e1d 100644 --- a/.github/workflows/dependabot-lockfile.yml +++ b/.github/workflows/dependabot-lockfile.yml @@ -1,7 +1,7 @@ name: Dependabot lockfile fix on: - pull_request_target: + pull_request: branches: [main] permissions: @@ -14,7 +14,7 @@ concurrency: jobs: fix-lockfile: if: >- - github.actor == 'dependabot[bot]' && + github.event.pull_request.user.login == 'dependabot[bot]' && startsWith(github.head_ref, 'dependabot/npm_and_yarn/') runs-on: ubuntu-latest @@ -26,10 +26,9 @@ jobs: - name: Checkout PR branch uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ github.event.pull_request.head.ref }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - token: ${{ secrets.DEPENDABOT_LOCKFILE_TOKEN || secrets.GITHUB_TOKEN }} + ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 + persist-credentials: false - name: Setup Node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 @@ -47,12 +46,15 @@ jobs: run: yarn install --mode=update-lockfile - name: Commit and push if changed + env: + GITHUB_TOKEN: ${{ github.token }} run: | git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" if [[ -n "$(git status --porcelain)" ]]; then git add yarn.lock ui-tests/yarn.lock git commit -m "Regenerate yarn.lock [dependabot skip]" + git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" git push else echo "Lockfiles already in sync — nothing to do." From 64a1a3055b057f7da5af5d3f351ecd7f67ef669b Mon Sep 17 00:00:00 2001 From: Aniket Singh Yadav Date: Sat, 18 Jul 2026 08:37:06 +0000 Subject: [PATCH 3/3] increase cooldown to 7 --- .github/dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8cf46185c9b..778a5f4828c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,7 +19,7 @@ updates: open-pull-requests-limit: 10 versioning-strategy: increase cooldown: - default-days: 3 + default-days: 7 groups: babel: patterns: @@ -52,7 +52,7 @@ updates: interval: 'weekly' open-pull-requests-limit: 5 cooldown: - default-days: 3 + default-days: 7 groups: ui-tests-deps: patterns: