From 098c0962697f7f9bb20705efcfebab8016818248 Mon Sep 17 00:00:00 2001 From: Armin Schrenk Date: Wed, 27 May 2026 17:13:15 +0200 Subject: [PATCH 1/2] Fix dependabot pnpm update --- .github/workflows/build.yml | 2 + .../workflows/dependabot-frontend-build.yml | 75 +++++++++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 .github/workflows/dependabot-frontend-build.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f09763b6f..36a3d080a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,6 +17,8 @@ jobs: test: name: Run Tests runs-on: ubuntu-latest + # gate for dependabot issue, see PR [TODO] + if: ${{ !(startsWith(github.head_ref, 'dependabot/npm_and_yarn/') || startsWith(github.ref_name, 'dependabot/npm_and_yarn/')) }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: diff --git a/.github/workflows/dependabot-frontend-build.yml b/.github/workflows/dependabot-frontend-build.yml new file mode 100644 index 000000000..fe6bb6815 --- /dev/null +++ b/.github/workflows/dependabot-frontend-build.yml @@ -0,0 +1,75 @@ +name: Fix Dependabot Lockfile + +# Dependabot's pnpm updater re-resolves pnpm-lock.yaml from scratch but +# writes it back in a form that does not byte-match the lockfile pnpm itself +# would produce (e.g. a top-level `overrides:` block that does not match +# `pnpm.overrides` in package.json). CI's `pnpm install --frozen-lockfile` +# then fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Tracked upstream in +# pnpm/pnpm#9283, pnpm/pnpm#9519, dependabot/dependabot-core#12244, +# dependabot/dependabot-core#14339. +# +# Dropping --frozen-lockfile is not an option — it is half of Step 4's +# lockfile-integrity defense (see frontend/security-migration.md). +# +# This workflow regenerates the lockfile on dependabot PRs and pushes the +# corrected file back to the PR branch so the main CI sees a lockfile that +# survives --frozen-lockfile. +# +# Note: pushes made with the default GITHUB_TOKEN do not retrigger +# downstream workflows. After this workflow commits the corrected lockfile, +# build.yml does not auto-rerun on the new SHA — re-run failed checks +# manually or push an empty commit with a PAT to retrigger. + +on: + pull_request: + branches: [develop] + paths: + - 'frontend/package.json' + - 'frontend/pnpm-lock.yaml' + - 'frontend/pnpm-workspace.yaml' + +permissions: + contents: read + +defaults: + run: + shell: bash + +env: + NODE_VERSION: 22 + JAVA_VERSION: 21 + +jobs: + test: + name: Run Tests + runs-on: ubuntu-latest + if: ${{ github.actor == 'dependabot[bot]' && startsWith(github.head_ref, 'dependabot/npm_and_yarn/') }} + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis + - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 + with: + package_json_file: frontend/package.json + - name: Check lockfile integrity + working-directory: frontend + run: bash scripts/check-lockfile.sh + - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + with: + node-version: ${{ env.NODE_VERSION }} + cache: 'pnpm' + cache-dependency-path: frontend/pnpm-lock.yaml + # no-frozen-lockfile option due to byte mismatch + - name: Regenerate pnpm-lock.yaml + working-directory: frontend + run: pnpm install --no-frozen-lockfile --lockfile-only + - name: Re-verify lockfile integrity after regeneration + working-directory: frontend + run: bash scripts/check-lockfile.sh + # business as usual + - name: Build and test frontend + working-directory: frontend + run: pnpm run test:coverage + - name: Deploy frontend + working-directory: frontend + run: pnpm run dist From 37f461bd3e60e57d8a710155c2366f9f2d79868c Mon Sep 17 00:00:00 2001 From: Armin Schrenk Date: Wed, 27 May 2026 17:19:44 +0200 Subject: [PATCH 2/2] reduce verbosity --- .github/workflows/build.yml | 2 +- .../workflows/dependabot-frontend-build.yml | 23 ++----------------- 2 files changed, 3 insertions(+), 22 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 36a3d080a..25079a4c3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,7 +17,7 @@ jobs: test: name: Run Tests runs-on: ubuntu-latest - # gate for dependabot issue, see PR [TODO] + # gate for dependabot issue, see https://github.com/cryptomator/hub/pull/459 if: ${{ !(startsWith(github.head_ref, 'dependabot/npm_and_yarn/') || startsWith(github.ref_name, 'dependabot/npm_and_yarn/')) }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/dependabot-frontend-build.yml b/.github/workflows/dependabot-frontend-build.yml index fe6bb6815..12d582164 100644 --- a/.github/workflows/dependabot-frontend-build.yml +++ b/.github/workflows/dependabot-frontend-build.yml @@ -1,24 +1,5 @@ -name: Fix Dependabot Lockfile - -# Dependabot's pnpm updater re-resolves pnpm-lock.yaml from scratch but -# writes it back in a form that does not byte-match the lockfile pnpm itself -# would produce (e.g. a top-level `overrides:` block that does not match -# `pnpm.overrides` in package.json). CI's `pnpm install --frozen-lockfile` -# then fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Tracked upstream in -# pnpm/pnpm#9283, pnpm/pnpm#9519, dependabot/dependabot-core#12244, -# dependabot/dependabot-core#14339. -# -# Dropping --frozen-lockfile is not an option — it is half of Step 4's -# lockfile-integrity defense (see frontend/security-migration.md). -# -# This workflow regenerates the lockfile on dependabot PRs and pushes the -# corrected file back to the PR branch so the main CI sees a lockfile that -# survives --frozen-lockfile. -# -# Note: pushes made with the default GITHUB_TOKEN do not retrigger -# downstream workflows. After this workflow commits the corrected lockfile, -# build.yml does not auto-rerun on the new SHA — re-run failed checks -# manually or push an empty commit with a PAT to retrigger. +name: Build and test frontend on dependabot update +# for reasons, see https://github.com/cryptomator/hub/pull/459 on: pull_request: