chore: automate library updates - #129
Conversation
WalkthroughRemoved legacy Changes
Sequence DiagramsequenceDiagram
autonumber
participant Scheduler as GitHub Scheduler
participant Workflow as Actions Workflow
participant Runner as Job Runner (Node 20)
participant Script as update-libraries.sh
participant npm as npm / npx
participant GlobalJSON as npm/global.json
Scheduler->>Workflow: Trigger (weekly or manual)
Workflow->>Runner: Checkout + setup Node 20 + cache
Runner->>Script: Run npm run update:libs
Script->>npm: npm-check-updates (apply, with rejects)
npm-->>Script: package.json updated
Script->>npm: npm install
npm-->>Script: deps installed
Script->>npm: npm view (latest) for global deps (if npm/global.json)
npm-->>Script: version info
Script->>GlobalJSON: Update manifest (if jq + file present)
Script->>Runner: npm run build
Runner-->>Workflow: Build complete
Workflow->>Workflow: create-pull-request (chore/auto-library-update)
Workflow-->>Scheduler: PR created + labeled, branch auto-delete after merge
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/update-libraries.yml (1)
1-39: LGTM! Consider adding a changes check.The workflow is well-structured with appropriate permissions and scheduling. The
peter-evans/create-pull-requestaction handles the no-changes case gracefully (won't create a PR if nothing changed), so the workflow is safe as-is.Optional enhancement: You could add a step to check for changes and skip PR creation explicitly:
- name: Check for changes id: changes run: | if git diff --quiet; then echo "has_changes=false" >> $GITHUB_OUTPUT else echo "has_changes=true" >> $GITHUB_OUTPUT fi - name: Create pull request if: steps.changes.outputs.has_changes == 'true' uses: peter-evans/create-pull-request@v6However, this is optional since
create-pull-requestalready handles this scenario.script/update-libraries.sh (1)
29-45: Consider adding error handling for npm view failures.The global CLI manifest refresh logic is well-structured, but
npm viewcould fail for network issues or missing packages.Apply this diff to add error handling:
while IFS= read -r pkg; do - latest_version=$(npm view "$pkg" version) + if ! latest_version=$(npm view "$pkg" version 2>&1); then + log "Warning: Failed to fetch version for $pkg, skipping" + continue + fi jq --arg pkg "$pkg" --arg version "$latest_version" \ '.dependencies[$pkg].version = $version' "$tmp_file" >"${tmp_file}.next" mv "${tmp_file}.next" "$tmp_file"This prevents the entire script from failing if a single package lookup fails while preserving the
set -ebehavior for other critical operations.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (8)
.eslintrc.js(0 hunks).github/workflows/update-libraries.yml(1 hunks)CLAUDE.md(1 hunks)README.md(3 hunks)eslint.config.mjs(1 hunks)npm/global.json(1 hunks)package.json(1 hunks)script/update-libraries.sh(1 hunks)
💤 Files with no reviewable changes (1)
- .eslintrc.js
🧰 Additional context used
🧠 Learnings (9)
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/claude.yml : Provide Claude Code integration workflow at .github/workflows/claude.yml triggered by claude mentions
Applied to files:
CLAUDE.mdREADME.md.github/workflows/update-libraries.yml
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/ci.yml : Maintain CI pipeline at .github/workflows/ci.yml to run linting, formatting, testing, and building
Applied to files:
CLAUDE.mdREADME.md.github/workflows/update-libraries.ymlscript/update-libraries.sh
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/docker-image.yml : Maintain DevContainer image build workflow at .github/workflows/docker-image.yml with semantic versioning and multi-platform support
Applied to files:
CLAUDE.mdREADME.md
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/README.md : Maintain workflow documentation at .github/workflows/README.md
Applied to files:
CLAUDE.mdREADME.md
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/docker-image.yml : Publish DevContainer images to ghcr.io/keito4/config-base via the Docker image workflow
Applied to files:
CLAUDE.md
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Enforce static quality gates: automated linting, formatting, security analysis, and license checking
Applied to files:
CLAUDE.mdREADME.md
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .claude/commands/README.md : Document available commands in .claude/commands/README.md
Applied to files:
README.md
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .claude/agents/README.md : Document agents and their usage in .claude/agents/README.md
Applied to files:
README.md
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Use semantic releases with automatic GitHub releases and generated release notes
Applied to files:
package.json
🪛 LanguageTool
CLAUDE.md
[uncategorized] ~106-~106: The official name of this software platform is spelled with a capital “H”.
Context: ...form support - Library Auto-Update (.github/workflows/update-libraries.yml): Sched...
(GITHUB)
README.md
[uncategorized] ~88-~88: The official name of this software platform is spelled with a capital “H”.
Context: ...r Node.js releases (semantic-release, @semantic-release/github) are excluded by default. Override the...
(GITHUB)
[uncategorized] ~233-~233: The official name of this software platform is spelled with a capital “H”.
Context: ...ent pipeline - Library Auto-Update (.github/workflows/update-libraries.yml): Sched...
(GITHUB)
🔇 Additional comments (11)
CLAUDE.md (1)
106-106: LGTM!The documentation accurately describes the new Library Auto-Update workflow and its integration.
eslint.config.mjs (1)
1-26: LGTM! Clean migration to ESLint 9 flat config.The configuration correctly migrates from the legacy
.eslintrc.jsformat to the new flat config format. The structure is clean with:
- Appropriate global ignores
- ESLint recommended rules
- Prettier integration to disable conflicting rules
- Sensible overrides for JS/JSX files with Node and Jest globals
The
globalspackage import at Line 2 is properly declared as a dependency inpackage.json(Line 33).script/update-libraries.sh (3)
1-15: LGTM! Solid initialization and validation.The script setup is excellent with:
- Strict error handling (
set -euo pipefail)- Flexible repository path detection
- Clear validation of required tools
17-24: LGTM! Smart rejection mechanism.The configurable rejection list with sensible defaults (excluding packages that require newer Node.js) allows flexibility while maintaining safety.
47-50: LGTM! Ensures changes are validated.Running the build pipeline (which includes linting and tests) after updates ensures that breaking changes are caught before creating a PR.
package.json (2)
20-20: LGTM! Script addition is clean.The new
update:libsscript properly wraps the bash script for convenient execution.
24-37: All major version upgrades are compatible with the current configuration.Jest 30 has breaking changes including Node support changes, jsdom upgrades, TypeScript 5.4 minimum, and removed alias matchers, but the test file (
test/config-validation.test.js) uses only standard matchers (toHaveProperty, toBe, toMatch) with no removed aliases. The CI runs on Node 20 (supported by Jest 30; earlier versions 14, 16, 19, 21 were dropped). No Jest-specific breaking changes impact this codebase.Commitlint v20's only breaking change is that body-max-line-length now ignores lines containing URLs. The
commitlint.config.jsextends the conventional config and uses custom rules for subject-case, subject-empty, type-empty, and scope-empty—it does not override body-max-line-length, so no migration needed.The @semantic-release/github v11 plugin changed internal shape for commit.associatedPRs and relatedIssues label properties and bumped peer dependency for semantic-release. The
.releaserc.jsonuses only public plugin configurations without consuming these internal properties. The top-level semantic-release version (24.2.9) should satisfy v11's peer requirements.The CI workflow successfully runs linting, formatting, tests, build, and validation on Node 20, confirming all configurations are working as expected.
README.md (3)
25-25: LGTM! Comprehensive script documentation.The script list accurately reflects all utility scripts including the new
update-libraries.shfor automated library updates.
84-90: LGTM! Clear and comprehensive documentation.The new section excellently documents the library update workflow, including:
- Command usage (
npm run update:libs)- What the script does (npm-check-updates, install, build, manifest sync)
- Default exclusions with override mechanism
- Weekly automation via GitHub Actions
233-233: LGTM! Workflow properly documented.The Library Auto-Update workflow is correctly added to the CI/CD pipeline list with an accurate description.
npm/global.json (1)
5-5: All updated package versions are valid and stable.Verification confirms all four packages exist on npm and are stable releases with proper cryptographic signatures and distribution metadata. No pre-release indicators found.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.devcontainer/Dockerfile(1 hunks)npm/global.json(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- npm/global.json
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/claude.yml : Provide Claude Code integration workflow at .github/workflows/claude.yml triggered by claude mentions
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/docker-image.yml : Maintain DevContainer image build workflow at .github/workflows/docker-image.yml with semantic versioning and multi-platform support
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/ci.yml : Maintain CI pipeline at .github/workflows/ci.yml to run linting, formatting, testing, and building
📚 Learning: 2025-08-29T14:37:56.575Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-29T14:37:56.575Z
Learning: Applies to .github/workflows/docker-image.yml : Maintain DevContainer image build workflow at .github/workflows/docker-image.yml with semantic versioning and multi-platform support
Applied to files:
.devcontainer/Dockerfile
| USER root | ||
|
|
||
| RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.35 @openai/codex@0.55.0 vercel | ||
| RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel |
There was a problem hiding this comment.
🧩 Analysis chain
Pin versions of typescript, eslint, and vercel for reproducible DevContainer builds.
Global npm CLI tools are installed without version constraints for typescript, eslint, and vercel, which means the image will have different tool versions depending on when it's rebuilt. This breaks reproducibility and contradicts the PR's intent to automate and standardize library updates. The PR explicitly upgrades to ESLint 9, but the Dockerfile doesn't pin it.
Pin all three tools to specific versions to ensure consistent image builds. Based on the PR description, at minimum use eslint@9. Verify target versions for typescript and vercel from npm/global.json:
Then update line 46 to match:
-RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel
+RUN npm install -g typescript@<VERSION> eslint@9 @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel@<VERSION>🏁 Script executed:
#!/bin/bash
# Description: Verify global CLI tool versions in npm/global.json
# Check if npm/global.json exists and display its content
if [ -f npm/global.json ]; then
echo "=== npm/global.json ==="
cat npm/global.json
else
echo "npm/global.json not found"
fi
# Also search for any version constraints in package.json or other config files
echo -e "\n=== package.json devDependencies (eslint, typescript) ==="
rg -A 5 '"devDependencies"' package.json | head -20Length of output: 870
🏁 Script executed:
#!/bin/bash
# Description: Verify typescript, eslint, and vercel versions in package.json and Dockerfile context
# Get full devDependencies section to find typescript and eslint versions
echo "=== Full package.json devDependencies ==="
rg -A 100 '"devDependencies"' package.json | grep -E '(typescript|eslint|vercel)' | head -10
# Search for vercel configuration
echo -e "\n=== Vercel configuration ==="
if [ -f vercel.json ]; then
echo "vercel.json found:"
cat vercel.json
else
echo "vercel.json not found"
fi
# Check .devcontainer/Dockerfile for context/comments around line 46
echo -e "\n=== .devcontainer/Dockerfile context (lines 40-50) ==="
sed -n '40,50p' .devcontainer/Dockerfile
# Search for any .npmrc or npm configuration that might set default versions
echo -e "\n=== .npmrc or npm configuration ==="
if [ -f .npmrc ]; then
cat .npmrc
else
echo ".npmrc not found"
fiLength of output: 324
🏁 Script executed:
#!/bin/bash
# Description: Verify typescript, eslint, and vercel versions in package.json and Dockerfile context
# Get full devDependencies section to find typescript and eslint versions
echo "=== Full package.json devDependencies ==="
rg -A 100 '"devDependencies"' package.json | grep -E '(typescript|eslint|vercel)' | head -10
# Search for vercel configuration
echo -e "\n=== Vercel configuration ==="
if [ -f vercel.json ]; then
echo "vercel.json found:"
cat vercel.json
else
echo "vercel.json not found"
fi
# Check .devcontainer/Dockerfile for context/comments around line 46
echo -e "\n=== .devcontainer/Dockerfile context (lines 40-50) ==="
sed -n '40,50p' .devcontainer/Dockerfile
# Search for any .npmrc or npm configuration that might set default versions
echo -e "\n=== .npmrc or npm configuration ==="
if [ -f .npmrc ]; then
cat .npmrc
else
echo ".npmrc not found"
fiLength of output: 695
🏁 Script executed:
#!/bin/bash
# Description: Find typescript version in package.json
echo "=== Searching for typescript version ==="
rg -i 'typescript' package.json | head -5
echo -e "\n=== Full devDependencies section ==="
rg -A 50 '"devDependencies"' package.json | head -60Length of output: 630
Pin eslint@9.39.1 to match project configuration; verify and pin typescript and vercel versions.
The Dockerfile installs global npm tools without version constraints. The project's package.json pins eslint@9.39.1, but line 46 installs global eslint without a version, creating reproducibility issues and a mismatch with the project's dev environment.
Update line 46 to:
-RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel
+RUN npm install -g typescript@<VERSION> eslint@9.39.1 @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel@<VERSION>Replace <VERSION> placeholders for typescript and vercel based on your intended versions (neither is documented in package.json or npm/global.json).
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
.devcontainer/Dockerfile around line 46: the Dockerfile installs global npm
packages without versions, causing reproducibility and a mismatch with
package.json; update the RUN to pin eslint to 9.39.1 and also pin specific
versions for typescript and vercel (replace <VERSION> placeholders with the
chosen versions), e.g. install typescript@<VERSION> eslint@9.39.1
@anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel@<VERSION>, then
rebuild the image to verify the pinned versions are used.
|
🎉 This PR is included in version 1.1.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
Testing
Summary by CodeRabbit
New Features
Documentation
Chores