taichi/actions-package-update

keeps npm dependencies up-to-date by making pull requests from GitHub Actions or CI.

actions-package-update

This tool keeps npm dependencies up-to-date by making pull requests from GitHub Actions or CI.

This tool is the successor of taichi/ci-yarn-upgrade.

Basic Usage

GitHub Action for package.json update.

GitHub Actions

Below is the complete workflow example:

name: Update

on:
  schedule:
  - cron: 0 0 * * 3
  
jobs:
  package-update:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@master
    
    - name: set remote url
      run: git remote set-url --push origin https://$GITHUB_ACTOR:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY
      
    - name: package-update
      uses: taichi/actions-package-update@master
      env:
        AUTHOR_EMAIL: [email protected]
        AUTHOR_NAME: john
        EXECUTE: "true"
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        LOG_LEVEL: debug
      with:
        args: -u --packageFile package.json --loglevel verbose

Notes:

• this workflow runs every Wednesday at midnight.
• all args are passed to npm-check-updates.
• AUTHOR_NAME and AUTHOR_EMAIL are use for the commit.
• if you set EXECUTE as true, then actions-package-update makes a Pull Request.
• you must grant access using the built-in GITHUB_TOKEN value as above, because actions-package-update access to your repository and make Pull Request.
  • see Storing Secrets in the docs.

Examples

• Update devDependencies only

  - name: package-update
    uses: taichi/actions-package-update@master
    env:
      AUTHOR_EMAIL: [email protected]
      AUTHOR_NAME: John
      EXECUTE: "true"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    with:
      args: -u --packageFile package.json  --dep dev

• Use yarn upgrade

  - name: package-update
    uses: taichi/actions-package-update@master
    env:
      AUTHOR_EMAIL: [email protected]
      AUTHOR_NAME: John
      EXECUTE: "true"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      UPDATE_COMMAND: yarn
    with:
      args: upgrade --latest

• Use npm update

  - name: package-update
    uses: taichi/actions-package-update@master
    env:
      AUTHOR_EMAIL: [email protected]
      AUTHOR_NAME: John
      EXECUTE: "true"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      UPDATE_COMMAND: npm
    with:
      args: update

• Use pnpm update

  - name: package-update
    uses: taichi/actions-package-update@master
    env:
      AUTHOR_EMAIL: [email protected]
      AUTHOR_NAME: John
      EXECUTE: "true"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      UPDATE_COMMAND: pnpm
    with:
      args: update

• Use ncu with yarn workspaces

  In your workspace root, run:

  yarn add -DW wsrun npm-check-updates

  Add this script to your root package.json:

  {
    "ncu-all": "ncu -u --packageFile package.json && wsrun --serial ncu -u --packageFile package.json"
  }

  Add this config:

  - name: package-update
    uses: taichi/actions-package-update@master
    env:
      AUTHOR_EMAIL: [email protected]
      AUTHOR_NAME: John
      EXECUTE: "true"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      UPDATE_COMMAND: yarn
    with:
      args: ncu-all

Local or CI Server|Service

Install

yarn global add actions-package-update

or

npm install actions-package-update -g

or

pnpm add --global actions-package-update

Setting Environment Variables

• Required Variables
  • GITHUB_TOKEN
    • GitHub personal access token is required for sending pull requests to your repository
    • Creating an access token for command-line use
  • AUTHOR_NAME and AUTHOR_EMAIL
    • this command use there variables for commit
  • EXECUTE
    • By default, actions-package-update runs in dry-run mode.
    • if you set to EXECUTE=true, then this command push branch to remote, and make a pull request.

Command Behavior

This command works locally and output result to standard output.

Optional Configurations

• BRANCH_PREFIX
  • specify working branch prefix. default prefix is package-update/.
• COMMIT_MESSAGE
  • specify the commit message. default message is update dependencies.
• COMMIT_FILES
  • a space separated list of files that will be added to the commit. Leave empty to use git add --all.
    • for example, you can use "package.json package-lock.json" to ensure only these two files gets added to the commit
• UPDATE_COMMAND
  • specify the command for update. default command is ncu.
    • for example, you may set to yarn or npm.
• WITH_SHADOWS
  • if you specify this option, shows shadow dependencies changes.
  • default value is false.
• KEEP
  • if you specify this option, keep working branch after all.
  • default value is false.
  • this is useful for debugging.
• LOG_LEVEL
  • One of fatal, error, warn, info, debug, trace or silent.
  • default value is info.
  • if you want to know this tool's internal states, set to debug.
• WORKING_DIR
  • specify the working dir.
  • default value is ./.
• SET_NODE_VERSION
  • specify the node version you want to run on.
  • default value is latest.

Development

Setup

Run these commands in the project root dir.

yarn install
code .

Release

• release package to npmjs

  yarn publish

• edit Dockerfile

actions-package-update's Issues

Feature request: Create pull requests for each package, like Renovate

Having multiple package updates in one pull request is hard to manage.
How about creating pull requests for each package, like Renovate?

Thank you.

Tests aren't ran for PRs

For projects with decent coverage I could just merge these PRs without doing any manual checking out and testing of the branch. When this bot creates the PRs Github actions aren't ran so my tests aren't run automatically. I'm not sure if there is a way around this or if it could be changed to run npm test or something before creating the PRs.

How to test the action?

Hey!
I've been using this action for a while, and about one and a half months ago the action started to fail to try to use fsevents in a ubuntu env (it's supposed to try that only on mac).
Testings locally on a ubuntu machine I reached the conclusion the problem was that it was trying to run npm install, instead of npm ci.
I tried cloning the action repository to validate a fix before submitting a PR, but for some reason, it's not being able to run the new command (it continues to run the version from the original repository).
What I did was to change the uses: taichi/actions-package-update@master to point to my repository, but it did not work.
Can you please share how this can be tested/validated?
Thanks!

Implement ability to add Labels and assign Reviewers

Hey @taichi 👋🏻

Would love to hear from you what do you think about implementing these two features to the opened PRs:

• Add Labels
• Assign Reviewers

I was reading Github's documentation and it seems to be easy to implement.

Let me know, I'd be happy to contribute here 🚀

Table update dependencies problem

Hello, I use this GitHub actions to update the dependencies on an old project. When I created the workflows, and I change the version of a dependency, I can see in my project an update that is done. example : 2.0.5 => 2.0.7

Name	Updating
nodemon	2.0.7

But I don't have the information in the table
Table update dependencies problem

Do you have any idea ?

About the function to display diff URL

ci-yarn-upgrade display diff URL in PR, but actions-package-update does not display diff URL. Processing that generates diff URL is implemented, but it seems that it is not working because tags are not actually acquired. Are there any plans to make the function of displaying diff URL work?

Release 0.10.0 to NPM

Hi @taichi, I contributed #15 about two weeks ago, but the changes aren't on npm. Could you please release 0.10.0 to npm?

Would it be possible to have an option to add labels on the PR?

For example:

steps:
  - uses: ybiquitous/npm-audit-fix-action@v1
    with:
      labels: [dependencies, security]

Action commits access token

The Action somehow managed to commit the env.sh file containing the access token to Github.
https://github.com/Catrobat/Catblocks/blob/c81c15c6cb3d0db750c125a40000f5273aca2a0b/env.sh

Fortunately Github instantly blocked the Token.

I want use email: github-actions[bot]@users.noreply.github.com

I want use email: github-actions[bot]@users.noreply.github.com.

but , this line that format: email don't allow [].

actions-package-update/src/config.ts

Line 42 in 5ab5dc4

format: "email"

I remove that, but test failed. because async test already broken.
I hope you accept it.

GitHub ignores GITHUB_WORKSPACE env variable

No matter how you set this variable in a GitHub action, it's ignored (or possibly overwritten by GitHub). This means you can't run actions-package-update in any folder other than the root.

You can verify this by creating a workflow step:

- name: Attempt to set GITHUB_WORKSPACE
  env:
    FOO: bar
    GITHUB_WORKSPACE: ./foo
  run: printenv

Observe that the output shows that the GITHUB_WORKSPACE variable has not been changed:

Run printenv
  printenv
  shell: /bin/bash -e {0}
  env:
    FOO: bar
    GITHUB_WORKSPACE: ./foo
# ...
FOO=bar
# ...
GITHUB_WORKSPACE=/home/runner/work/actions-package-update/actions-package-update

This is also the case if you use set-env, because all that does is create an env property for future steps as if you had put them into the workflow yourself.

To solve this you would need to create a different environment variable that we can use which GitHub will not ignore or clobber (WORKING_DIRECTORY maybe?).

git fetch failed

I keep getting this:

[1590443623387] INFO  (1 on 926fcaaa51cd): Start process.
[1590443623389] DEBUG (1 on 926fcaaa51cd): START makeBranch
[1590443623389] DEBUG (1 on 926fcaaa51cd): getFile /github/workspace/package.json
[1590443623393] DEBUG (1 on 926fcaaa51cd): BEGIN git fetch --prune origin
Error: Command failed with exit code 128: git fetch --prune origin
    at makeError (/usr/local/share/.config/yarn/global/node_modules/execa/lib/error.js:56:11)
    at handlePromise (/usr/local/share/.config/yarn/global/node_modules/execa/index.js:114:26)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)
    at async h.makeBranch (/usr/local/share/.config/yarn/global/node_modules/actions-package-update/dist/index.js:12:1603)
    at async h.run (/usr/local/share/.config/yarn/global/node_modules/actions-package-update/dist/index.js:12:633)
    at async o (/usr/local/share/.config/yarn/global/node_modules/actions-package-update/dist/index.js:14:300) {
  command: 'git fetch --prune origin',
  exitCode: 128,
  signal: undefined,
  signalDescription: undefined,
  stdout: '',
  stderr: "fatal: unable to access 'https://github.com/naugtur/handsfreeyoutube/': Problem with the SSL CA cert (path? access rights?)",
  failed: true,
  timedOut: false,
  isCanceled: false,
  killed: false
}

Doesn't seem like something I misconfigured about the repo or access.

What am mI missing?