implemented update dependencies action by ramaghanta · Pull Request #111 · checkdigit/github-actions

ramaghanta · 2026-10-26T17:23:08Z

closes #110

…tion

Copilot

🟡 Changes recommended

Unresolved critical and moderate findings affect action execution, security, deletion handling, outputs, and automated pull-request checks.

5 open issues

Pin npm-check-updates to a reviewed version · New
Run setup from the repository root · New
Treat missing collaborator permissions as unauthorized · New
Include deleted tracked files in the commit · New
Pin the example action to the reviewed SHA · New

What changed in this PR

This pull request adds an issue-comment-driven GitHub Action that updates npm dependencies, validates the changes, and publishes a signed dependency-update pull request.

Changes:

Adds action metadata, caller documentation, and repository context handling.
Implements comment authorization, dependency migration, version updates, validation, and lockfile regeneration.
Adds GitHub API publication, pull-request management, tests, and package version updates.

File	Description
`update-dependencies/README.md`	Documents action behavior, workflow setup, validation, and logging.
`update-dependencies/action.yml`	Defines the Node 24 action, inputs, outputs, and lifecycle scripts.
`src/update-dependencies/update-dependencies.ts`	Implements dependency migration, validation, and publication orchestration.
`src/update-dependencies/update-dependencies.spec.ts`	Tests dependency migration, validation, failures, and authorization flow.
`src/update-dependencies/publish.ts`	Creates update branches, signed commits, pull requests, labels, assignments, and comments.
`src/update-dependencies/publish.spec.ts`	Tests commit publication, verification, pull-request creation, and metadata handling.
`src/update-dependencies/issue-command.ts`	Validates issue comments and commenter permissions.
`src/update-dependencies/issue-command.spec.ts`	Tests authorization and ignored comment cases.
`src/update-dependencies/index.ts`	Provides action-level error handling and failure comments.
`src/update-dependencies/client.ts`	Creates the authenticated GitHub client and resolves repository context.
`src/update-dependencies/client.spec.ts`	Tests required token configuration.
`package.json`	Bumps the package version to `4.3.0`.
`package-lock.json`	Updates lockfile metadata and resolved dependency versions.

_{Review effort: Lite}

carlansley · 2026-10-26T17:57:49Z

+updater then:
+
+1. Increments the package's own version by one patch, without a Git tag or commit.
+   Removes `rimraf` and `@types/koa__router` from dependency sections and replaces


regarding the @types/koa__router change, this could be made more general. i.e. if a package (in this case @koa/router) has types defined internally, we should remove the @types declaration. of course maybe create an issue for our future selves, not suggesting we need to do it for this PR.

good idea. created #112

carlansley · 2026-10-26T17:58:23Z

+
+import { getDependencyClient } from './client.ts';
+
+it('requires GITHUB_TOKEN like existing GitHub API helpers', () => {


wrap in a describe block

github-actions · 2026-10-26T18:06:59Z

❌ PR review status - has 1 reviewer outstanding

github-actions · 2026-10-26T18:07:08Z

Coverage after merging dependency-updates-action into main will be

95.73%	▾ -0.92%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
src/check-dependencies
check-dependencies.spec.ts	100%	100%	100%	100%
check-dependencies.ts	98.74%	94.67%	100%	100%	91, 156, 200, 200
src/check-imports
package-lock-file-utility.spec.ts	100%	100%	100%	100%
package-lock-file-utility.ts	100%	100%	100%	100%
packages-not-allowed.spec.ts	83.33%	100%	66.67%	83.33%	13–15
packages-not-allowed.ts	100%	100%	100%	100%
src/check-label
check-label-compare-match-semver.spec.ts	100%	100%	100%	100%
check-label.spec.ts	100%	100%	100%	100%
check-label.ts	95.08%	90%	100%	95.96%	68–70, 78–80
src/check-pr-reviews
check-pr-reviews.spec.ts	100%	100%	100%	100%
check-pr-reviews.ts	50.65%	40%	100%	50.70%	22–37, 41–59, 68–70
src/coverage-reporter
html.spec.ts	100%	100%	100%	100%
html.ts	100%	100%	100%	100%
lcov.spec.ts	100%	100%	100%	100%
lcov.ts	93.72%	90.91%	80%	94.44%	117–127, 134
tabulate.spec.ts	100%	100%	100%	100%
tabulate.ts	98.87%	94.44%	100%	100%	176, 176, 183
utility.spec.ts	100%	100%	100%	100%
utility.ts	100%	100%	100%	100%
src/github-api
index-context.spec.ts	100%	100%	100%	100%
index-publish-comment.spec.ts	100%	100%	100%	100%
index-reviews.spec.ts	100%	100%	100%	100%
index.spec.ts	100%	100%	100%	100%
index.ts	83.22%	71.64%	100%	84.83%	61, 70, 77–81, 98–103, 108–111, 126–128, 146–149, 179–184, 207–216, 235–238, 243–246, 265–268, 273–276, 287–290, 301–303, 311–313, 315–318, 341–343
src/prepare-beta
package.spec.ts	100%	100%	100%	100%
package.ts	94.12%	75%	100%	95.56%	23–25
src/publish-beta
files.spec.ts	100%	100%	100%	100%
files.ts	94.03%	92.31%	100%	94%	36–39
package.spec.ts	100%	100%	100%	100%
package.ts	95.38%	85.71%	100%	96.36%	23–25
publish.spec.ts	100%	100%	100%	100%
publish.ts	85.37%	100%	50%	86.11%	32–36
validate-name-and-resource-length.spec.ts	100%	100%	100%	100%
validate-name-and-resource-length.ts	89.13%	100%	71.43%	88.07%	35–40, 103–109
src/update-dependencies
client.spec.ts	90.63%	80%	100%	91.67%	19–21
client.ts	60%	66.67%	50%	60%	12–13, 17–25
issue-command.spec.ts	100%	100%	100%	100%
issue-command.ts	100%	100%	100%	100%
publish.spec.ts	99.52%	92.86%	100%	100%	60
publish.ts	70.72%	75%	44.44%	71.50%	31–33, 40–42, 87, 90, 93, 133–138, 141–150, 153–170, 173–179, 182–191
update-dependencies.spec.ts	99.04%	98.08%	89.66%	100%	209
update-dependencies.ts	88.54%	80%	100%	90.37%	106, 132–134, 140, 140–143, 143–145, 164–166, 170–173, 175, 214–216, 221–223, 239–249, 252–254
src/validate-npm-package
validate-npm-package.spec.ts	99.19%	96%	95.24%	100%	30
validate-npm-package.ts	89.43%	64%	100%	92.35%	41, 62–70, 72, 89, 92–97, 113, 178–182

Copilot

🟡 Changes recommended

Unresolved critical and moderate issues affect workflow triggering, deletion publication, output consistency, and rimraf migration behavior.

1 open issue

GITHUB_TOKEN prevents checks from running on published PR · New

1 previously missed issue

In code that hasn't changed since last review

Issue URL missing when existing update PR is reused

src/update-dependencies/update-dependencies.ts:241

When an existing update PR is found, this early return sets only pull-request-url; the declared issue-url output remains empty, unlike the normal publication path. Consumers cannot reliably obtain the issue URL on the retry/already-published path. Set the issue URL before returning.

5 resolved since last review

_{Review effort: Lite}

+Pass the built-in `GITHUB_TOKEN` with contents, issues, and pull requests write
+permissions. The action publishes through GitHub's API, so checkout can use
+`persist-credentials: false`. No manually created write token or signing key is
+needed. Enable Actions PR creation in repository settings and ensure `PATCH`
+already exists.
+
+The action's own JavaScript runtime is Node 24; npm and project scripts use the
+Node version configured by the caller. In-action tests run on Node 26 and do not
+replace the repository's PR checks or its Node 24/26 matrix. Verify that those
+checks run on the resulting PR before merging. Token-applied labels do not


ramaghanta and others added 16 commits October 6, 2026 14:53

initial version of dependency updates action

50da1a5

removed unnecessary checks

2ac7a10

log errors

85c2f96

created two actions

f516aa6

revert back an unintended change

4e975d0

update dependencies action

3ab422c

Merge remote-tracking branch 'origin/main' into dependency-updates-ac…

0c81426

…tion

updated version

3251d9a

minor refactoring

8f02196

another refactor

0435288

create the branch and PR upon failure

0b43fbe

fewer logs

dae9365

fixed logging

b4ca866

changes to npm scripts

3d0d9bd

change the order of scripts

fa48869

prettier standard scripts

10e845e

ramaghanta self-assigned this Oct 26, 2026

ramaghanta added the MINOR label Oct 26, 2026

Copilot AI lite review requested due to automatic review settings October 26, 2026 17:23

Copilot started reviewing on behalf of ramaghanta October 26, 2026 17:23

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

copilot comments

382eaa4

ramaghanta requested a review from carlansley October 26, 2026 17:44

carlansley requested changes Oct 26, 2026

View reviewed changes

Carl fix

88507c1

ramaghanta requested review from carlansley and a lite review from Copilot October 26, 2026 18:06

Copilot started reviewing on behalf of ramaghanta October 26, 2026 18:07

View session

carlansley approved these changes Oct 26, 2026

View reviewed changes

Copilot AI reviewed Oct 26, 2026

View reviewed changes

ramaghanta merged commit 4967841 into main Oct 26, 2026
12 of 13 checks passed

ramaghanta deleted the dependency-updates-action branch October 26, 2026 18:13

Navigation Menu

Repository navigation

implemented update dependencies action - #111

implemented update dependencies action#111
ramaghanta merged 18 commits into
mainfrom
dependency-updates-action

ramaghanta commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

carlansley Oct 26, 2026

Uh oh!

ramaghanta Oct 26, 2026

Uh oh!

carlansley Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		import { getDependencyClient } from './client.ts';

		it('requires GITHUB_TOKEN like existing GitHub API helpers', () => {

Conversation

ramaghanta commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

carlansley Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

ramaghanta Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

carlansley Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants