chore(deps): update dependencies #50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot age-gate exempt (compute) | |
| # Stage 1 of 2 (UNPRIVILEGED). Runs in the `pull_request` context — read-only | |
| # token, no secrets — so it is safe to execute against the PR-authored | |
| # lockfile. It decides whether pnpm's minimumReleaseAge gate (24h — see | |
| # pnpm-workspace.yaml) blocks a frozen install for this Dependabot PR and, if | |
| # so, computes and verifies the exact name@version entries to exempt, | |
| # publishing them as an artifact for the privileged apply stage | |
| # (dependabot-age-exempt-apply.yml). | |
| # | |
| # This split is deliberate: the untrusted code runs here without write | |
| # access, and only a validated, data-only artifact crosses into the | |
| # privileged stage. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| paths: | |
| - 'pnpm-lock.yaml' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: dependabot-age-compute-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| compute: | |
| if: github.actor == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 # full history so we can diff against the PR base | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - name: Compute age-gate exemption | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| run: node .github/scripts/dependabot-age-compute.mjs | |
| - name: Upload exemption request | |
| if: ${{ hashFiles('age-exempt/additions.txt') != '' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: age-exempt-request | |
| path: age-exempt/ | |
| retention-days: 1 | |
| if-no-files-found: ignore |