Refresh E2E Fixtures #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Refresh E2E Fixtures | |
| on: | |
| schedule: | |
| - cron: "0 13 1,15 * *" # 1st and 15th of each month at 13:00 UTC | |
| workflow_dispatch: | |
| concurrency: | |
| group: refresh-fixtures | |
| cancel-in-progress: false | |
| # The default GITHUB_TOKEN only needs read access for checkout; the PR step | |
| # authenticates with CLERK_COOKIE_PAT so GITHUB_TOKEN never opens PRs here. | |
| permissions: | |
| contents: read | |
| env: | |
| CLERK_TELEMETRY_DISABLED: "1" | |
| jobs: | |
| refresh: | |
| # Guard against workflow_dispatch runs from non-main refs. Without this, | |
| # a modified workflow on a feature branch could execute with access to | |
| # CLERK_COOKIE_PAT because workflow_dispatch runs the YAML from the | |
| # dispatched ref, not from main. | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| # Always refresh from main, even on workflow_dispatch runs that | |
| # select a different ref, so manual triggers cannot smuggle | |
| # unrelated changes from a feature branch into the refresh PR. | |
| ref: main | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - name: Refresh fixtures | |
| run: bun run e2e:refresh-fixtures | |
| # Reports rather than blocks. A refresh that fails here would leave the | |
| # fixtures stale and open no PR at all, and most findings are transitive | |
| # and unfixable from this repo. Putting the table in the PR body is what | |
| # makes a new advisory visible, since nobody finds one by reading a | |
| # few-thousand-line lockfile diff. | |
| - name: Audit fixture dependencies | |
| id: audit | |
| run: | | |
| bun run e2e:audit-fixtures > audit-report.md | |
| { | |
| echo 'report<<EOF_AUDIT_REPORT' | |
| cat audit-report.md | |
| echo 'EOF_AUDIT_REPORT' | |
| } >> "$GITHUB_OUTPUT" | |
| cat audit-report.md >> "$GITHUB_STEP_SUMMARY" | |
| rm audit-report.md | |
| - name: Create or update pull request | |
| # Pinned to v8.1.0 by SHA because this step handles the CLERK_COOKIE_PAT. | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| token: ${{ secrets.CLERK_COOKIE_PAT }} | |
| branch: chore/refresh-e2e-fixtures | |
| base: main | |
| commit-message: "chore(test): refresh e2e fixtures" | |
| title: "chore(test): refresh e2e fixtures" | |
| body: | | |
| Automated refresh of E2E test fixtures via the `refresh-fixtures` workflow. | |
| Generated by `bun run e2e:refresh-fixtures`. Review the diff for any | |
| unexpected framework changes (especially major version bumps in | |
| upstream scaffolders) before merging. | |
| ## Dependency audit | |
| ${{ steps.audit.outputs.report }} | |
| Reproduce locally with `bun run e2e:audit-fixtures`. Fixtures are | |
| throwaway scaffolded apps, so an advisory here is not shipped risk — | |
| but a new entry means an upstream scaffolder started resolving to a | |
| vulnerable release, which is worth understanding before merging. | |
| Triggered by: ${{ github.event_name }} on ${{ github.ref }} | |
| labels: | | |
| automated |