From a09656ced1968d1b411d030fba3298a8a7fc1ece Mon Sep 17 00:00:00 2001 From: planadecu Date: Sat, 10 Oct 2026 01:31:11 +0200 Subject: [PATCH 1/2] ci: exempt Dependabot PRs from the version-bump check --- .github/workflows/ci.yml | 4 +++- CHANGELOG.md | 5 +++++ CLAUDE.md | 4 ++-- CONTRIBUTING.md | 5 +++++ package.json | 2 +- scripts/check-changelog-heading.mjs | 9 +++++++-- test/release-scripts.spec.ts | 21 ++++++++++++++++++++- 7 files changed, 43 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a869afa..b00abdd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,11 +40,13 @@ jobs: # The top CHANGELOG.md heading must be exactly `## ` (publish.yml takes # the GitHub Release notes from that line). Into release/** a `## (unreleased)` # heading is accepted too. The target is the PR's base branch, or the pushed branch (main) - # when publish.yml calls this. + # when publish.yml calls this. Dependabot PRs (identified by the PR author, which only + # Dependabot can be, not the branch name) skip the version bump and ship with the next release. - name: Check the CHANGELOG.md heading env: TARGET_BRANCH: ${{ github.base_ref || github.ref_name }} BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || '' }} + PR_AUTHOR: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login || '' }} run: node scripts/check-changelog-heading.mjs # pnpm-workspace.yaml enforces the build allowlist and the 7-day release-age cooldown. - run: pnpm install --frozen-lockfile diff --git a/CHANGELOG.md b/CHANGELOG.md index 1934e1b..a023114 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to `glassnode-terminal` are documented here. The project fol [semver](https://semver.org/); see [CONTRIBUTING.md](./CONTRIBUTING.md) for how versions and this file are updated. +## 0.2.5 + +- CI no longer requires a version bump on Dependabot PRs: their dependency updates merge without + publishing and ship with the next release. + ## 0.2.4 - Add repository owners in `CODEOWNERS` so GitHub can request ownership reviews automatically. diff --git a/CLAUDE.md b/CLAUDE.md index 6d18558..e9259bf 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -67,7 +67,7 @@ Interactive TUI (Terminal User Interface) for Glassnode on-chain crypto data, bu Follow [semver](https://semver.org/) (major: breaking for users — removed flags/env vars, changed defaults, higher Node floor; minor: new features; patch: fixes, docs, dependency bumps, refactors). -**Every change** (except PRs into `release/**` branches, which still add a CHANGELOG entry) MUST: +**Every change** (except PRs into `release/**` branches, which still add a CHANGELOG entry, and Dependabot PRs, which ship with the next release) MUST: 1. Bump `version` in `package.json` 2. Add a `## ` entry at the top of `CHANGELOG.md` @@ -76,7 +76,7 @@ The `version` in `package.json` is exactly what gets published: CI never bumps i ## CI -- `.github/workflows/ci.yml` runs on PRs into `main` and `release/**`, and `publish.yml` calls it (`workflow_call`) as its `verify` job: the CHANGELOG heading check (`scripts/check-changelog-heading.mjs`: the top heading must be exactly `## `; into `release/**`, `## (unreleased)` is also accepted), install, build, tests and a CLI smoke test, on Node 22 and 24 (`test (22)`, `test (24)` are the required checks). PRs into `main` additionally require a version greater than the base commit (`BASE_SHA`) and nonempty release notes. +- `.github/workflows/ci.yml` runs on PRs into `main` and `release/**`, and `publish.yml` calls it (`workflow_call`) as its `verify` job: the CHANGELOG heading check (`scripts/check-changelog-heading.mjs`: the top heading must be exactly `## `; into `release/**`, `## (unreleased)` is also accepted), install, build, tests and a CLI smoke test, on Node 22 and 24 (`test (22)`, `test (24)` are the required checks). PRs into `main` additionally require a version greater than the base commit (`BASE_SHA`) and nonempty release notes, except PRs authored by `dependabot[bot]` (`PR_AUTHOR`). - Every action is pinned by full commit SHA with a `# vX.Y.Z` comment, never a movable tag. To bump one, resolve the tag with `gh api repos///git/ref/tags/` (dereference an annotated tag with `gh api repos///git/tags/`), update SHA and comment together, and read the release notes. Dependabot proposes these updates. ## Publishing diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9bc1c97..ad6be34 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -61,6 +61,11 @@ For PRs into `main`, CI also compares the version with the exact PR base commit: greater, and its changelog section must contain release notes. Locally, set `BASE_SHA` to a base commit to run the same comparison. +**Dependabot PRs.** Dependabot cannot bump the version or write release notes, so CI skips the +version comparison for PRs opened by `dependabot[bot]` (the heading check still runs). Merging one +publishes nothing; the update ships with the next release, whose `CHANGELOG.md` entry should +mention it. For an urgent security fix, open a release PR right after merging. + **Release branches.** A large release can be prepared on a `release/**` branch. PRs into it carry no version bump but still add their `CHANGELOG.md` entry under a single `## (unreleased)` heading; the last PR bumps the version and renames the heading to diff --git a/package.json b/package.json index e8abe8e..e31eecf 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "glassnode-terminal", - "version": "0.2.4", + "version": "0.2.5", "description": "Interactive TUI for exploring Glassnode on-chain and market crypto data", "type": "module", "main": "dist/cli.js", diff --git a/scripts/check-changelog-heading.mjs b/scripts/check-changelog-heading.mjs index 587ec3e..6870593 100644 --- a/scripts/check-changelog-heading.mjs +++ b/scripts/check-changelog-heading.mjs @@ -11,7 +11,9 @@ // Usage: node scripts/check-changelog-heading.mjs [target-branch] // The target defaults to $TARGET_BRANCH, then `main`. Env CHANGELOG and PACKAGE_JSON override // the file paths (for tests). Exits 1 with a GitHub `::error::` annotation on failure. -// BASE_SHA enables PR version/notes checks against that commit's package.json. +// BASE_SHA enables PR version/notes checks against that commit's package.json. PR_AUTHOR +// `dependabot[bot]` skips them: Dependabot cannot bump the version or write release notes, so its +// dependency updates merge without publishing and ship with the next release. /* global process, console */ import { readFileSync } from 'node:fs'; import { execFileSync } from 'node:child_process'; @@ -46,7 +48,10 @@ console.log(`CHANGELOG.md heading "${heading}" is valid for a PR into ${target}. // PR CI supplies the exact base commit. Push/release runs and local heading checks omit it. // Release-branch PRs accumulate changes under an unreleased heading without a version bump. -if (process.env.BASE_SHA && !/^release\//.test(target)) { +const dependabot = process.env.PR_AUTHOR === 'dependabot[bot]'; +if (process.env.BASE_SHA && dependabot) { + console.log('Dependabot PR: version bump not required; the update ships with the next release.'); +} else if (process.env.BASE_SHA && !/^release\//.test(target)) { const base = JSON.parse(execFileSync('git', ['show', `${process.env.BASE_SHA}:package.json`], { encoding: 'utf8' })); if (!parseSemver(version) || !parseSemver(base.version) || compareSemver(version, base.version) <= 0) { console.error(`::error file=package.json::Version ${version} must be greater than base version ${base.version} for a PR into ${target}.`); diff --git a/test/release-scripts.spec.ts b/test/release-scripts.spec.ts index ec179a6..cc55be2 100644 --- a/test/release-scripts.spec.ts +++ b/test/release-scripts.spec.ts @@ -337,7 +337,7 @@ describe('release-state.sh (fake npm)', () => { }); describe('check-changelog-heading.mjs', () => { - function check(changelog: string, version: string, target: string, baseVersion?: string) { + function check(changelog: string, version: string, target: string, baseVersion?: string, prAuthor = '') { const dir = tempDir(); let baseSha = ''; if (baseVersion !== undefined) { @@ -360,6 +360,7 @@ describe('check-changelog-heading.mjs', () => { env: { ...process.env, BASE_SHA: baseSha, + PR_AUTHOR: prAuthor, CHANGELOG: join(dir, 'CHANGELOG.md'), PACKAGE_JSON: join(dir, 'package.json'), }, @@ -382,6 +383,24 @@ describe('check-changelog-heading.mjs', () => { expect(r.status, r.stderr).toBe(0); }); + it('lets Dependabot PRs keep the base version', () => { + const r = check(log('## 0.30.1'), '0.30.1', 'main', '0.30.1', 'dependabot[bot]'); + expect(r.status, r.stderr).toBe(0); + expect(r.stdout).toContain('version bump not required'); + }); + + it.each(['someone', 'dependabot'])('still requires a bump from PR author %s', (author) => { + const r = check(log('## 0.30.1'), '0.30.1', 'main', '0.30.1', author); + expect(r.status).toBe(1); + expect(r.stderr).toContain('must be greater than base version'); + }); + + it('still checks the changelog heading on Dependabot PRs', () => { + const r = check(log('## 0.30.2'), '0.30.1', 'main', '0.30.1', 'dependabot[bot]'); + expect(r.status).toBe(1); + expect(r.stderr).toMatch(/must be "## 0.30.1"/); + }); + it('rejects a bumped PR version with an empty release section', () => { const r = check('## 0.30.2\n\n## 0.30.1\n\n- old notes\n', '0.30.2', 'main', '0.30.1'); expect(r.status).toBe(1); From 59be6458d58ae4136128c936f05091b9ec3cd3ec Mon Sep 17 00:00:00 2001 From: planadecu Date: Sat, 10 Oct 2026 01:32:36 +0200 Subject: [PATCH 2/2] fix: raise source-map-js to 1.2.2 (GHSA-68fv-2mgg-jv7q) --- CHANGELOG.md | 2 ++ pnpm-lock.yaml | 9 +++++---- pnpm-workspace.yaml | 3 ++- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a023114..dd6949f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ file are updated. - CI no longer requires a version bump on Dependabot PRs: their dependency updates merge without publishing and ship with the next release. +- Raise the transitive dev dependency `source-map-js` to 1.2.2 (GHSA-68fv-2mgg-jv7q), which + Dependabot could not update in the pnpm lockfile. ## 0.2.4 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 68890fe..1538236 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: postcss: ^8.5.23 nanoid@3: ^3.3.18 + source-map-js: ^1.2.2 importers: @@ -1008,8 +1009,8 @@ packages: resolution: {integrity: sha512-aBY19bn/XA+hKOKX0qL7Z0UfdBsbQvc9hn993U8ALUjzxCvDcuZqLoRXjGJrUARWAlwMnsRVD9sw2AFNOYvalA==} engines: {node: '>=22'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} stack-utils@2.0.6: @@ -1899,7 +1900,7 @@ snapshots: dependencies: nanoid: 3.3.19 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 prebuild-install@7.1.3: dependencies: @@ -1990,7 +1991,7 @@ snapshots: ansi-styles: 6.2.3 is-fullwidth-code-point: 5.1.0 - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} stack-utils@2.0.6: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 353b4c9..8d1a4b9 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -19,7 +19,8 @@ minimumReleaseAgeExclude: # glassnode-api's x402 needs ^2.18.0 to complete x402Version-2 payments. - '@x402/*' -# Security floors for transitive dev deps (vitest > vite > postcss > nanoid). +# Security floors for transitive dev deps (vitest > vite > postcss > nanoid, source-map-js). overrides: postcss: ^8.5.23 nanoid@3: ^3.3.18 + source-map-js: ^1.2.2