[glaziermag]

Description

Adds an update-yarn-lock job to cd.yml that runs after publish-npm. It checks out the default branch, runs yarn install --mode=update-lockfile in npm/git-cliff, and opens a pull request with the regenerated yarn.lock (via peter-evans/create-pull-request, SHA-pinned like the other actions). RELEASE.md gets the matching step.

Motivation and Context

release.sh bumps the optionalDependencies in npm/git-cliff/package.json, but yarn.lock cannot be regenerated at that point: the platform packages only exist on npm once cd.yml has published them. Since the v2.14.0 release commit (94b313a, 2026-09-01) yarn.lock still pins git-cliff-*@2.13.1 while package.json says 2.14.2, so the immutable yarn install in the Check NodeJS tarball job has failed on every main run since (17 runs; latest https://github.com/orhun/git-cliff/actions/runs/35479961040: YN0028: The lockfile would have been modified by this install, which is explicitly forbidden.). Releases themselves are unaffected because publish-npm sets YARN_ENABLE_IMMUTABLE_INSTALLS: false.

This is the approach agreed in #1266 ("I'd be fine to update the lock file after the release and automate that with a PR workflow (triggered by the cd workflow)"). Closes #1266.

Two things to know:

• The repository setting "Allow GitHub Actions to create and approve pull requests" (Settings → Actions → General → Workflow permissions) has to be enabled once. Without it the step fails with GitHub Actions is not permitted to create or approve pull requests (fork run https://github.com/glaziermag/git-cliff/actions/runs/36051427711).
• Pull requests opened with GITHUB_TOKEN do not trigger CI (GitHub restriction). Closing and reopening the PR runs it, or a PAT can be passed through the action's token: input.

How Has This Been Tested?

• Locally at 60e0be9 with the repository's own Yarn 4.1.0: CI=true yarn install in npm/git-cliff exits 1 with YN0028 (six platform packages 2.13.1 → 2.14.2). yarn install --mode=update-lockfile with immutable installs off changes yarn.lock by +24/−24 lines, after which the immutable install passes.
• On a fork, the same job on workflow_dispatch: run https://github.com/glaziermag/git-cliff/actions/runs/36051572003 opened chore(npm): update yarn.lock for main glaziermag/git-cliff#1, touching only npm/git-cliff/yarn.lock (+24/−24).

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation (no code change)
• Refactor (refactoring production code)
• Other

Checklist:

• My code follows the code style of this project (SHA-pinned actions with version comments, ubuntu-22.04, Node 18, as in the sibling jobs).
• I have updated the documentation accordingly (if applicable).
• rustfmt / clippy / cargo test: not applicable, no Rust changes.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.21%. Comparing base (60e0be9) to head (4a60acb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1648   +/-   ##
=======================================
  Coverage   53.21%   53.21%           
=======================================
  Files          28       28           
  Lines        2633     2633           
=======================================
  Hits         1401     1401           
  Misses       1232     1232           

Flag	Coverage Δ
unit-tests	53.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[orhun]

LGTM

[welcome]

Congrats on merging your first pull request! ⛰️