[Issue #612] Dependabot and catalog dependency update automation by bryan-thompsoncodes · Pull Request #647 · HHS/simpler-grants-protocol

bryan-thompsoncodes · 2026-03-31T22:25:14Z

Summary

Fixes [Security] SPIKE: Research setting up automated dependency updates #612
Time to review: 15 minutes

Changes proposed

Implements a split dependency update strategy (builds on the ci scripts and ci-catalog-validation.yml workflow from #658):

Dependabot for non-catalog deps (templates, examples, Python SDK, GitHub Actions) via .github/dependabot.yml with 8 ecosystem entries, grouped updates, and staggered schedules. Root workspace runs daily; templates and Actions run weekly/monthly.
Scheduled GitHub Action for catalog-managed deps (@typespec/*, vitest, @types/node) via deps-catalog-check.yml — runs weekly, opens PRs via peter-evans/create-pull-request. The update script parses catalog deps directly from pnpm-workspace.yaml (no hardcoded list to maintain).

Also adds:

lib/changelog-emitter to .changeset/config.json (was missing from changeset tracking)
dependencies label to .github/labeler.yml for auto-labeling dependency PRs
DEPENDENCY_MANAGEMENT.md documenting the full strategy
Reviewer checklist items for website and SDK validation on catalog update PRs
Lockfile update to patch vite and defu audit vulnerabilities

Context for reviewers

Why two systems? Dependabot has 5 open bugs with pnpm workspace catalogs that corrupt the lockfile. Since all 15 CI workflows use --frozen-lockfile, any catalog corruption fails CI. The scheduled workflow avoids this by running pnpm update + pnpm install directly, producing a clean lockfile.

Why no auto-changeset? GITHUB_TOKEN cannot push to Dependabot branches (read-only since Dec 2021). Since only lib/cli and lib/ts-sdk have production deps that would need changesets, and those change infrequently, manual changeset creation on those rare PRs is simpler than a PAT or two-workflow workaround.

Testing: The catalog update script was tested locally (--dry-run mode). Workflow YAML can only be validated post-merge by triggering deps-catalog-check via workflow_dispatch and watching for initial Dependabot PRs.

Post-merge validation plan:

Trigger deps-catalog-check manually via Actions tab
Verify Dependabot creates PRs for templates/examples but NOT for catalog deps
Verify ci-catalog-validation triggers when pnpm-workspace.yaml changes

Additional information

See DEPENDENCY_MANAGEMENT.md for the full strategy docs. When adding a new catalog dep, only two places need updating: pnpm-workspace.yaml and the Dependabot ignore list. The update script reads from the YAML directly.

When dependabot-core fixes the catalog bugs, the scheduled workflow can be removed and all deps moved back to Dependabot. The split is a workaround, not a permanent design.

widal001 · 2026-04-01T12:59:12Z

@bryan-thompsoncodes Building on the stack diff conversation yesterday, would it be possible to stack this on a smaller PR that simply creates a new placeholder GitHub action, so that way we can test test the full workflow, including the action, on the branch?

.github/workflows/ci-catalog-validation.yml

bryan-thompsoncodes · 2026-04-01T22:58:25Z

Really appreciate the feedback, @widal001 both suggestions made this a lot cleaner. Added per-package ci scripts and root-level ci:core, ci:cli, ci:sdk, ci:changelog-emitter, ci:website shortcuts plus an aggregate ci that runs them all in dependency order.

Also split into a stacked PR per your suggestion: #658 is the base with the ci scripts + workflow, this PR is rebased on top. We'll want to review and merge #658 first, then this one.

…ies label - Create .github/dependabot.yml with 8 ecosystem entries across 3 worlds (root workspace, isolated templates/examples, GitHub Actions) - Root workspace ignores catalog-managed deps to avoid dependabot-core bugs - Add lib/changelog-emitter to .changeset/config.json packages array - Add dependencies label to .github/labeler.yml for auto-labeling dep PRs Ref: #612

- Create .github/scripts/update-catalog-deps.sh for updating pnpm catalog deps with --dry-run support (avoids dependabot-core catalog bugs) - Create deps-catalog-check.yml scheduled workflow (weekly Monday 7am PT) that opens PRs via peter-evans/create-pull-request when catalog deps are stale - Create ci-catalog-validation.yml that validates all workspace packages when pnpm-workspace.yaml changes (catches peerDep breakage) Ref: #612

Document the split strategy (Dependabot + catalog workflow), changeset expectations, three-place sync for catalog deps, troubleshooting, and known upstream issues. Ref: #612

- Fix bug: add explicit pnpm update for website catalog vitest (^4.x) - Fix fragile string parsing: use pnpm outdated exit code instead of grep for 'All packages are up to date' - Add self-trigger: ci-catalog-validation.yml now triggers on its own file changes (matches existing CI patterns) - Document major version bump behavior in DEPENDENCY_MANAGEMENT.md Ref: #612

…heck

…ance

…g check

The ci-catalog-validation workflow now handles lockfile changes by running all package checks. Removing the duplicate trigger from individual workflows prevents running each package's CI twice.

jcrichlake · 2026-04-03T13:33:35Z

.github/scripts/update-catalog-deps.sh

+# IMPORTANT: Must match the `catalog:` section in pnpm-workspace.yaml.
+# The validation below will fail if they drift apart.
+DEFAULT_CATALOG_DEPS=(
+  "@types/node"


Is there a way to refactor this script so that when we add a dependency we don't have to remember to update this script as well?

Done ✅ the script now parses catalog deps directly from pnpm-workspace.yaml instead of maintaining a hardcoded list. I also added a CI check in ci-catalog-validation.yml that validates every catalog dep has a matching Dependabot ignore entry, so if someone adds a dep to the catalog but forgets dependabot.yml, the PR fails.

jcrichlake · 2026-04-03T13:40:26Z

.github/workflows/deps-catalog-check.yml

+            - [ ] CI passes (catalog validation runs all workspace package checks)
+            - [ ] If TypeSpec packages updated: verify `pnpm run typespec` output is sensible
+            - [ ] If this is a **major** version bump: review changelog of updated packages
+            - [ ] Add changeset if peerDep ranges changed for `@common-grants/core` or `typespec-versioning-changelog`


Should we add a checklist item for general validation? Like if it's the website be sure to validate the pages or ensure that the SDKs work as expected

Good call, I added two items: "If website deps updated: spot-check key pages render correctly" and "If SDK-affecting deps updated: verify SDK examples still work."

jcrichlake · 2026-04-03T13:42:16Z

.github/dependabot.yml

+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"


Should we perhaps run this daily? Or instead have a way to manually kick off this flow in the case that we have an urgent update that needs resolved?

Yes to both, I'll adjust to daily and add the manual trigger

Changed to daily. The catalog workflow deps-catalog-check.yml already supports workflow_dispatch for manual runs from the Actions tab.

.github/dependabot.yml

jcrichlake · 2026-04-03T13:48:36Z

Left a few questions/comments. Overall it looks really good!

…, reviewer checklist

github-actions · 2026-04-06T22:36:11Z

🚀 Website Preview Deployed!

Preview your changes at: https://cg-pr-647.billy-daly.workers.dev

This preview will be automatically deleted when the PR is closed.

bryan-thompsoncodes · 2026-04-06T22:50:36Z

Thank you for the review @jcrichlake I implemented some adjustments to incorporate your feedback

widal001 reviewed Apr 1, 2026

View reviewed changes

.github/workflows/ci-catalog-validation.yml Outdated Show resolved Hide resolved

bryan-thompsoncodes mentioned this pull request Apr 1, 2026

[Issue #612] Add per-package ci scripts and workspace validation workflow #658

Merged

bryan-thompsoncodes force-pushed the 612-dependabot-and-catalog-update-automation branch from 436eef6 to 6998232 Compare April 1, 2026 22:44

bryan-thompsoncodes changed the base branch from main to 612-ci-workspace-scripts April 1, 2026 22:45

bryan-thompsoncodes force-pushed the 612-dependabot-and-catalog-update-automation branch 3 times, most recently from 74e6e0a to 9bf65e3 Compare April 1, 2026 23:46

Base automatically changed from 612-ci-workspace-scripts to main April 2, 2026 19:31

bryan-thompsoncodes changed the title ~~Set up Dependabot and catalog dependency update automation~~ [Issue #612] Set up Dependabot and catalog dependency update automation Apr 2, 2026

bryan-thompsoncodes added 9 commits April 2, 2026 12:41

Add dependency management documentation

4cd4a29

Document the split strategy (Dependabot + catalog workflow), changeset expectations, three-place sync for catalog deps, troubleshooting, and known upstream issues. Ref: #612

Add audit step to catalog validation, fix cron schedule comment

1e61246

fix: audit level, website vitest gate, website tests, catalog drift c…

188a8ef

…heck

Fix review findings: exit code signaling, docs accuracy, removal guid…

c96117e

…ance

Document YAML parser assumptions, add workflow_call trigger to catalo…

b5b2810

…g check

Remove pnpm-lock.yaml trigger from individual lib workflows

53c97b2

The ci-catalog-validation workflow now handles lockfile changes by running all package checks. Removing the duplicate trigger from individual workflows prevents running each package's CI twice.

bryan-thompsoncodes force-pushed the 612-dependabot-and-catalog-update-automation branch from dfd981f to 53c97b2 Compare April 2, 2026 19:42

bryan-thompsoncodes added 3 commits April 2, 2026 12:50

Clarify exit code semantics for dry-run mode

292c842

Fix workflow self-trigger path in ci-lib-changelog-emitter

c77fa14

fix: use actions v6 and node 22.x in deps-catalog-check workflow

6184607

bryan-thompsoncodes added 2 commits April 2, 2026 13:50

fix: bump pnpm/action-setup to v5 in deps-catalog-check workflow

846875b

Distinguish pnpm outdated failures from outdated-deps exit code

47bda9b

bryan-thompsoncodes changed the title ~~[Issue #612] Set up Dependabot and catalog dependency update automation~~ [Issue #612] Dependabot and catalog dependency update automation Apr 2, 2026

fix: clarify catalog workflow schedule with UTC time

7edeaa3

bryan-thompsoncodes marked this pull request as ready for review April 2, 2026 21:05

bryan-thompsoncodes requested review from jcrichlake and widal001 April 2, 2026 21:05

jcrichlake reviewed Apr 3, 2026

View reviewed changes

.github/dependabot.yml Show resolved Hide resolved

bryan-thompsoncodes added 2 commits April 6, 2026 15:28

Address PR review feedback: auto-parse catalog deps, daily Dependabot…

d602177

…, reviewer checklist

Fix vite/defu audit vulnerabilities and trim script comments

5ef8a98

Add CI validation for catalog deps in Dependabot ignore list

1e3f5f4

bryan-thompsoncodes requested a review from jcrichlake April 6, 2026 22:50

Conversation

bryan-thompsoncodes commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes proposed

Context for reviewers

Additional information

Uh oh!

widal001 commented Apr 1, 2026

Uh oh!

Uh oh!

bryan-thompsoncodes commented Apr 1, 2026

Uh oh!

jcrichlake Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

bryan-thompsoncodes Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

jcrichlake Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

bryan-thompsoncodes Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

jcrichlake Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

bryan-thompsoncodes Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

bryan-thompsoncodes Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jcrichlake commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bryan-thompsoncodes commented Apr 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bryan-thompsoncodes commented Mar 31, 2026 •

edited

Loading

github-actions bot commented Apr 6, 2026 •

edited

Loading