From 526021550f274558b7306167ee6ea7b37e798a53 Mon Sep 17 00:00:00 2001 From: mmeest Date: Mon, 7 Sep 2026 09:52:36 +0300 Subject: [PATCH 1/4] Ensure PR CI uses lockfile Node version and add automerge. Co-authored-by: Cursor --- .github/workflows/auto-approve-merge-bot.yml | 88 ++++++++++++++++++++ .github/workflows/node.yml | 44 +++++----- .nvmrc | 1 + 3 files changed, 110 insertions(+), 23 deletions(-) create mode 100644 .github/workflows/auto-approve-merge-bot.yml create mode 100644 .nvmrc diff --git a/.github/workflows/auto-approve-merge-bot.yml b/.github/workflows/auto-approve-merge-bot.yml new file mode 100644 index 0000000..f7fd86e --- /dev/null +++ b/.github/workflows/auto-approve-merge-bot.yml @@ -0,0 +1,88 @@ +name: Auto approve & merge Dependabot and Renovate PRs + +on: + pull_request: + types: [opened, edited, synchronize, reopened, labeled] + branches: [master] + +permissions: + contents: write + pull-requests: write + +jobs: + auto-approve-merge: + runs-on: ubuntu-latest + if: > + github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.user.login == 'dependabot' || + github.event.pull_request.user.login == 'renovate[bot]' || + github.event.pull_request.user.login == 'renovate' + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Auto approve PR + uses: hmarr/auto-approve-action@v3 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Fetch Dependabot metadata + if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'dependabot' + id: metadata + uses: dependabot/fetch-metadata@v2 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Check if PR should be auto-merged + id: check_auto_merge + env: + UPDATE_TYPE: ${{ steps.metadata.outputs['update-type'] }} + ACTOR: ${{ github.event.pull_request.user.login }} + LABELS: ${{ toJson(github.event.pull_request.labels) }} + run: | + UPDATE_TYPE="${UPDATE_TYPE:-unknown}" + + if [ "$ACTOR" == "dependabot[bot]" ] || [ "$ACTOR" == "dependabot" ]; then + if [[ "$UPDATE_TYPE" == "version-update:semver-patch" || "$UPDATE_TYPE" == "version-update:semver-minor" ]]; then + echo "auto_merge=true" >> $GITHUB_OUTPUT + else + echo "auto_merge=false" >> $GITHUB_OUTPUT + fi + elif [ "$ACTOR" == "renovate[bot]" ] || [ "$ACTOR" == "renovate" ]; then + LABEL_NAMES=$(echo "$LABELS" | jq -r '.[].name' | tr '\n' ' ') + if [[ "$LABEL_NAMES" == *"patch"* ]] || [[ "$LABEL_NAMES" == *"minor"* ]]; then + echo "auto_merge=true" >> $GITHUB_OUTPUT + else + echo "auto_merge=false" >> $GITHUB_OUTPUT + fi + else + echo "auto_merge=false" >> $GITHUB_OUTPUT + fi + shell: bash + + - name: Wait for CI checks + if: steps.check_auto_merge.outputs.auto_merge == 'true' + timeout-minutes: 45 + uses: lewagon/wait-on-check-action@v1.9.1 + with: + ref: ${{ github.event.pull_request.head.sha }} + repo-token: ${{ secrets.GITHUB_TOKEN }} + wait-interval: 30 + running-workflow-name: 'auto-approve-merge' + ignore-checks: | + sync + renovate/artifacts + + - name: Enable GitHub auto-merge + if: steps.check_auto_merge.outputs.auto_merge == 'true' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + echo "Enabling GitHub auto-merge for PR #$PR_NUMBER" + if gh pr merge --auto --merge "$PR_NUMBER"; then + echo "GitHub auto-merge enabled" + exit 0 + fi + echo "Native auto-merge unavailable; merging after green CI" + gh pr merge --merge "$PR_NUMBER" diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index 57020d7..32a2c29 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -1,25 +1,15 @@ name: Node.js CI -on: [push] +on: + push: + branches: [master] + pull_request: jobs: build: - runs-on: ubuntu-latest - container: - image: node:22-bookworm - - strategy: - matrix: - node-version: [22.x] steps: - # Install essential packages first - - name: Install essential packages - run: | - apt-get update - apt-get install -y git curl xz-utils - - uses: actions/checkout@v4 with: persist-credentials: false @@ -28,19 +18,27 @@ jobs: run: > git config --global url."https://github.com/".insteadOf ssh://git@github.com/ - - name: Mark workspace as safe for git - run: | - git config --global --add safe.directory "$GITHUB_WORKSPACE" - - - name: Use Node.js ${{ matrix.node-version }} + - name: Use Node.js from .nvmrc uses: actions/setup-node@v4 with: - node-version: ${{ matrix.node-version }} + node-version-file: '.nvmrc' + cache: 'npm' - - name: Install dependencies + - name: Verify dependencies match this PR lockfile run: | - npm ci - npm install @rollup/rollup-linux-x64-gnu + expected=$(grep -Eo '[0-9]+' .nvmrc | head -1) + actual=$(node -p "process.versions.node.split('.')[0]") + echo "Node from .nvmrc: $expected" + echo "Installed Node major: $actual" + test "$actual" = "$expected" + npm ci --include=optional + echo "Installed packages from this PR package-lock.json:" + npm ls --depth=0 --omit=dev || true + if [ "${{ github.event_name }}" = "pull_request" ]; then + git fetch --depth=1 origin "${{ github.base_ref }}" + echo "package-lock.json changes vs ${{ github.base_ref }}:" + git diff "origin/${{ github.base_ref }}" -- package-lock.json package.json || true + fi - run: npm run build diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 0000000..2bd5a0a --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +22 From dfc3e950b2a38724110ba265148709ab0bae63d4 Mon Sep 17 00:00:00 2001 From: mmeest Date: Mon, 7 Sep 2026 10:09:59 +0300 Subject: [PATCH 2/4] Install Rollup Linux binary from this PR's lockfile in CI. Co-authored-by: Cursor --- .github/workflows/node.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index 32a2c29..34f1ef1 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -32,6 +32,8 @@ jobs: echo "Installed Node major: $actual" test "$actual" = "$expected" npm ci --include=optional + ROLLUP_LINUX=$(node -p "require('./node_modules/rollup/package.json').optionalDependencies['@rollup/rollup-linux-x64-gnu']") + npm install --no-save --no-package-lock "@rollup/rollup-linux-x64-gnu@${ROLLUP_LINUX}" echo "Installed packages from this PR package-lock.json:" npm ls --depth=0 --omit=dev || true if [ "${{ github.event_name }}" = "pull_request" ]; then From fa34b877d3c6464278582df086d609f55bfb0947 Mon Sep 17 00:00:00 2001 From: mmeest Date: Mon, 7 Sep 2026 10:24:00 +0300 Subject: [PATCH 3/4] Read CI test credentials from GitHub Actions secrets. Co-authored-by: Cursor --- .github/workflows/node.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index 34f1ef1..c1db481 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -51,15 +51,15 @@ jobs: VITE_SERVER_PORT: 5000 API_HOST: https://testrant.internet.ee PUBLIC_API_HOST: https://www.internet.ee - PUBLIC_API_KEY: 4395743059dsfksdfyds8f7334 + PUBLIC_API_KEY: ${{ secrets.PUBLIC_API_KEY }} CLIENT_ID: eis_client_test - CLIENT_SECRET: secret12345 + CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }} ISSUER_URL: https://tara-test.ria.ee TOKEN_PATH: /oidc/token JWKS_PATH: /oidc/jwks AUTH_PATH: /oidc/authorize REDIRECT_URL: /auth/callback - SESSION_SECRET: secret555555 + SESSION_SECRET: ${{ secrets.SESSION_SECRET }} HTTPS: true run: npm run coverage -- --coverage.reporter=lcov From b87ef634ad3a1a1933accd50c2f51daf5c2c43f6 Mon Sep 17 00:00:00 2001 From: mmeest Date: Mon, 7 Sep 2026 12:04:00 +0300 Subject: [PATCH 4/4] Bump GitHub Actions to Node 24 runtimes. Co-authored-by: Cursor --- .github/workflows/auto-approve-merge-bot.yml | 2 +- .github/workflows/deploy-pr-staging.yml | 2 +- .github/workflows/node.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/auto-approve-merge-bot.yml b/.github/workflows/auto-approve-merge-bot.yml index f7fd86e..5e901e2 100644 --- a/.github/workflows/auto-approve-merge-bot.yml +++ b/.github/workflows/auto-approve-merge-bot.yml @@ -19,7 +19,7 @@ jobs: github.event.pull_request.user.login == 'renovate' steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Auto approve PR uses: hmarr/auto-approve-action@v3 diff --git a/.github/workflows/deploy-pr-staging.yml b/.github/workflows/deploy-pr-staging.yml index cac8969..cfe45d2 100644 --- a/.github/workflows/deploy-pr-staging.yml +++ b/.github/workflows/deploy-pr-staging.yml @@ -40,7 +40,7 @@ jobs: fi - name: ⬇️ Checkout application code - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ inputs.deploy_target == 'master' && 'master' || format('refs/pull/{0}/merge', inputs.pr_number) }} diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index c1db481..b9c34b2 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: persist-credentials: false @@ -19,7 +19,7 @@ jobs: git config --global url."https://github.com/".insteadOf ssh://git@github.com/ - name: Use Node.js from .nvmrc - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version-file: '.nvmrc' cache: 'npm'