@@ -13,13 +13,13 @@ jobs:
1313 contents : read
1414 runs-on : ubuntu-latest
1515 steps :
16- - name : Check Out
16+ - name : Checkout
1717 uses : actions/checkout@v6
1818
1919 - name : Enable Corepack
2020 run : corepack enable
2121
22- - name : Set up Node
22+ - name : Setup Node
2323 uses : actions/setup-node@v6
2424 with :
2525 cache : yarn
2929 run : |-
3030 npm -g install lerna npm-check-updates@^20
3131
32- name : List Mono-Repo Packages
32+ name : List Monorepo Packages
3333 id : monorepo-packages
3434 # These need to be ignored from the `ncu` runs!
3535 run : |-
@@ -75,31 +75,34 @@ jobs:
7575 # We special-case eslint-plugin-import because 26 is the last version that works for us.
7676 # We special-case glob because newer version don't support Node 18
7777 # We special-case @xmldom/xmldom because newer versions are not compatible with the code and jsii-rosetta 1.x is soon EOS
78+ # --cooldown=3 ignores package versions published in the last 3 days to reduce
79+ # the risk of pulling in newly published, potentially compromised packages.
80+ # This matches `npmMinimalAgeGate` in `.yarnrc.yml`.
7881 run : |-
7982 # Upgrade devDependencies at repository root
80- ncu --upgrade --target=minor --filter=@types/inquirer,@types/node,@jest/types,jest-config,jest-circus,eslint
81- ncu --upgrade --target=patch --filter=typescript
82- ncu --upgrade --target=latest --reject=@types/inquirer,@types/node,typescript,@jest/types,jest-config,jest-circus,eslint,eslint-plugin-import
83+ ncu --upgrade --cooldown=3 -- target=minor --filter=@types/inquirer,@types/node,@jest/types,jest-config,jest-circus,eslint
84+ ncu --upgrade --cooldown=3 -- target=patch --filter=typescript
85+ ncu --upgrade --cooldown=3 -- target=latest --reject=@types/inquirer,@types/node,typescript,@jest/types,jest-config,jest-circus,eslint,eslint-plugin-import
8386
8487 # Upgrade all production dependencies (and other always major-pinned dependencies)
85- lerna exec --parallel ncu -- --upgrade --target=minor \
88+ lerna exec --parallel ncu -- --upgrade --cooldown=3 -- target=minor \
8689 --filter='@types/diff,@types/fs-extra,${{ steps.production-dependencies.outputs.list }}' \
8790 --reject='typescript,@xmldom/xmldom,jsii,jsii-rosetta,${{ steps.monorepo-packages.outputs.list }}'
8891
8992 # Upgrade all minor-pinned dependencies
90- lerna exec --parallel ncu -- --upgrade --target=patch \
93+ lerna exec --parallel ncu -- --upgrade --cooldown=3 -- target=patch \
9194 --filter=typescript,@xmldom/xmldom
9295
9396 # Upgrade all other dependencies (devDependencies) to the latest
94- lerna exec --parallel ncu -- --upgrade --target=latest \
97+ lerna exec --parallel ncu -- --upgrade --cooldown=3 -- target=latest \
9598 --reject='@types/diff,@types/inquirer,@types/node,@types/fs-extra,@types/yargs,@xmldom/xmldom,glob,typescript,${{ steps.production-dependencies.outputs.list }},jsii,jsii-rosetta,${{ steps.monorepo-packages.outputs.list }}'
9699
97100# This will ensure the current lockfile is up-to-date with the dependency specifications (necessary for "yarn update" to run)
98101 - name : Run "yarn install"
99- run : yarn install
102+ run : yarn install --no-immutable
100103
101104 - name : Run "yarn up"
102- run : yarn up '*'
105+ run : yarn up -R '*'
103106
104107 # Next, create and upload the changes as a patch file. This will later be downloaded to create a pull request
105108 # Creating a pull request requires write permissions and it's best to keep write privileges isolated.
@@ -121,7 +124,7 @@ jobs:
121124 pull-requests : write
122125 runs-on : ubuntu-latest
123126 steps :
124- - name : Check Out
127+ - name : Checkout
125128 uses : actions/checkout@v6
126129
127130 - name : Download patch
@@ -131,7 +134,8 @@ jobs:
131134 path : ${{ runner.temp }}
132135
133136 - name : Apply patch
134- run : ' [ -s ${{ runner.temp }}/upgrade.patch ] && git apply ${{ runner.temp }}/upgrade.patch || echo "Empty patch. Skipping."'
137+ run : " [ -s ${{ runner.temp }}/upgrade.patch ] && git apply ${{ runner.temp
138+ }}/upgrade.patch || echo \" Empty patch. Skipping.\" "
135139
136140 - name : Make Pull Request
137141 uses : peter-evans/create-pull-request@v8
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?v=4&size=40){kind=avatar}
0 commit comments