docs/.github/workflows/package-lock-lint.yml at main · basiclines/docs · GitHub

View runs

History

63 lines (51 loc) · 2.38 KB

Raw

name: Package lock lint

# **What it does**: Makes sure package.json and package-lock.json is in sync

# **Why we have it**: Accidental manual edits of the dependencies directly in package.json

# **Who does it impact**: Docs engineering/writers/contributors.

on:

pull_request:

paths:

- package.json

- package-lock.json

- .github/workflows/package-lock-lint.yml

permissions:

contents: read

# This allows a subsequently queued workflow run to interrupt previous runs

concurrency:

group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'

cancel-in-progress: true

jobs:

lint:

runs-on: ubuntu-latest

if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

steps:

- name: Check out repo

uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

- name: Setup Node.js

uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0

with:

node-version-file: 'package.json'

cache: npm

- name: Run check

run: |

npm --version

# Save the current top-level dependencies from package-lock.json

node -e "console.log(JSON.stringify(require('./package-lock.json').packages['']))" > /tmp/before.json

# From https://docs.npmjs.com/cli/v7/commands/npm-install

# The --package-lock-only argument will only update the

# package-lock.json, instead of checking node_modules and

# downloading dependencies.

npm install --package-lock-only --ignore-scripts --include=optional

# Extract the top-level dependencies after regeneration

node -e "console.log(JSON.stringify(require('./package-lock.json').packages['']))" > /tmp/after.json

# Compare only the top-level package dependencies

# This ignores platform-specific differences in nested dependency resolution

# (like "peer" flags) that don't affect actual installed versions

if ! diff /tmp/before.json /tmp/after.json; then

echo "ERROR: Top-level dependencies in package-lock.json are out of sync with package.json"

echo "Please run 'npm install' locally and commit the updated package-lock.json"

exit 1

echo "✓ Top-level dependencies are in sync"

docs/.github/workflows/package-lock-lint.yml at main · basiclines/docs · GitHub

Expand file tree

Breadcrumbs

package-lock-lint.yml

Latest commit

History

Breadcrumbs

package-lock-lint.yml

File metadata and controls