The synced zizmor workflow reports cache-poisoning for the synced
golangci-lint workflow in every Go repository, because the workflow runs
on tag and release branch pushes and actions/setup-go caches by default.
zizmor here only scans .github/workflows, so it never checks
scripts/golangci-lint.yml.
Restoring the Go cache is acceptable in this workflow: its token is
read-only, it uses no secrets and it publishes nothing. Ignore the
finding for this step rather than disabling the cache. This differs from
the golangci job in ci.yml, which disables the cache since d5f79f751,
because that job runs in the same workflow as the publish jobs.
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
The react-app version bump was dropped in #18975 to work around
ERR_PNPM_VERSION_NOT_CHANGED, but the same error also fires from the
primary `pnpm -r` invocation when ui-bump-version is re-run for a
version that was already applied. Add --allow-same-version to both
pnpm version calls: it restores the react-app bump (which has since
had to be applied by hand for every 3.13.x patch release, and was
missed for 3.13.3) and makes the whole command idempotent.
Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
The test_go_oldest job pinned the golang-builder image tag by hand, which
had to be bumped on every Go release and was enforced by
scripts/check-go-mod-version.sh. Compute the oldest supported Go version
from https://go.dev/dl/?mode=json instead, and feed it to the job as a
single-row matrix, like list_lts_releases already does for LTS releases.
This also keeps CI green on the next Go minor release. With the version
pinned in the tree, upstream releasing a new minor makes the check fail on
every PR that is not on top of main, and each one has to be rebased on the
bump commit. Reading the version at runtime means every PR picks up the
new N-1 version on its own.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Avoid hardcoded go.mod list so that newly added modules
(e.g. compliance/go.mod) are picked up automatically.
Also handle go.work
Signed-off-by: Ayoub Mrini <ayoubmrini424@gmail.com>
Update all `github.com/prometheus/*` dependencies for
dependabot Go updates. Avoids rebases when updating several.
Signed-off-by: SuperQ <superq@gmail.com>
ALSO
ui: add pnpm dedupe to npm-deps update script
The move to pnpm (#18797) introduced strict dependency isolation.
When npm-check-updates bumps deps independently per workspace, pnpm
can resolve duplicate versions of the same package. This happened
with @codemirror/state (6.7.0 and 6.7.1) after running
`make update-npm-deps`, causing TypeScript build failures:
src/lint/hybrid.ts(23,33): error TS2345:
'import(".../@codemirror+state@6.7.0/...").EditorState'
is not assignable to
'import(".../@codemirror+state@6.7.1/...").EditorState'.
Types have separate declarations of a private property 'flags'.
npm avoided this by hoisting into a flat node_modules. Add
`pnpm dedupe` after `pnpm install` to collapse compatible duplicates.
Signed-off-by: Ayoub Mrini <ayoubmrini424@gmail.com>
push_branch unconditionally deleted the remote branch before pushing.
On the force-update path for an existing bot-only PR, deleting the
branch closes the PR on GitHub, so the PR was lost instead of updated.
Force-push in place on that path and keep the delete only for the
fresh-PR path.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
When a repo_sync PR is already open, the sync script skipped the repo
entirely, so the PR went stale whenever the source files changed again.
Now, if the open PR carries only the single bot commit, the branch is
rebuilt from the target default branch (staying current with the base)
and force-pushed, but only when the synced files actually differ from
the PR branch. PRs that a maintainer has committed to (more than one
commit) are left untouched.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
The scripts/dependabot.yml -> .github/dependabot.yml remapping was present
in the detection loop but missing from the copy loop, so downstream repos
received a stray scripts/dependabot.yml that Dependabot never reads while
.github/dependabot.yml was never created.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
check_no_sync received the fetched file contents but grepped them as a
filename, so the marker was never detected and repos opting out via
no_prometheus_repo_sync were synced anyway. Feed the contents on stdin
with a here-string, matching check_license, and log the filename instead
of the whole file body.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Add `.github/dependabot.yml` to the repo sync script.
* Sync is optional.
* Add feature to skip files that contain the string `no_prometheus_repo_sync`.
* Add generic dependabot config for Go and GitHub Actions ecosystems.
Signed-off-by: SuperQ <superq@gmail.com>
Derive the npm dist-tag from the Prometheus version (VERSION file) and
download.json so pre-releases and old patches never move the "latest"
tag: pre-releases publish under their channel (rc/beta/alpha/next), the
latest stable under "latest", the newest LTS under "lts", and older
stable or LTS patches under "oldstable". Fail the publish if
download.json cannot be fetched.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
checkPackage read each workspace package's version via `pnpm run env | grep
npm_package_version`, an npm-ism. pnpm has no built-in `env` script, so it
fails with ERR_PNPM_NO_SCRIPT and returns an empty string, making
`ui_release.sh --check-package` report a false version mismatch for every
package.
Read the version with `pnpm pkg get version` instead. Leftover from the
npm-to-pnpm migration (#18797).
Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
You get
[ERR_PNPM_VERSION_NOT_CHANGED] Version was not changed: 0.313.0-rc.0
error if you try.
Signed-off-by: György Krajcsovits <gyorgy.krajcsovits@grafana.com>
react-app is not part of the pnpm workspace, so it pulled
@prometheus-io/codemirror-promql from the npm registry by exact version.
During a release, `make ui-bump-version` rewrote that pin to the new,
not-yet-published version, so the subsequent `pnpm install` failed with
ERR_PNPM_NO_MATCHING_VERSION.
Use pnpm's "link:" protocol to consume the locally built workspace package
instead. There is no version to publish or rewrite, react-app always builds
against the in-tree codemirror-promql, and its lockfile stays isolated (which
is why react-app was separated from the workspace in the first place).
build_ui.sh --all already builds the modules before react-app, so dist/ is
present at build time; `make ui-build` passes. Drop the dependency-rewriting
sed from ui_release.sh's bumpVersion accordingly.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Set maintainer_can_modify on the create-pull-request API call so that
target-repo maintainers can push directly to the repo_sync branch from
the GitHub UI instead of only via the local checkout workaround.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Switch the UI workspace from npm to pnpm. Declare jest as a direct
devDependency in lezer-promql (pnpm's strict isolation requires every
binary to be an explicit dependency), fix the moduleNameMapper path in
codemirror-promql's jest config to reflect pnpm's per-package
node_modules layout, and add a localStorage mock to mantine-ui's test
setup so module-level Redux slice initializers work under Node.js v22+,
which pre-defines localStorage as undefined on globalThis.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
The check_license guard ran before target_file was fetched, so it always
tested the previous iteration's file content (CODE_OF_CONDUCT.md) instead
of the target repo's LICENSE. This caused the LICENSE file to be silently
skipped on every run regardless of the actual license.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Read the fork's actual full_name from the fork API response instead of
constructing it. Pass the fork full_name to post_pull_request so the checkout
hint uses the correct repo name.
Use newly-created scoped PROMBOT_REPOSYNC_TOKEN in the workflow.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Open the sync PRs from a prombot-owned fork instead of pushing the branch
to the upstream repo. The fork name is prefixed with the upstream org
(e.g. prometheus_node_exporter) so repos with the same name in
different orgs do not collide. The GitHub forks API is idempotent and
returns the existing fork on subsequent calls.
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Add a CI job to run govulncheck.
* Run daily.
* Run when touching go.{mod,sum}.on PRs and merge to the default branch.
* Cleanup unused / broken govulncheck in Makefile.common.
* Add status badge.
* Add to repo sync for all Go projects.
* Reduce green lines in sync script to make it easier to read the log.
Signed-off-by: SuperQ <superq@gmail.com>
Promote the Prometheus container archs settings to common so they
are used by default on other projects.
* Add `.dockerignore` to sync script to include docker archs.
Signed-off-by: SuperQ <superq@gmail.com>
Julien Pivotto