Skip to content

refactor: Enhance lockfile regeneration logic to handle project-speci… #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Harsh-Microsoft merged 1 commit into from
Jul 18, 2025
Merged

refactor: Enhance lockfile regeneration logic to handle project-speci… #24

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 26 additions & 16 deletions .github/workflows/group-dependabot-security-updates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,28 +223,38 @@ jobs:

case "$group_name" in
frontend)
if [ -f "package.json" ]; then
# If a yarn.lock file exists, we treat it as a yarn project.
if [ -f "yarn.lock" ]; then
echo "Found yarn.lock, running 'yarn install' to regenerate lockfile."
yarn install --ignore-scripts
git add package.json yarn.lock
# Find the package.json that was conflicted to determine the directory.
# We assume only one package.json gets conflicted per cherry-pick for a single project.
pkg_json_path=$(echo "$manifest_files_conflicted" | grep "package.json" | head -n1)
if [ -n "$pkg_json_path" ]; then
project_dir=$(dirname "$pkg_json_path")
echo "Regenerating lockfile in directory: $project_dir"

# If a yarn.lock file exists in that directory, we treat it as a yarn project.
if [ -f "$project_dir/yarn.lock" ]; then
echo "Found yarn.lock, running 'yarn install'."
# Run yarn install from the project's directory
(cd "$project_dir" && yarn install --ignore-scripts)
# Add the regenerated lockfile to resolve its conflict
git add "$project_dir/yarn.lock"
# Otherwise, we fall back to npm.
else
echo "No yarn.lock found. Running 'npm install' to regenerate lockfile."
npm install --ignore-scripts
git add package.json
# Add package-lock.json only if it exists.
if [ -f "package-lock.json" ]; then
git add package-lock.json
fi
echo "No yarn.lock found. Running 'npm install'."
# Run npm install from the project's directory
(cd "$project_dir" && npm install --ignore-scripts)
# Add the regenerated lockfile to resolve its conflict
git add "$project_dir/package-lock.json"
fi
fi
;;
backend)
echo "Running 'pip install' to update dependencies."
pip install -r src/App/requirements.txt
git add src/App/requirements.txt
# For python, find the requirements file that was conflicted.
req_file_path=$(echo "$manifest_files_conflicted" | grep "requirements.txt" | head -n1)
if [ -n "$req_file_path" ]; then
echo "Running 'pip install' for '$req_file_path' to ensure consistency."
pip install -r "$req_file_path"
# The requirements file itself was already staged in the merge loop.
fi
;;
esac

Expand Down