Dependency Updates #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Updates | |
| on: | |
| schedule: | |
| - cron: '0 0 * * 1' # Run weekly on Mondays at midnight UTC | |
| workflow_dispatch: | |
| jobs: | |
| update-dependencies: | |
| name: Update Dependencies | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| service: [auth-service, payments-service, accounting-service, analytics-service, credit-engine, frontend] | |
| include: | |
| - service: auth-service | |
| path: backend/auth-service | |
| - service: payments-service | |
| path: backend/payments-service | |
| - service: accounting-service | |
| path: backend/accounting-service | |
| - service: analytics-service | |
| path: backend/analytics-service | |
| - service: credit-engine | |
| path: backend/credit-engine | |
| - service: frontend | |
| path: frontend | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: '16' | |
| - name: Update dependencies | |
| id: update | |
| run: | | |
| cd ${{ matrix.path }} | |
| # Check if there are outdated dependencies | |
| npm outdated --json > outdated.json | |
| # Update dependencies | |
| npm update | |
| # Check if package.json was modified | |
| git diff --exit-code package.json || echo "::set-output name=updated::true" | |
| - name: Run tests after update | |
| if: steps.update.outputs.updated == 'true' | |
| run: | | |
| cd ${{ matrix.path }} | |
| npm ci | |
| npm test | |
| - name: Create Pull Request | |
| if: steps.update.outputs.updated == 'true' | |
| uses: peter-evans/create-pull-request@v4 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| commit-message: "chore(deps): update dependencies for ${{ matrix.service }}" | |
| title: "chore(deps): update dependencies for ${{ matrix.service }}" | |
| body: | | |
| This PR updates dependencies for the ${{ matrix.service }} service. | |
| Updated dependencies: | |
| ``` | |
| $(cat ${{ matrix.path }}/outdated.json | jq -r 'to_entries | .[] | "\(.key): \(.value.current) -> \(.value.latest)"') | |
| ``` | |
| All tests are passing with the updated dependencies. | |
| branch: "deps-update-${{ matrix.service }}" | |
| base: "develop" | |
| labels: "dependencies,automated pr" | |
| update-github-actions: | |
| name: Update GitHub Actions | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Update GitHub Actions | |
| uses: renovatebot/github-action@v32.238.3 | |
| with: | |
| configurationFile: renovate.json | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Create Pull Request for GitHub Actions updates | |
| uses: peter-evans/create-pull-request@v4 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| commit-message: "chore(actions): update GitHub Actions" | |
| title: "chore(actions): update GitHub Actions" | |
| body: | | |
| This PR updates GitHub Actions to their latest versions. | |
| Updates were performed automatically by the Renovate bot. | |
| branch: "actions-update" | |
| base: "develop" | |
| labels: "dependencies,github actions,automated pr" | |
| security-updates: | |
| name: Security Updates | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: '16' | |
| - name: Run npm audit fix | |
| id: audit | |
| run: | | |
| # Check for vulnerabilities in all services | |
| SERVICES=("backend/auth-service" "backend/payments-service" "backend/accounting-service" "backend/analytics-service" "backend/credit-engine" "frontend") | |
| for service in "${SERVICES[@]}"; do | |
| cd $GITHUB_WORKSPACE/$service | |
| # Run npm audit and capture the output | |
| npm audit --json > audit_results.json | |
| # Check if there are vulnerabilities that can be fixed | |
| if [ $(cat audit_results.json | jq '.vulnerabilities | length') -gt 0 ]; then | |
| # Run npm audit fix | |
| npm audit fix | |
| # Check if package.json was modified | |
| git diff --exit-code package.json || echo "::set-output name=fixed::true" | |
| fi | |
| cd $GITHUB_WORKSPACE | |
| done | |
| - name: Create Pull Request for security fixes | |
| if: steps.audit.outputs.fixed == 'true' | |
| uses: peter-evans/create-pull-request@v4 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| commit-message: "fix(security): apply security updates" | |
| title: "fix(security): apply security updates" | |
| body: | | |
| This PR applies security updates to fix vulnerabilities in dependencies. | |
| These updates were automatically applied using `npm audit fix`. | |
| branch: "security-updates" | |
| base: "develop" | |
| labels: "security,dependencies,automated pr" |