Copilot commented on code in PR #968:
URL: https://github.com/apache/fesod/pull/968#discussion_r3652274015
##########
.github/workflows/deploy-docs.yml:
##########
@@ -26,18 +26,18 @@ jobs:
if: github.repository == 'apache/fesod'
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
with:
fetch-depth: 0
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@v6
with:
- version: 10
+ version: 11
run_install: false
Review Comment:
`pnpm/action-setup` is configured with `version: 11`, but the repo declares
`packageManager: [email protected]` in `website/package.json`. Pinning to a floating
major can cause CI to run a different pnpm minor than developers, which can
affect lockfile compatibility. Prefer reading the version from
`website/package.json` (or pin the exact version).
##########
.github/workflows/preview-docs.yml:
##########
@@ -26,16 +26,19 @@ jobs:
deploy-preview:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - name: Checkout code
+ uses: actions/checkout@v5
- - uses: pnpm/action-setup@v4
+ - name: Setup pnpm
+ uses: pnpm/action-setup@v6
with:
- version: 10
+ version: 11
run_install: false
Review Comment:
`pnpm/action-setup` is pinned to `version: 11`, while `website/package.json`
declares `packageManager: [email protected]`. Using a floating major in CI can lead
to different pnpm minor versions than contributors use (and potentially
lockfile/behavior drift). Consider sourcing the pnpm version from
`website/package.json` instead.
##########
.github/workflows/ci-docs.yml:
##########
@@ -34,23 +34,23 @@ jobs:
uses: actions/checkout@v5
- name: Setup pnpm
- uses: pnpm/action-setup@v4
+ uses: pnpm/action-setup@v6
with:
- version: 10
+ version: 11
run_install: false
Review Comment:
CI installs pnpm `version: 11` (floating major) even though
`website/package.json` pins `packageManager: [email protected]`. To avoid pnpm
minor-version drift between CI and local dev (and potential lockfile/behavior
changes), source the pnpm version from `website/package.json`.
##########
.github/dependabot.yml:
##########
@@ -41,3 +41,24 @@ updates:
labels:
- "dependencies"
- "github actions"
+
+ - package-ecosystem: "npm"
+ directory: "/website"
+ schedule:
+ interval: "monthly"
+ labels:
+ - "dependencies"
+ - "npm"
+ groups:
+ docusaur:
+ patterns:
+ - "@docusaurus/core"
+ - "@docusaurus/plugin-client-redirects"
+ - "@docusaurus/preset-classic"
+ others:
+ patterns:
+ - "*"
+ cooldown:
+ semver-patch-days: 90
+ include:
+ - "*"
Review Comment:
`cooldown` is currently nested under `groups`, but Dependabot expects
`cooldown` at the update-entry level (sibling of `groups`). As written, this
will likely be treated as an invalid group and the cooldown won’t apply.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
