You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "hainenber (via GitHub)" <gi...@apache.org> on 2026/02/06 07:26:01 UTC
[PR] feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces [superset]
hainenber opened a new pull request, #37738:
URL: https://github.com/apache/superset/pull/37738
<!---
Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/
Example:
fix(dashboard): load charts correctly
-->
feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces
### SUMMARY
<!--- Describe the change below, including rationale and design decisions -->
During my usual maintenance PR review session, I couldn't help but noticing lots of Dependabot PRs that bumps version for deps in `superset-frontend/packages/*` or `superset-frontend/plugins/*` couldn't pass CI due to lack of lockfile sync in the root dir.
<img width="990" height="748" alt="image" src="https://github.com/user-attachments/assets/416d1a80-7b2b-4b46-b348-59f1f9e6e105" />
<img width="1113" height="456" alt="image" src="https://github.com/user-attachments/assets/8b880e61-0abe-4eae-bd02-3f539cd3d4fc" />
This PR is to rectify such flaw by running an additional `npm install` command for any PRs opened by Dependabot in described directories.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
N/A
### TESTING INSTRUCTIONS
<!--- Required! What steps can be taken to manually verify the changes? -->
This can only be tested after this PR got merged. If there are any issues, there'll be follow up PRs.
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #37738:
URL: https://github.com/apache/superset/pull/37738#issuecomment-3858496752
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #37738:
URL: https://github.com/apache/superset/pull/37738#issuecomment-3858527044
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | cf8094cbc866be90f15403c4f8142229c5aea8fe |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6985978948b30c0008955d40 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-37738--superset-docs-preview.netlify.app](https://deploy-preview-37738--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-37738--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces [superset]
Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on PR #37738:
URL: https://github.com/apache/superset/pull/37738#issuecomment-3902037371
@rusackas you're correct on this, pushing to branches should originate from non-GHA. I'll try to develop lockfile sync and pre-commit automation in `supersetbot` instead.
Closing this for brevity.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on PR #37738:
URL: https://github.com/apache/superset/pull/37738#issuecomment-3858500517
## **Sequence Diagram**
This PR adds a GitHub Actions workflow that, when Dependabot opens a PR touching frontend workspace packages/plugins, runs npm install to update the root lockfile and commits the synchronized lockfile back to the PR.
```mermaid
sequenceDiagram
participant Dependabot
participant GitHub
participant Runner
participant Node/npm
participant Repo
Dependabot->>GitHub: Open PR touching superset-frontend/packages/** or plugins/**
GitHub->>Runner: Trigger "Sync lockfile for Dependabot PRs" workflow (actor=dependabot[bot])
Runner->>Repo: Checkout code (ref = head_ref)
Runner->>Node/npm: Setup Node from .nvmrc and run npm install
Node/npm-->>Runner: Updated lockfile(s)
Runner->>Repo: Commit & push lockfile changes back to PR
```
---
*Generated by [CodeAnt AI](https://codeant.ai)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #37738:
URL: https://github.com/apache/superset/pull/37738#issuecomment-3876165362
@hainenber do you think this will actually _work_? I thought GHA can't write to PRs.
Happy to approve it, I suppose. I might also want eyes from @dpgaspar to make sure there's not some weird risk.
For example, I'd love to do the same thing to just run `pre-commit` and commit the changed results... it'd solve SO many headaches. However, someone could *change* the pre-commit script to do nefarious things, and then... you're in trouble.
In this case, though, it looks pretty safe.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces [superset]
Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber closed pull request #37738: feat(ci): add GHA workflow to sync lockfiles for version bumping PRs in frontend's npm workspaces
URL: https://github.com/apache/superset/pull/37738
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org