GitHub Action
Automated dependency override management for CI
Automated dependency override management for CI
name: Override Check on: [pull_request] jobs: check: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7+ - uses: yowainwright/pastoralist@v1+ with:+ mode: check+ check-security: falseThe action enables OSV security scanning by default. Set
check-security: false when you only want to validate override tracking.
name: Override Maintenance on: schedule: - cron: "0 0 * * 1" # Weekly on Monday +permissions:+ contents: write+ pull-requests: write jobs: maintain: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7+ - uses: yowainwright/pastoralist@v1+ with:+ mode: pr+ pr-title: "chore(deps): update dependency overrides"+ pr-labels: "dependencies automated"mode: checkRuns Pastoralist in dry-run mode. Reports issues without modifying files.
- uses: yowainwright/pastoralist@v1 with:+ mode: checkmode: updateDefault: selected when
modeis unset
Runs Pastoralist and modifies package.json. Use when you want to handle commits yourself.
- uses: actions/checkout@v7 - uses: yowainwright/pastoralist@v1 with:+ mode: update +- name: Commit changes+ run: |+ git config user.name github-actions[bot]+ git config user.email github-actions[bot]@users.noreply.github.com+ git add package.json+ git diff --staged --quiet || git commit -m "chore: update overrides"+ git pushmode: prRuns Pastoralist and creates a PR if changes are needed. This is best for scheduled workflows.
Use this mode with contents: write and pull-requests: write workflow
permissions.
- uses: yowainwright/pastoralist@v1 with:+ mode: pr+ pr-title: "fix(security): update vulnerable overrides"modeType:
"check" | "update" | "pr"Default:"update"
Selects validation, direct file updates, or PR creation.
check-securityType:
booleanDefault:true
Enables vulnerability scanning.
security-providerType:
"osv" | "github" | "npm" | "snyk" | "socket" | "spektion"Default:"osv"
Selects the security provider used when check-security is enabled.
security-tokenType:
stringDefault: unset
Passes a token to providers that require authentication.
auto-fixType:
booleanDefault:true
Applies security fixes automatically when the action can write files.
dry-runType:
booleanDefault:false
Previews changes without modifying files. mode: check always runs as a dry
run.
root-dirType:
stringDefault: unset
Sets the project root directory passed to pastoralist --root.
dep-pathsType:
stringDefault: unset
Passes space-separated workspace package patterns to pastoralist --depPaths.
configType:
stringDefault: unset
Deprecated. Config files are auto-detected from root-dir.
fail-on-securityType:
booleanDefault:true
Fails the action when vulnerabilities are found.
fail-on-unusedType:
booleanDefault:false
Fails the action when unused overrides are detected.
silentType:
booleanDefault:false
Deprecated compatibility input. The action ignores it and prints a warning when it is enabled.
debugType:
booleanDefault:false
Passes --debug to Pastoralist.
pr-titleType:
stringDefault:"chore(deps): update dependency overrides"
Sets the PR title for mode: pr.
pr-bodyType:
stringDefault: auto-generated
Sets the PR body for mode: pr.
pr-branchType:
stringDefault:"pastoralist/updates"
Sets the PR branch for mode: pr.
pr-labelsType:
stringDefault:"dependencies"
Adds space-separated labels to the PR created by mode: pr.
github-tokenType:
stringDefault:github.token
Sets the GitHub token for PR creation.
has-security-issuesType:
"true" | "false"Default:"false"
Reports whether vulnerabilities were found.
has-unused-overridesType:
"true" | "false"Default:"false"
Reports whether unused overrides were detected.
updatedType:
"true" | "false"Default:"false"
Reports whether package.json was modified.
security-countType:
numberDefault:0
Reports the number of security vulnerabilities found.
unused-countType:
numberDefault:0
Reports the number of unused overrides detected.
override-countType:
numberDefault:0
Reports the number of tracked overrides after the run.
pr-urlType:
stringDefault:""
Reports the created PR URL in mode: pr.
name: Override Security on: [pull_request] jobs: security: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - uses: yowainwright/pastoralist@v1 with:+ mode: check+ fail-on-security: true+ security-provider: osv - uses: yowainwright/pastoralist@v1 with:+ dep-paths: "packages/*/package.json apps/*/package.json" - uses: yowainwright/pastoralist@v1 with:+ security-provider: github+ security-token: ${{ secrets.GITHUB_TOKEN }} - uses: yowainwright/pastoralist@v1+ id: pastoralist with:+ mode: check +- name: Create security PR+ if: steps.pastoralist.outputs.has-security-issues == 'true'+ run: |+ # Custom PR logic here name: Weekly Override Maintenance on: schedule: - cron: "0 9 * * 1" +permissions:+ contents: write+ pull-requests: write jobs: maintain: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + - uses: yowainwright/pastoralist@v1+ id: pastoralist+ with:+ mode: pr++ - name: Notify Slack+ if: steps.pastoralist.outputs.pr-url != ''+ uses: slackapi/[email protected]+ with:+ payload: |+ {+ "text": "Pastoralist created a PR: ${{ steps.pastoralist.outputs.pr-url }}"+ }For mode: pr, the action needs write permissions:
permissions:+ contents: write+ pull-requests: writesecurity-provider: osvAuth: none Default: selected when
security-provideris unset
Uses the Open Source Vulnerabilities database.
security-provider: npmAuth: none Default: unset
Uses the detected package manager's audit command.
security-provider: githubAuth: required Default: unset
Reads Dependabot alerts. Pass GITHUB_TOKEN or rely on an authenticated gh
CLI session.
security-provider: snykAuth: required Default: unset
Requires SNYK_TOKEN.
security-provider: socketAuth: required Default: unset
Requires SOCKET_SECURITY_API_KEY.
security-provider: spektionAuth: required Default: unset
Requires SPEKTION_API_KEY.
name: Override Check
on: [pull_request]
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
+ - uses: yowainwright/pastoralist@v1
+ with:
+ mode: check
+ check-security: false name: Override Maintenance
on:
schedule:
- cron: "0 0 * * 1" # Weekly on Monday
+permissions:
+ contents: write
+ pull-requests: write
jobs:
maintain:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
+ - uses: yowainwright/pastoralist@v1
+ with:
+ mode: pr
+ pr-title: "chore(deps): update dependency overrides"
+ pr-labels: "dependencies automated" - uses: yowainwright/pastoralist@v1
with:
+ mode: check - uses: actions/checkout@v7
- uses: yowainwright/pastoralist@v1
with:
+ mode: update
+- name: Commit changes
+ run: |
+ git config user.name github-actions[bot]
+ git config user.email github-actions[bot]@users.noreply.github.com
+ git add package.json
+ git diff --staged --quiet || git commit -m "chore: update overrides"
+ git push - uses: yowainwright/pastoralist@v1
with:
+ mode: pr
+ pr-title: "fix(security): update vulnerable overrides" name: Override Security
on: [pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: yowainwright/pastoralist@v1
with:
+ mode: check
+ fail-on-security: true
+ security-provider: osv - uses: yowainwright/pastoralist@v1
with:
+ dep-paths: "packages/*/package.json apps/*/package.json" - uses: yowainwright/pastoralist@v1
with:
+ security-provider: github
+ security-token: ${{ secrets.GITHUB_TOKEN }} - uses: yowainwright/pastoralist@v1
+ id: pastoralist
with:
+ mode: check
+- name: Create security PR
+ if: steps.pastoralist.outputs.has-security-issues == 'true'
+ run: |
+ # Custom PR logic here name: Weekly Override Maintenance
on:
schedule:
- cron: "0 9 * * 1"
+permissions:
+ contents: write
+ pull-requests: write
jobs:
maintain:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
+ - uses: yowainwright/pastoralist@v1
+ id: pastoralist
+ with:
+ mode: pr
+
+ - name: Notify Slack
+ if: steps.pastoralist.outputs.pr-url != ''
+ uses: slackapi/[email protected]
+ with:
+ payload: |
+ {
+ "text": "Pastoralist created a PR: ${{ steps.pastoralist.outputs.pr-url }}"
+ } permissions:
+ contents: write
+ pull-requests: write