Remove instructions for merging Dependabot PRs

These are no longer required, since the bot will update the `dist` directory.
This commit is contained in:
Daz DeBoer 2024-06-27 19:32:31 -06:00 committed by GitHub
parent 1da1cc97d5
commit c04155e2ca
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -6,21 +6,6 @@ The `build` script in the project root provides a convenient way to perform many
3. `./build init-scripts` will run the init-script integration tests 3. `./build init-scripts` will run the init-script integration tests
4. `./build act <act-commands>` will run `act` after building local changes (see below) 4. `./build act <act-commands>` will run `act` after building local changes (see below)
## How to merge a Dependabot PR
The "distribution" for a GitHub Action is checked into the repository itself.
In the case of these actions, the transpiled sources are committed to the `dist` directory.
Any production dependencies are inlined into the distribution.
So if a Dependabot PR updates a production dependency (or a dev dependency that changes the distribution, like the Typescript compiler),
then a manual step is required to rebuild the dist and commit.
The simplest process to follow is:
1. Checkout the dependabot branch locally eg: `git checkout dependabot/npm_and_yarn/actions/github-5.1.0`
2. In the `sources` directory, run `npm install` to download NPM dependencies
3. In the `sources` directory, run `npm run build` to regenerate the distribution
4. Push the changes to the dependabot branch
5. If/when the checks pass, you can merge the dependabot PR
## Using `act` to run integ-test workflows locally ## Using `act` to run integ-test workflows locally
It's possible to run GitHub Actions workflows locally with https://nektosact.com/. It's possible to run GitHub Actions workflows locally with https://nektosact.com/.
@ -46,4 +31,4 @@ Tips:
- Add the following lines to `~/.actrc`: - Add the following lines to `~/.actrc`:
- `--container-daemon-socket -` : Prevents "error while creating mount source path", and yes that's a solitary dash at the end - `--container-daemon-socket -` : Prevents "error while creating mount source path", and yes that's a solitary dash at the end
- `--matrix os:ubuntu-latest` : Avoids a lot of logging about unsupported runners being skipped - `--matrix os:ubuntu-latest` : Avoids a lot of logging about unsupported runners being skipped
- Runners don't have `java` installed by default, so all workflows that run Gradle require a `setup-java` step. - Runners don't have `java` installed by default, so all workflows that run Gradle require a `setup-java` step.