@moku-labs/ci 1.5.5 → 1.5.6

package/README.md

@@ -120,7 +120,7 @@ flowchart LR
 | [`rulesets/main.json`](rulesets/main.json) | Branch ruleset for `main`: PR only, no force-push, the four `ci / …` checks required. |
 | [`examples/dependabot.yml`](examples/dependabot.yml) | Dependabot config: one grouped PR a day for `@moku-labs/*` only. `setup` writes it to `.github/dependabot.yml`. |
 | [`examples/org/fleet.yml`](examples/org/fleet.yml) | For the organization's `.github` repository. Every 15 minutes it runs `moku-release fleet --markdown --deps` and puts the table between `<!-- fleet:start -->` and `<!-- fleet:end -->` of `profile/README.md`. |
-| [`examples/package/dependabot-automerge.yml`](examples/package/dependabot-automerge.yml) | Turns on auto-merge for a Dependabot PR; the ruleset checks stay the gate. After the merge it dispatches `publish.yml` with `patch`, because a merge made by `GITHUB_TOKEN` starts no push run. `setup` writes it and allows auto-merge on the repo. |
+| [`examples/package/dependabot-automerge.yml`](examples/package/dependabot-automerge.yml) | Turns on auto-merge for a Dependabot PR; the ruleset checks stay the gate. After the merge it dispatches `publish.yml` with `patch`, because a merge made by `GITHUB_TOKEN` starts no push run. A bump of `devDependencies` alone dispatches nothing: the published package is the same, and two packages that pin each other would release each other forever. `setup` writes it and allows auto-merge on the repo. |
 
 > [!TIP]
 > A Layer-3 app copies `examples/app/ci.yml` and `examples/dependabot.yml` by hand and needs

package/examples/package/dependabot-automerge.yml

@@ -3,7 +3,8 @@ name: Dependabot automerge
 # Turns on auto-merge for a Dependabot PR. The branch ruleset stays the gate: the merge
 # waits for ci / lint, ci / types, ci / test and ci / build. Needs the repo setting
 # allow_auto_merge, which `moku-release setup` turns on. After the merge it dispatches
-# publish.yml, so a Dependabot merge releases a patch like any other merge.
+# publish.yml, so a Dependabot merge releases a patch like any other merge. A bump of
+# devDependencies alone releases nothing: the published package did not change.
 on: pull_request
 
 # One waiter per PR: a rebase of the PR starts a new run and ends the old one.
@@ -23,6 +24,8 @@ jobs:
     env:
       PR_URL: ${{ github.event.pull_request.html_url }}
       REPO: ${{ github.repository }}
+      BASE_SHA: ${{ github.event.pull_request.base.sha }}
+      HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Merge once required checks pass
@@ -33,6 +36,17 @@ jobs:
         # the merge, then dispatch the same patch a push would have cut.
         run: |
           set -euo pipefail
+          # A devDependency is not part of the published package. Releasing its bump would
+          # make every package that pins this one release too, and two packages that pin
+          # each other would release each other forever.
+          published() {
+            gh api "repos/$REPO/contents/package.json?ref=$1" --jq .content | base64 -d \
+              | jq -S '{dependencies, peerDependencies, optionalDependencies}'
+          }
+          if [ "$(published "$BASE_SHA")" = "$(published "$HEAD_SHA")" ]; then
+            echo "only devDependencies moved: the published package is the same, no release"
+            exit 0
+          fi
           for _ in $(seq 1 90); do
             state="$(gh pr view "$PR_URL" --json state --jq .state)"
             case "$state" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moku-labs/ci",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
   "type": "module",
   "sideEffects": [