chore(deps-dev): bump rollup from 4.62.4 to 4.62.5 #72
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update Composer Lock | |
| # Regenerates composer.lock when the Ouroboros constraint in composer.json | |
| # has been bumped but the lock file still pins the old version. | |
| # Triggered manually or when composer.json changes on a PR branch. | |
| on: | |
| push: | |
| branches-ignore: | |
| - main | |
| - universe | |
| - develop | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update-lock: | |
| name: Regenerate composer.lock via sparxstar-composer-resolver | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout branch | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.head_ref || github.ref_name }} | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f | |
| with: | |
| php-version: '8.3' | |
| # Composer >= 2.9.8 closes CVE-2026-45793 (GitHub App token leak to logs) | |
| tools: composer:2.9.8 | |
| - name: Mint Composer resolver token | |
| id: composer-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| client-id: ${{ vars.COMPOSER_RESOLVER_CLIENT_ID }} | |
| private-key: ${{ secrets.COMPOSER_RESOLVER_PRIVATE_KEY }} | |
| owner: Starisian-Technologies | |
| repositories: sparxstar-ouroboros-integrity | |
| - name: Wire git to use Composer resolver token for Ouroboros | |
| env: | |
| TOKEN: ${{ steps.composer-token.outputs.token }} | |
| run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/" | |
| - name: Update Ouroboros to latest allowed version | |
| env: | |
| COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ steps.composer-token.outputs.token }}"}}' | |
| run: composer update starisian/sparxstar-ouroboros-integrity --no-interaction --prefer-dist | |
| - name: Commit updated composer.lock if changed | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| if git diff --quiet composer.lock; then | |
| echo "composer.lock unchanged — nothing to commit." | |
| else | |
| git add composer.lock | |
| git commit -m "chore: regenerate composer.lock after Ouroboros constraint bump [skip ci]" | |
| git push origin HEAD | |
| fi |