PromucFlow_constructor/.github/workflows/ci-client-cyclic-deps-check.yml
dependabot[bot] 0da21be439
chore: bump tj-actions/changed-files from 41 to 46 in /.github/workflows (#39761)
Bumps
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
from 41 to 46.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/releases">tj-actions/changed-files's
releases</a>.</em></p>
<blockquote>
<h2>v46</h2>
<blockquote>
<p>[!WARNING]<br />
<strong>Security Alert:</strong> A critical security issue was
identified in this action due to a compromised commit.</p>
<p>This commit has been <strong>removed</strong> from all tags and
branches, and necessary measures have been implemented to prevent
similar issues in the future.</p>
<h4><strong>Action Required:</strong></h4>
<ul>
<li><strong>Review your workflows executed between March 14 and March
15.</strong> If you notice unexpected output under the
<code>changed-files</code> section, decode it using the following
command: <code>echo 'xxx' | base64 -d | base64 -d</code><br />
If the output contains sensitive information (e.g., tokens or secrets),
<strong>revoke and rotate those secrets immediately</strong>.</li>
<li><strong>If your workflows reference this commit directly by its
SHA</strong>, you must update them immediately to avoid using the
compromised version.</li>
<li><strong>If you are using tagged versions</strong> (e.g.,
<code>v35</code>, <code>v44.5.1</code>), no action is required as these
tags have been updated and are now safe to use.</li>
</ul>
<p>Additionally, as a precaution, we recommend rotating any secrets that
may have been exposed during this timeframe to ensure the continued
security of your workflows.</p>
</blockquote>
<h1>Changes in v46.0.1</h1>
<h2>What's Changed</h2>
<ul>
<li>update: sync-release-version.yml to use signed commits by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2472">tj-actions/changed-files#2472</a></li>
<li>Updated README.md by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2473">tj-actions/changed-files#2473</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tj-actions/changed-files/compare/v46...v46.0.1">https://github.com/tj-actions/changed-files/compare/v46...v46.0.1</a></p>
<hr />
<h1>Changes in v46.0.0</h1>
<h2>What's Changed</h2>
<ul>
<li>docs: update docs to highlight security issues by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2465">tj-actions/changed-files#2465</a></li>
<li>fix: update github workflow update-readme.yml by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2466">tj-actions/changed-files#2466</a></li>
<li>fix: update permission in update-readme.yml workflow by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2467">tj-actions/changed-files#2467</a></li>
<li>fix: update update-readme.yml to sign-commits by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2468">tj-actions/changed-files#2468</a></li>
<li>Updated README.md by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2469">tj-actions/changed-files#2469</a></li>
<li>update: sync-release-version.yml by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2471">tj-actions/changed-files#2471</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/github-actions"><code>@​github-actions</code></a>
made their first contribution in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2469">tj-actions/changed-files#2469</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tj-actions/changed-files/compare/v45.0.5...v46.0.0">https://github.com/tj-actions/changed-files/compare/v45.0.5...v46.0.0</a></p>
<h2>What's Changed</h2>
<ul>
<li>docs: update docs to highlight security issues by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2465">tj-actions/changed-files#2465</a></li>
<li>fix: update github workflow update-readme.yml by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2466">tj-actions/changed-files#2466</a></li>
<li>fix: update permission in update-readme.yml workflow by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2467">tj-actions/changed-files#2467</a></li>
<li>fix: update update-readme.yml to sign-commits by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2468">tj-actions/changed-files#2468</a></li>
<li>Updated README.md by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2469">tj-actions/changed-files#2469</a></li>
<li>update: sync-release-version.yml by <a
href="https://github.com/jackton1"><code>@​jackton1</code></a> in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2471">tj-actions/changed-files#2471</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tj-actions/changed-files/compare/v45.0.5...v46.0.0">https://github.com/tj-actions/changed-files/compare/v45.0.5...v46.0.0</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v46.0.0...v46.0.1">46.0.1</a>
- (2025-03-16)</h1>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2473">#2473</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot] <!-- raw HTML omitted --> (<a
href="2f7c5bfce2">2f7c5bf</a>)
- (github-actions[bot])</p>
<ul>
<li>Sync-release-version.yml to use signed commits (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2472">#2472</a>)
(<a
href="4189ec62c4">4189ec6</a>)
- (Tonye Jack)</li>
</ul>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v45.0.9...v46.0.0">46.0.0</a>
- (2025-03-16)</h1>
<h2><!-- raw HTML omitted -->🐛 Bug Fixes</h2>
<ul>
<li>Update update-readme.yml to sign-commits (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2468">#2468</a>)
(<a
href="0f1ffe6185">0f1ffe6</a>)
- (Tonye Jack)</li>
<li>Update permission in update-readme.yml workflow (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2467">#2467</a>)
(<a
href="ddef03e37c">ddef03e</a>)
- (Tonye Jack)</li>
<li>Update github workflow update-readme.yml (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2466">#2466</a>)
(<a
href="9c2df0d54a">9c2df0d</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted --> Remove</h2>
<ul>
<li>Deleted renovate.json (<a
href="e37e952786">e37e952</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Sync-release-version.yml (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2471">#2471</a>)
(<a
href="4cd184a1dd">4cd184a</a>)
- (Tonye Jack)</li>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2469">#2469</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot] <!-- raw HTML omitted --> (<a
href="5cbf22026d">5cbf220</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->📚 Documentation</h2>
<ul>
<li>Update docs to highlight security issues (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2465">#2465</a>)
(<a
href="65253327cf">6525332</a>)
- (Tonye Jack)</li>
</ul>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v45.0.4...v45.0.9">45.0.9</a>
- (2025-03-15)</h1>
<h2><!-- raw HTML omitted -->🐛 Bug Fixes</h2>
<ul>
<li><strong>deps:</strong> Update dependency <code>@​octokit/rest</code>
to v21.1.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2435">#2435</a>)
(<a
href="fb8dcda5fb">fb8dcda</a>)
- (renovate[bot])</li>
<li><strong>deps:</strong> Update dependency <code>@​octokit/rest</code>
to v21.1.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2394">#2394</a>)
(<a
href="7b72c97d73">7b72c97</a>)
- (renovate[bot])</li>
<li><strong>deps:</strong> Update dependency yaml to v2.7.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2383">#2383</a>)
(<a
href="5f974c28f5">5f974c2</a>)
- (renovate[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps:</strong> Lock file maintenance (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2460">#2460</a>)
(<a
href="9200e69727">9200e69</a>)
- (renovate[bot])</li>
<li><strong>deps:</strong> Update dependency <code>@​types/node</code>
to v22.13.10 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2459">#2459</a>)
(<a
href="e650cfdae5">e650cfd</a>)
- (renovate[bot])</li>
<li><strong>deps:</strong> Update dependency eslint-config-prettier to
v10.1.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2458">#2458</a>)
(<a
href="82af21f4a0">82af21f</a>)
- (renovate[bot])</li>
<li><strong>deps:</strong> Update dependency eslint-config-prettier to
v10.1.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2457">#2457</a>)
(<a
href="82fa4a6402">82fa4a6</a>)
- (renovate[bot])</li>
<li><strong>deps:</strong> Update peter-evans/create-pull-request action
to v7.0.8 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2455">#2455</a>)
(<a
href="315505acf4">315505a</a>)
- (renovate[bot])</li>
<li><strong>deps:</strong> Update dependency <code>@​types/node</code>
to v22.13.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2454">#2454</a>)
(<a
href="c8e1cdb9ea">c8e1cdb</a>)
- (renovate[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2f7c5bfce2"><code>2f7c5bf</code></a>
Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2473">#2473</a>)</li>
<li><a
href="4189ec62c4"><code>4189ec6</code></a>
update: sync-release-version.yml to use signed commits (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2472">#2472</a>)</li>
<li><a
href="4cd184a1dd"><code>4cd184a</code></a>
update: sync-release-version.yml (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2471">#2471</a>)</li>
<li><a
href="5cbf22026d"><code>5cbf220</code></a>
Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2469">#2469</a>)</li>
<li><a
href="0f1ffe6185"><code>0f1ffe6</code></a>
fix: update update-readme.yml to sign-commits (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2468">#2468</a>)</li>
<li><a
href="ddef03e37c"><code>ddef03e</code></a>
fix: update permission in update-readme.yml workflow (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2467">#2467</a>)</li>
<li><a
href="9c2df0d54a"><code>9c2df0d</code></a>
fix: update github workflow update-readme.yml (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2466">#2466</a>)</li>
<li><a
href="65253327cf"><code>6525332</code></a>
docs: update docs to highlight security issues (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2465">#2465</a>)</li>
<li><a
href="e37e952786"><code>e37e952</code></a>
Deleted renovate.json</li>
<li><a
href="a284dc1814"><code>a284dc1</code></a>
Upgraded to v45.0.8 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2462">#2462</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tj-actions/changed-files/compare/v41...v46">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tj-actions/changed-files&package-manager=github_actions&previous-version=41&new-version=46)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/appsmithorg/appsmith/network/alerts).

</details>

<!-- This is an auto-generated comment: Cypress test results  -->
> [!WARNING]
> Tests have not run on the HEAD
7cc23031088dd77b20e7b899010f7343a2c5269d yet
> <hr>Tue, 18 Mar 2025 06:37:37 UTC
<!-- end of auto-generated comment: Cypress test results  -->


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Chores**
- Upgraded internal automation dependencies to enhance the consistency
and reliability of our build and deployment processes. These
improvements help maintain stability and performance across client and
server operations, ensuring a smooth experience for users without any
visible interface changes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 11:46:54 +05:30

152 lines
6.8 KiB
YAML

name: Cyclic Dependency Check
on:
workflow_call:
inputs:
pr:
description: "This is the PR number in case the workflow is being called in a pull request"
required: false
type: number
jobs:
check-cyclic-dependencies:
runs-on: ubuntu-latest
defaults:
run:
working-directory: app/client
shell: bash
steps:
# The checkout steps MUST happen first because the default directory is set according to the code base.
# GitHub Action expects all future commands to be executed in the code directory. Hence, we need to check out
# the code before doing anything else.
# Check out merge commit with the base branch in case this workflow is invoked via pull request
- name: Checkout the merged commit from PR and base branch
uses: actions/checkout@v4
with:
ref: refs/pull/${{ inputs.pr }}/merge
- name: Check for changes in app/client/src
id: changed-files
uses: tj-actions/changed-files@v46
with:
files: |
app/client/src/**
- name: Use Node.js
if: steps.changed-files.outputs.any_changed == 'true'
uses: actions/setup-node@v4
with:
node-version-file: app/client/package.json
# Globally install the npm package
- name: Install dpdm globally
if: steps.changed-files.outputs.any_changed == 'true'
run: npm install -g dpdm@3.14
# Install all the dependencies
- name: Install dependencies
if: steps.changed-files.outputs.any_changed == 'true'
run: |
yarn install --immutable
- name: Count circular dependencies on PR branch
id: count-cyclic-deps-in-pr
if: steps.changed-files.outputs.any_changed == 'true'
run: |
dpdm "./src/**/*.{js,jsx,ts,tsx}" --circular --warning=false --tree=false | sed '1d; s/^[[:space:]]*[0-9]\{4\})[[:space:]]*/• /; /^[[:space:]]*$/d' \
| sort | sed '/^[[:space:]]*$/d' > pr_circular_deps.txt
# awk 'NF' pr_circular_deps.txt: Filter out empty lines from the file
# wc -l: Count the number of lines in the file
pr_count="$(awk 'NF' pr_circular_deps.txt | wc -l)"
echo "pr_count=$pr_count" >> $GITHUB_OUTPUT
cat pr_circular_deps.txt
- name: Checkout base branch
uses: actions/checkout@v4
if: steps.changed-files.outputs.any_changed == 'true'
with:
ref: ${{ github.event.pull_request.base.ref }}
clean: false
- name: Install dependencies
if: steps.changed-files.outputs.any_changed == 'true'
run: |
yarn install --immutable
- name: Count circular dependencies on base branch
id: count-cyclic-deps-in-base
if: steps.changed-files.outputs.any_changed == 'true'
run: |
dpdm "./src/**/*.{js,jsx,ts,tsx}" --circular --warning=false --tree=false | sed '1d; s/^[[:space:]]*[0-9]\{4\})[[:space:]]*/• /; /^[[:space:]]*$/d' \
| sort | sed '/^[[:space:]]*$/d' > base_branch_circular_deps.txt
# awk 'NF' base_branch_circular_deps.txt: Filter out empty lines from the file
# wc -l: Count the number of lines in the file
base_branch_count="$(awk 'NF' base_branch_circular_deps.txt | wc -l)"
echo "base_branch_count=$base_branch_count" >> $GITHUB_OUTPUT
cat base_branch_circular_deps.txt
- name: Compare circular dependencies
id: compare-deps
if: steps.changed-files.outputs.any_changed == 'true'
run: |
base_branch_count="${{ steps.count-cyclic-deps-in-base.outputs.base_branch_count }}"
pr_count="${{ steps.count-cyclic-deps-in-pr.outputs.pr_count }}"
diff="$((pr_count - base_branch_count))"
if [ "$diff" -gt 0 ]; then
echo "has_more_cyclic_deps=true" >> "$GITHUB_OUTPUT"
echo "diff=$diff" >> "$GITHUB_OUTPUT"
fi
- name: Save diff
if: steps.compare-deps.outputs.has_more_cyclic_deps == 'true' && steps.changed-files.outputs.any_changed == 'true'
run: |
{ diff -u base_branch_circular_deps.txt pr_circular_deps.txt || true; } > diff_output.txt
- name: Log diff in circular dependencies between PR and base branch
id: log-compare-circular-deps
if: steps.compare-deps.outputs.has_more_cyclic_deps == 'true' && steps.changed-files.outputs.any_changed == 'true'
run: |
# Capture added dependencies (lines starting with '+' but not the diff header lines)
added=$(grep -E '^\+[^+]' diff_output.txt | sed 's/^\+//') || true
# Only output the "Dependencies added:" header if there are any added dependencies.
if [[ -n "$added" ]]; then
echo "Dependencies added:" >> diff.txt
echo "$added" >> diff.txt
echo "" >> diff.txt
fi
# Capture removed dependencies (lines starting with '-' but not the diff header lines)
removed=$(grep -E '^-[^-]' diff_output.txt | sed 's/^-//') || true
# Only output the "Dependencies removed:" header if there are any removed dependencies.
if [[ -n "$removed" ]]; then
echo "Dependencies removed:" >> diff.txt
echo "$removed" >> diff.txt
fi
cat diff.txt
# Comment on the PR if cyclic dependencies are found
- name: Comment the result on PR
if: steps.compare-deps.outputs.has_more_cyclic_deps == 'true' && steps.changed-files.outputs.any_changed == 'true'
uses: actions/github-script@v3
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
const prNumber = context.payload.pull_request.number;
const message = `🔴🔴🔴 Cyclic Dependency Check:\n\nThis PR has increased the number of cyclic dependencies by ${{steps.compare-deps.outputs.diff}}, when compared with the ${{github.event.pull_request.base.ref}} branch.\n\nRefer [this document](https://appsmith.notion.site/How-to-check-cyclic-dependencies-c47b08fe5f2f4261a3a234b19e13f2db) to identify the cyclic dependencies introduced by this PR.\n\nYou can view the dependency diff in the [run log](${runUrl}). Look for the **check-cyclic-dependencies** job in the run.`;
github.issues.createComment({
...context.repo,
issue_number: prNumber,
body: message
});
# Fail the workflow if cyclic dependencies are found
- name: Fail the workflow if cyclic dependencies are found
if: steps.compare-deps.outputs.has_more_cyclic_deps == 'true' && steps.changed-files.outputs.any_changed == 'true'
run: exit 1