From 5fd204b93e5cf4c07854203f6a28dd4a06ed7e0b Mon Sep 17 00:00:00 2001 From: Emilien Escalle Date: Thu, 29 Oct 2026 17:00:36 +0100 Subject: [PATCH] fix(release): expose documentation pull request merge method Signed-off-by: Emilien Escalle --- .github/linters/trivy-ignore.yaml | 12 +++++++ .github/workflows/release-actions.md | 30 ++++++++++------ .github/workflows/release-actions.yml | 8 +++++ .../summarize-changelog/package-lock.json | 36 +++++++++---------- .../release/summarize-changelog/package.json | 4 +-- 5 files changed, 59 insertions(+), 31 deletions(-) diff --git a/.github/linters/trivy-ignore.yaml b/.github/linters/trivy-ignore.yaml index 2839f0e..ca26434 100644 --- a/.github/linters/trivy-ignore.yaml +++ b/.github/linters/trivy-ignore.yaml @@ -17,3 +17,15 @@ vulnerabilities: brace patterns cannot reach the vulnerable AST walkers through this action. Reassess when changing Jampack, its CLI arguments, or this dependency, and remove the exception when a patched release is available. + - id: CVE-2026-93753 + paths: + - actions/deploy/jampack/package-lock.json + purls: + - pkg:npm/deepmerge@4.3.1 + expired_at: 2026-11-12 + statement: >- + Jampack uses deepmerge for defaults and repository-controlled configuration, + not processed HTML or downloaded images. This exception assumes trusted + repository configuration, including its imports and extends. Reassess if + these merge inputs change, and remove when a patched release is available. + Decision and supporting evidence: docs/adr/0001-deepmerge-exception.md. diff --git a/.github/workflows/release-actions.md b/.github/workflows/release-actions.md index f208f47..9bcf90d 100644 --- a/.github/workflows/release-actions.md +++ b/.github/workflows/release-actions.md @@ -60,7 +60,7 @@ on: permissions: {} jobs: release-actions: - uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@218a19141dd9c88bd74b0ad28f1facb4c3568fbb # 1.0.0 + uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2 permissions: contents: read secrets: @@ -81,6 +81,12 @@ jobs: # Update all actions and workflows, regardless of changes. update-all: false + # Merge strategy for the documentation pull request: `merge`, `rebase`, or `squash`. + # Use `squash` for branches requiring signed commits and enable squash merging in the repository settings. + # + # Default: `rebase` + merge-method: rebase + # List of extra documentation files to update (if any). documentation-files: "" @@ -101,16 +107,18 @@ jobs: ### Workflow Call Inputs -| **Input** | **Description** | **Required** | **Type** | **Default** | -| -------------------------- | ---------------------------------------------------------------------------------- | ------------ | ----------- | ------------------- | -| **`runs-on`** | JSON array of runner(s) to use. | **false** | **string** | `["ubuntu-latest"]` | -| | See . | | | | -| **`update-all`** | Update all actions and workflows, regardless of changes. | **false** | **boolean** | `false` | -| **`documentation-files`** | List of extra documentation files to update (if any). | **false** | **string** | - | -| **`extra-badges`** | JSON array of extra badges to include in generated documentation. | **false** | **string** | - | -| | Each badge should have `label`, `url`, and optional `linkUrl` properties. | | | | -| **`github-app-client-id`** | GitHub App Client ID to generate GitHub token in place of github-token. | **false** | **string** | - | -| | See . | | | | +| **Input** | **Description** | **Required** | **Type** | **Default** | +| -------------------------- | -------------------------------------------------------------------------------------------------------- | ------------ | ----------- | ------------------- | +| **`runs-on`** | JSON array of runner(s) to use. | **false** | **string** | `["ubuntu-latest"]` | +| | See . | | | | +| **`update-all`** | Update all actions and workflows, regardless of changes. | **false** | **boolean** | `false` | +| **`merge-method`** | Merge strategy for the documentation pull request: `merge`, `rebase`, or `squash`. | **false** | **string** | `rebase` | +| | Use `squash` for branches requiring signed commits and enable squash merging in the repository settings. | | | | +| **`documentation-files`** | List of extra documentation files to update (if any). | **false** | **string** | - | +| **`extra-badges`** | JSON array of extra badges to include in generated documentation. | **false** | **string** | - | +| | Each badge should have `label`, `url`, and optional `linkUrl` properties. | | | | +| **`github-app-client-id`** | GitHub App Client ID to generate GitHub token in place of github-token. | **false** | **string** | - | +| | See . | | | | diff --git a/.github/workflows/release-actions.yml b/.github/workflows/release-actions.yml index 5ed797a..5e0013d 100644 --- a/.github/workflows/release-actions.yml +++ b/.github/workflows/release-actions.yml @@ -26,6 +26,13 @@ on: required: false default: false type: boolean + merge-method: + description: | + Merge strategy for the documentation pull request: `merge`, `rebase`, or `squash`. + Use `squash` for branches requiring signed commits and enable squash merging in the repository settings. + required: false + default: rebase + type: string documentation-files: description: "List of extra documentation files to update (if any)." required: false @@ -335,6 +342,7 @@ jobs: with: github-token: ${{ steps.generate-token.outputs.token || secrets.github-token || github.token }} # zizmor: ignore[secrets-outside-env] reusable workflow token override is intentional branch: docs/actions-workflows-documentation-update + merge-method: ${{ inputs.merge-method }} title: "docs: update actions and workflows documentation" body: Update actions and workflows documentation commit-message: | diff --git a/actions/release/summarize-changelog/package-lock.json b/actions/release/summarize-changelog/package-lock.json index 27b4d72..736d817 100644 --- a/actions/release/summarize-changelog/package-lock.json +++ b/actions/release/summarize-changelog/package-lock.json @@ -11,9 +11,9 @@ "dependencies": { "@langchain/anthropic": "1.6.0", "@langchain/google-genai": "2.3.4", - "@langchain/openai": "1.7.0", + "@langchain/openai": "1.8.0", "html-to-text": "^10.0.1", - "langchain": "1.5.19" + "langchain": "1.6.0" }, "engines": { "node": ">=24.0.0" @@ -82,9 +82,9 @@ } }, "node_modules/@langchain/core": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.3.0.tgz", - "integrity": "sha512-ZiS8USsHdO8ZVFh0m8Rs6v2BvqBEvfFicG66zxdF4rGgXSJjk0d0sLnnFZCx3RXPUvP8ybTJgPlNfkJGs1J7BA==", + "version": "1.3.1", + "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.3.1.tgz", + "integrity": "sha512-jt0miXWxNi+rbZLeSeZkc7BBYKnWopksoJSpB+P3zaYgzMMNwkAPWqnd1zSClfYGwLZPXQbbTtaqv8ZFXmE3FA==", "license": "MIT", "peer": true, "dependencies": { @@ -206,20 +206,20 @@ } }, "node_modules/@langchain/openai": { - "version": "1.7.0", - "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-1.7.0.tgz", - "integrity": "sha512-ne5vZme5yZaC0VcNu2SJrYa8kqJ++dTZlvPmq4lNMyp+oupl5vsEb7YXPHtGgzBU21C44+I5ToEFYbJrXieSkA==", + "version": "1.8.0", + "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-1.8.0.tgz", + "integrity": "sha512-HstN9V0rUkNnOyzMSylP2e5z6VbyuZXyoliuepO2Tf59bezrhvB/sljLfREN1lAGsy4YysD5hUeCN/2ynAZKjQ==", "license": "MIT", "dependencies": { "js-tiktoken": "^1.0.12", - "openai": "^7.23.0", + "openai": "^7.45.1", "zod": "^3.25.76 || ^4" }, "engines": { "node": ">=22" }, "peerDependencies": { - "@langchain/core": "^1.3.0" + "@langchain/core": "^1.3.1" } }, "node_modules/@langchain/protocol": { @@ -465,9 +465,9 @@ } }, "node_modules/langchain": { - "version": "1.5.19", - "resolved": "https://registry.npmjs.org/langchain/-/langchain-1.5.19.tgz", - "integrity": "sha512-9fcjfjr3EWL6Oj/m0Uygkrq1hiq9gxsWryPHuEquJydmWPnDC8j/kBhrGyGTiQCw3ECdMmUXkWyZT93n8SSyoQ==", + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/langchain/-/langchain-1.6.0.tgz", + "integrity": "sha512-3zKLH17Baacw+MtVcKj3f6onstPzmVSI2yfmABdClqVofsifOIt/Ypw7wyMyjFkyOzJTJePVb8hUWILxYpUhKw==", "license": "MIT", "dependencies": { "@langchain/langgraph": "^1.4.18", @@ -479,7 +479,7 @@ "node": ">=20" }, "peerDependencies": { - "@langchain/core": "^1.2.20" + "@langchain/core": "^1.3.1" } }, "node_modules/langsmith": { @@ -535,9 +535,9 @@ } }, "node_modules/openai": { - "version": "7.44.0", - "resolved": "https://registry.npmjs.org/openai/-/openai-7.44.0.tgz", - "integrity": "sha512-xdHRvQgpstjXVD9hGuU7imdMAKDmAoUWU5vrl4cmOISl7MJAiAVDvF5BLTD4mzpgeFP8ecF8tnt6XjJQqFrSIw==", + "version": "7.45.1", + "resolved": "https://registry.npmjs.org/openai/-/openai-7.45.1.tgz", + "integrity": "sha512-mutrJXwhJIMZ24Lab2COFtNp44OcpZSnV4O2O7q38wAHUa2m2fQqUO5pj1XS3PqLfOTeODBUS9YoadqDnnGk5A==", "license": "Apache-2.0", "engines": { "node": ">=22.0.0" @@ -546,7 +546,7 @@ "@aws-sdk/credential-provider-node": ">=3.972.0 <4", "@smithy/hash-node": ">=4.3.0 <5", "@smithy/signature-v4": ">=5.4.0 <6", - "google-auth-library": ">=9.15.1 <11", + "google-auth-library": ">=9.15.1 <12", "undici": ">=5 <9", "ws": "^8.21.0", "zod": "^3.25 || ^4.0" diff --git a/actions/release/summarize-changelog/package.json b/actions/release/summarize-changelog/package.json index 9a1d0b2..9cfdac3 100644 --- a/actions/release/summarize-changelog/package.json +++ b/actions/release/summarize-changelog/package.json @@ -21,9 +21,9 @@ "dependencies": { "@langchain/anthropic": "1.6.0", "@langchain/google-genai": "2.3.4", - "@langchain/openai": "1.7.0", + "@langchain/openai": "1.8.0", "html-to-text": "^10.0.1", - "langchain": "1.5.19" + "langchain": "1.6.0" }, "engines": { "node": ">=24.0.0"