annotate-npm-dependencies.yml

# Updates a pull request created by dependabot for an NPM-based dependency to
# identify the direct dependencies that are impacted.
#
# Example Usage:
# --------------
# name: My favorite workflow
# on:
#   pull_request:
#     types: [opened, synchronize, reopened]
# jobs:
#   annotate-npm-dependencies:
#     if: ${{ github.actor == 'dependabot[bot]' }}
#     permissions:
#       contents: read
#       pull-requests: write
#     uses: pangaeatech/.github/.github/workflows/annotate-npm-dependencies.yml@main
#     with:
#       pr_url: ${{github.event.pull_request.html_url}}
#       branch: ${{github.head_ref}}

name: Annotate NPM Dependencies
on:
  workflow_call:
    inputs:
      pr_url:
        # The Pull Request URL
        required: true
        type: string
      branch:
        # The Pull Request Branch Name
        required: true
        type: string
jobs:
  annotate:
    runs-on: ubuntu-latest
    steps:
      - name: Retrieve dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@37d2f78
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Checkout source code
        uses: actions/checkout@v2
      - name: Setup Node
        uses: actions/setup-node@v2
      - name: Generate comment
        if: ${{ steps.metadata.outputs.package-ecosystem == "npm_and_yarn" }}
        run: |
          npm install;
          echo "### \`${PR_DEPS//,/, }\` in \`${PR_DIR}\`" > body.txt;
          echo "\`\`\`" >> body.txt;
          npm ls ${PR_DEPS//,/ } >> body.txt;
          echo "\`\`\`" >> body.txt;
          gh pr comment "$PR_URL" -F body.txt;
        env:
          PR_URL: ${{ inputs.pr_url }}
          PR_DIR: ${{ steps.metadata.outputs.directory }}
          PR_DEPS: ${{ steps.metadata.outputs.dependency-names }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}