ci: add the weekly toolchain bump workflow - #14
Merged
Conversation
Dependabot updates dependencies but never the packageManager pin — this repo has sat on pnpm 11.12.0 while 11.17.0 shipped, with every dependency PR green. corepack reads packageManager, so moving the pin is the upgrade. Under GITHUB_TOKEN the resulting PR's checks stay in action_required until approved, so the job runs ci.yml's gates itself: lint, format:check, typecheck, build, test. E2E is skipped — a browser install for a pin bump isn't worth it every Monday. engines.node is deliberately untouched: raising the published floor drops users and is a breaking release, not something an automation decides. Guards against re-running while last week's bump PR is still open, which would collide on the branch name.
pauldvlp
force-pushed
the
ci/toolchain-workflow
branch
from
July 23, 2026 21:20
e7473ec to
b7393bc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot updates dependencies but never the
packageManagerpin. This repo is on pnpm11.12.0while11.17.0is current, with every dependency PR green the whole time. corepack readspackageManager, so moving the pin is the upgrade.Runs Mondays ~06:17 UTC, plus
workflow_dispatch.What it does not touch
engines.node. Raising the published floor drops end users and is a breaking release — a decision, not something an automation makes. The CI Node stays a manual bump when a new Active LTS lands.Why the gates run inside the job
Under
GITHUB_TOKENthe PR it opens has its checks parked inaction_requireduntil approved by hand, so the PR CI cannot be the verification. The job runsci.yml's own gates itself: lint, format:check, typecheck, build, test.E2E is deliberately skipped — a browser install for a package-manager pin is not worth six minutes every Monday.
Swapping
GH_TOKENfor a fine-grained PAT makes it fully hands-off; that trade (a standing credential vs. one click a week) is documented in the workflow header.Guard
If last week's bump PR is still open, the run exits before doing any work rather than colliding on the branch name.
Note:
scheduleonly fires from the default branch, so nothing runs until this merges.