From 511ce33f4c657ed9c9b04088ba606de035b96c01 Mon Sep 17 00:00:00 2001
From: Zoltan Kochan <z@kochan.io>
Date: Sat, 29 Aug 2026 01:46:12 +0200
Subject: [PATCH] ci: update dependencies with pnpm/update instead of
 Dependabot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dependabot cannot open a passing pull request against this repository.
`dist/index.js` is committed and pr-check rebuilds it and fails on any
difference, but a bump only touches package.json and the lockfile — so
every update lands with a bundle built by the previous dependency set.
That is why #5 is red: esbuild 0.28 changed the CommonJS init helpers it
emits, so a fresh build cannot match the committed one. It is not
specific to esbuild either. All twelve runtime dependencies are inlined
into that bundle.

pnpm/update runs `pnpm run build` through its `post-update` hook, so the
rebuilt bundle is committed alongside the bump and the pull request can
go green. It also updates through pnpm itself, so workspace features the
lockfile depends on are handled by the tool that owns them.

`verify` typechecks and runs the unit tests before the commit is made;
the pull request then gets the full matrix from test.yaml.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7B41egL5GwZk1gw2DU7sY
---
 .github/workflows/update-dependencies.yaml | 47 ++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/update-dependencies.yaml

diff --git a/.github/workflows/update-dependencies.yaml b/.github/workflows/update-dependencies.yaml
new file mode 100644
index 0000000..bc18504
--- /dev/null
+++ b/.github/workflows/update-dependencies.yaml
@@ -0,0 +1,47 @@
+name: Update Dependencies
+
+on:
+  schedule:
+    - cron: '0 4 * * 1' # Mondays, 04:00 UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: update-dependencies
+  cancel-in-progress: false
+
+jobs:
+  update-dependencies:
+    # The branch push and the pull request both target this repository, so
+    # this must never run on a fork.
+    if: github.repository == 'pnpm/setup'
+    name: 'Update dependencies'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      # This repository's own action, on the pnpm it ships. `install: false`
+      # because pnpm/update deletes the lockfile and node_modules before it
+      # resolves anything, so installing first would be thrown away.
+      - uses: ./
+        with:
+          version: '^12.0.0'
+          install: false
+
+      - uses: pnpm/update@v0
+        with:
+          # `dist/index.js` is committed, and pr-check rebuilds it and fails on
+          # any difference. Every runtime dependency is inlined into that
+          # bundle, and esbuild itself decides how — so it has to be
+          # regenerated in the same commit as the bump, or the update pull
+          # request can never go green. This is the step Dependabot had no way
+          # to run.
+          post-update: pnpm run build
+          verify: |
+            pnpm exec tsc --noEmit
+            pnpm test
+          # No .changeset directory in this repository.
+          changesets: false