chore: switch from native upgrades to dependabot

.gitattributes

@@ -3,11 +3,11 @@
 *.snap linguist-generated
 /.eslintrc.yml linguist-generated
 /.gitattributes linguist-generated
+/.github/dependabot.yml linguist-generated
 /.github/pull_request_template.md linguist-generated
 /.github/workflows/build.yml linguist-generated
 /.github/workflows/pull-request-lint.yml linguist-generated
 /.github/workflows/release.yml linguist-generated
-/.github/workflows/upgrade-main.yml linguist-generated
 /.gitignore linguist-generated
 /.mergify.yml linguist-generated
 /.prettierrc.json linguist-generated

.github/dependabot.yml

@@ -1,16 +1,24 @@
+# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+
 version: 2
 updates:
-- package-ecosystem: npm
-  directory: "/"
-  schedule:
-    interval: weekly
-    day: tuesday
-  open-pull-requests-limit: 10
-  target-branch: 'master'
-- package-ecosystem: npm
-  directory: "/"
-  schedule:
-    interval: weekly
-    day: tuesday
-  open-pull-requests-limit: 10
-  target-branch: 'v1-node16'
+  - package-ecosystem: npm
+    versioning-strategy: lockfile-only
+    directory: /
+    schedule:
+      interval: weekly
+      day: tuesday
+    ignore:
+      - dependency-name: projen
+    open-pull-requests-limit: 10
+    target-branch: main
+  - package-ecosystem: npm
+    directory: /
+    open-pull-requests-limit: 10
+    target-branch: v1-node16
+    ignore:
+      - dependency-name: projen
+    versioning-strategy: lockfile-only
+    schedule:
+      interval: weekly
+      day: tuesday

.github/workflows/upgrade-main.yml

@@ -1,92 +0,0 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
-
-name: upgrade-main
-on:
-  workflow_dispatch: {}
-  schedule:
-    - cron: 0 0 * * *
-jobs:
-  upgrade:
-    name: Upgrade
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      patch_created: ${{ steps.create_patch.outputs.patch_created }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          ref: main
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: 14.0.0
-      - name: Install dependencies
-        run: npm ci
-      - name: Upgrade dependencies
-        run: npx projen upgrade
-      - name: Find mutations
-        id: create_patch
-        run: |-
-          git add .
-          git diff --staged --patch --exit-code > .repo.patch || echo "::set-output name=patch_created::true"
-      - name: Upload patch
-        if: steps.create_patch.outputs.patch_created
-        uses: actions/upload-artifact@v2
-        with:
-          name: .repo.patch
-          path: .repo.patch
-  pr:
-    name: Create Pull Request
-    needs: upgrade
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    if: ${{ needs.upgrade.outputs.patch_created }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
-          ref: main
-      - name: Download patch
-        uses: actions/download-artifact@v3
-        with:
-          name: .repo.patch
-          path: ${{ runner.temp }}
-      - name: Apply patch
-        run: '[ -s ${{ runner.temp }}/.repo.patch ] && git apply ${{ runner.temp }}/.repo.patch || echo "Empty patch. Skipping."'
-      - name: Set git identity
-        run: |-
-          git config user.name "github-actions"
-          git config user.email "github-actions@github.com"
-      - name: Create Pull Request
-        id: create-pr
-        uses: peter-evans/create-pull-request@v3
-        with:
-          token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
-          commit-message: |-
-            chore(deps): upgrade dependencies
-
-            Upgrades project dependencies. See details in [workflow run].
-
-            [Workflow Run]: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-
-            ------
-
-            *Automatically created by projen via the "upgrade-main" workflow*
-          branch: github-actions/upgrade-main
-          title: "chore(deps): upgrade dependencies"
-          body: |-
-            Upgrades project dependencies. See details in [workflow run].
-
-            [Workflow Run]: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-
-            ------
-
-            *Automatically created by projen via the "upgrade-main" workflow*
-          author: github-actions <github-actions@github.com>
-          committer: github-actions <github-actions@github.com>
-          signoff: true

.gitignore

@@ -36,7 +36,7 @@ junit.xml
 /coverage/
 !/.github/workflows/build.yml
 !/.github/workflows/release.yml
-!/.github/workflows/upgrade-main.yml
+!/.github/dependabot.yml
 !/.github/pull_request_template.md
 !/.prettierrc.json
 !/test/

.projen/deps.json

@@ -73,11 +73,6 @@
       "name": "json-schema",
       "type": "build"
     },
-    {
-      "name": "npm-check-updates",
-      "version": "^16",
-      "type": "build"
-    },
     {
       "name": "prettier",
       "type": "build"

.projen/files.json

@@ -2,11 +2,11 @@
   "files": [
     ".eslintrc.yml",
     ".gitattributes",
+    ".github/dependabot.yml",
     ".github/pull_request_template.md",
     ".github/workflows/build.yml",
     ".github/workflows/pull-request-lint.yml",
     ".github/workflows/release.yml",
-    ".github/workflows/upgrade-main.yml",
     ".gitignore",
     ".mergify.yml",
     ".prettierrc.json",

.projen/tasks.json

@@ -125,10 +125,6 @@
       "name": "post-compile",
       "description": "Runs after successful compilation"
     },
-    "post-upgrade": {
-      "name": "post-upgrade",
-      "description": "Runs after upgrading dependencies"
-    },
     "pre-compile": {
       "name": "pre-compile",
       "description": "Prepare the project for compilation"
@@ -196,45 +192,6 @@
         }
       ]
     },
-    "upgrade": {
-      "name": "upgrade",
-      "description": "upgrade dependencies",
-      "env": {
-        "CI": "0"
-      },
-      "steps": [
-        {
-          "exec": "npm update npm-check-updates"
-        },
-        {
-          "exec": "npm-check-updates --dep dev --upgrade --target=minor"
-        },
-        {
-          "exec": "npm-check-updates --dep optional --upgrade --target=minor"
-        },
-        {
-          "exec": "npm-check-updates --dep peer --upgrade --target=minor"
-        },
-        {
-          "exec": "npm-check-updates --dep prod --upgrade --target=minor"
-        },
-        {
-          "exec": "npm-check-updates --dep bundle --upgrade --target=minor"
-        },
-        {
-          "exec": "npm install"
-        },
-        {
-          "exec": "npm update"
-        },
-        {
-          "exec": "npx projen"
-        },
-        {
-          "spawn": "post-upgrade"
-        }
-      ]
-    },
     "watch": {
       "name": "watch",
       "description": "Watch & compile in the background",

.projenrc.cjs

@@ -1,4 +1,6 @@
+const { JsonPatch } = require('projen');
 const { GitHubActionTypeScriptProject, RunsUsing } = require('projen-github-action-typescript');
+const { DependabotScheduleInterval } = require('projen/lib/github');
 const { NodePackageManager, NpmAccess } = require('projen/lib/javascript');
 
 const project = new GitHubActionTypeScriptProject({
@@ -143,6 +145,11 @@ const project = new GitHubActionTypeScriptProject({
       bracketSpacing: true,
     },
   },
+  dependabot: true,
+  dependabotOptions: {
+    scheduleInterval: DependabotScheduleInterval.WEEKLY,
+
+  },
   githubOptions: {
     mergify: true,
     mergifyOptions: {
@@ -185,6 +192,9 @@ const project = new GitHubActionTypeScriptProject({
     },
   },
 });
+/*-------------------------------------------------------------------
+   Overrides and escape hatches
+-------------------------------------------------------------------*/
 // We use different mergify defaults than projen
 const mergifyyml = project.tryFindObjectFile('.mergify.yml');
 if (mergifyyml) {
@@ -222,5 +232,21 @@ if (packageJson) {
   // We don't want to publish this to NPM.
   packageJson.addOverride('private', true);
 }
+// Projen doesn't know about our extra branches
+const dependabotConfig = project.tryFindObjectFile('.github/dependabot.yml');
+if (dependabotConfig) {
+  dependabotConfig.patch(JsonPatch.add('/updates/0/open-pull-requests-limit', 10));
+  dependabotConfig.patch(JsonPatch.add('/updates/0/target-branch', 'main'));
+  dependabotConfig.patch(JsonPatch.add('/updates/0/schedule/day', 'tuesday'));
+  dependabotConfig.addToArray('updates', {
+    'package-ecosystem': 'npm',
+    directory: '/',
+    'open-pull-requests-limit': 10,
+    'target-branch': 'v1-node16',
+    ignore: [ { 'dependency-name': 'projen' } ],
+    'versioning-strategy': 'lockfile-only',
+    schedule: { interval: 'weekly', day: 'tuesday' },
+  });
+}
 
 project.synth();

package.json

@@ -11,13 +11,11 @@
     "eslint": "npx projen eslint",
     "package": "npx projen package",
     "post-compile": "npx projen post-compile",
-    "post-upgrade": "npx projen post-upgrade",
     "pre-compile": "npx projen pre-compile",
     "release": "npx projen release",
     "test": "npx projen test",
     "test:watch": "npx projen test:watch",
     "unbump": "npx projen unbump",
-    "upgrade": "npx projen upgrade",
     "watch": "npx projen watch",
     "projen": "node .projenrc.cjs"
   },
@@ -44,7 +42,6 @@
     "jest": "^29.1.2",
     "jest-junit": "^13",
     "json-schema": "^0.4.0",
-    "npm-check-updates": "^16",
     "prettier": "^2.7.1",
     "projen": "^0.63.19",
     "projen-github-action-typescript": "^0.0.155",