Skip to content

Auto-heal npm dependency sync failures in CI workflow #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EthanThePhoenix38 merged 2 commits into from
Feb 1, 2026
+46 −2
Merged

Auto-heal npm dependency sync failures in CI workflow #48

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91ed360
Initial plan
Copilot Feb 1, 2026
e6090c6
🔧 feat: Add automated dependency management with auto-fix
Copilot Feb 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 46 additions & 2 deletions .github/workflows/update-ai-pulse.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,52 @@ jobs:
node-version: '20'
cache: 'npm'

- name: Install dependencies
run: npm ci
# Installation automatique et résiliente des dépendances
# Tente d'abord npm ci (rapide et reproductible)
# Si échec dû à désynchronisation, bascule sur npm install
# Et commit automatiquement le package-lock.json mis à jour
- name: Install dependencies with auto-fix
run: |
# Tentative avec npm ci (installation propre et rapide)
if npm ci; then
echo "✅ Installation réussie avec npm ci"
else
echo "⚠️ npm ci a échoué, reconstruction du lock file..."

# Suppression du cache npm pour éviter les conflits
npm cache clean --force

# Installation complète qui met à jour package-lock.json
npm install
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The npm install command at line 44 can fail (e.g., network issues, registry unavailable, dependency resolution conflicts), but there's no error handling. If npm install fails, the script will continue and echo the success message, potentially causing the subsequent aggregation step to fail when dependencies are missing.

Add error handling to ensure npm install succeeds:

if ! npm install; then
  echo "❌ npm install a également échoué"
  exit 1
fi
Suggested change
npm install
if ! npm install; then
echo "❌ npm install a également échoué lors de la régénération du package-lock.json"
exit 1
fi

Copilot uses AI. Check for mistakes.

echo "✅ package-lock.json régénéré automatiquement"
fi

# Commit automatique du package-lock.json si modifié
# S'exécute avant l'agrégation pour garder le repo propre
- name: Auto-commit updated lock file
run: |
# Configuration Git pour les commits automatiques
git config --global user.name 'PhoenixProject-AutoSync'
git config --global user.email '${{ secrets.GIT_AUTHOR_EMAIL }}'
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a secret (GIT_AUTHOR_EMAIL) for the commit email in an auto-sync bot may be unnecessary and could expose the secret in git logs. Bot emails are typically public and don't need to be secrets. Consider using a fixed bot email address or the GitHub no-reply email format.

For example:

git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'

Or a project-specific bot email without needing a secret:

git config --global user.email 'phoenix-autosync@users.noreply.github.com'

Copilot uses AI. Check for mistakes.

# Vérifier si package-lock.json a été modifié
if ! git diff --exit-code package-lock.json; then
echo "📦 Synchronisation automatique de package-lock.json"

git add package-lock.json
git commit -m "🔧 Auto-sync: package-lock.json mis à jour automatiquement

- Synchronisation automatique des dépendances
- Généré par le workflow CI/CD
- Date: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"

Comment on lines +62 to +67
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The multi-line commit message uses embedded newlines which may not render correctly in git commit -m. The command substitution $(date -u +'%Y-%m-%d %H:%M:%S UTC') at line 66 is inside the quoted string, which should work, but the multi-line string format could cause issues depending on the shell.

Consider using git commit with -m multiple times for a cleaner approach, or ensure proper escaping. Also, consider adding [skip ci] to prevent infinite loops when this commit triggers the workflow again.

Suggested change
git commit -m "🔧 Auto-sync: package-lock.json mis à jour automatiquement
- Synchronisation automatique des dépendances
- Généré par le workflow CI/CD
- Date: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
UTC_DATE=$(date -u +'%Y-%m-%d %H:%M:%S UTC')
git commit \
-m "🔧 Auto-sync: package-lock.json mis à jour automatiquement [skip ci]" \
-m "- Synchronisation automatique des dépendances" \
-m "- Généré par le workflow CI/CD" \
-m "- Date: $UTC_DATE"

Copilot uses AI. Check for mistakes.
git push
Comment on lines +32 to +68
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow creates a potential infinite loop. The workflow triggers on push to main (line 6-8), and the auto-commit step pushes to main (line 68), which will trigger the workflow again. This can cause an endless cycle of workflow runs.

To prevent this, you should either:

  1. Add [skip ci] to the commit message to prevent retriggering workflows
  2. Use paths filters in the workflow trigger to exclude package-lock.json
  3. Add a condition to check if the commit author is 'PhoenixProject-AutoSync' and skip the workflow

The recommended fix is to update the commit message on line 62 to include [skip ci] marker.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The git push operation will fail because actions/checkout@v4 by default uses the GITHUB_TOKEN which doesn't persist credentials for subsequent git operations. When the workflow tries to push, it will encounter an authentication error.

You need to either:

  1. Pass a token to actions/checkout that has push permissions (e.g., persist-credentials: true should work with GITHUB_TOKEN given the workflow has contents: write permission)
  2. Or configure git to use the GITHUB_TOKEN explicitly before pushing

Consider adding to the checkout step:

- name: Check out repository
  uses: actions/checkout@v4
  with:
    token: ${{ secrets.GITHUB_TOKEN }}

Or configure git credentials before the push:

git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git

Copilot uses AI. Check for mistakes.

echo "✅ package-lock.json synchronisé et committé"
else
echo "ℹ️ package-lock.json déjà à jour"
fi
Comment on lines +51 to +73
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The auto-commit step will create commit noise in the repository history every time package-lock.json drifts from package.json. While this provides traceability, it adds clutter to the git log. Combined with the fact that this workflow runs every 3 hours (line 5) AND on every push to main (line 6-8), this could result in frequent auto-sync commits.

Consider:

  1. Documenting this behavior in the repository's README or contributing guidelines
  2. Adding a concurrency group to prevent multiple simultaneous runs
  3. Using a separate branch for auto-sync commits and periodically merging to main

This is particularly important given the workflow already makes automatic commits for README updates (lines 87-101), potentially resulting in two commits per workflow run.

Copilot uses AI. Check for mistakes.
Comment on lines +32 to +73
Copy link

Copilot AI Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow lacks a concurrency control mechanism. Since it triggers on both schedule (every 3 hours) and push to main, and now makes auto-commits that could re-trigger itself, multiple instances of this workflow could run simultaneously. This could lead to:

  1. Git push conflicts when multiple runs try to commit simultaneously
  2. Race conditions in package-lock.json updates
  3. Wasted CI resources

Add a concurrency group to ensure only one instance runs at a time:

concurrency:
  group: ai-pulse-aggregator
  cancel-in-progress: false

Place this at the job level (after line 16) or workflow level (after line 12).

Copilot uses AI. Check for mistakes.

- name: Aggregate AI, iOT and Cybersecurity articles
env:
Expand Down
Loading