Skip to content

fix(ci): replace yarnPath with corepack, disable dependabot #769

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Decipher merged 1 commit into from
Aug 14, 2026
Merged

fix(ci): replace yarnPath with corepack, disable dependabot #769

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .cspell-project-words.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ Colour
consola
corepack
customisations
deasync
ddev
dbaeumer
decoupled
Expand Down Expand Up @@ -70,3 +71,4 @@ vuex
yaml
yamllint
yarnpkg
yarnrc
60 changes: 49 additions & 11 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,19 @@
# Dependabot is intentionally disabled for the ecosystems Renovate manages.
# Dependabot and Renovate responsibilities are deliberately split:
#
# Renovate (renovate.json) owns all dependency updates for this repo's enabled
# ecosystems (npm, github-actions), including a deliberate freeze policy for
# the Node 16 / Vue 2 / Nuxt 2 toolchain and supply-chain SHA pinning for
# GitHub Actions. Running Dependabot in parallel produced duplicate and
# policy-violating PRs (e.g. #744 bumping vue 2 -> 3.0.0 against the freeze).
# - Renovate (renovate.json) owns all routine *version* updates (npm,
# github-actions), including a deliberate freeze policy for the Node 16 /
# Vue 2 / Nuxt 2 toolchain and supply-chain SHA pinning for GitHub Actions.
# vulnerabilityAlerts is disabled in renovate.json to avoid duplicate
# security PRs. automerge is false — all PRs require manual review.
#
# This file suppresses Dependabot *version* updates via open-pull-requests-limit.
# NOTE: Dependabot *security* updates are governed by a separate repository
# setting ("Dependabot security updates" under Settings -> Code security), not
# by this file. To stop those too, disable that setting there — Renovate
# surfaces vulnerabilities via its own Dependency Dashboard (issue #211).
# - Dependabot owns *security* (CVE) updates only. Security update PRs are
# enabled at the repo level (Settings -> Code security -> Dependabot
# security updates). Grouped security updates are enabled so CVE fixes are
# batched per ecosystem rather than one PR per advisory.
#
# This file suppresses Dependabot *version* updates via
# open-pull-requests-limit: 0 for every directory Dependabot has ever scanned
# in this repo. Security update PRs are unaffected by this limit.
version: 2
updates:
- package-ecosystem: 'npm'
Expand All @@ -23,3 +26,38 @@ updates:
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
- package-ecosystem: 'npm'
directory: '/docs/nuxt'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
- package-ecosystem: 'composer'
directory: '/docs/drupal'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
- package-ecosystem: 'npm'
directory: '/examples/custom-module'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
- package-ecosystem: 'npm'
directory: '/examples/druxt-site'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
- package-ecosystem: 'npm'
directory: '/examples/entity-form'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
- package-ecosystem: 'npm'
directory: '/examples/_deprecated/debug-component'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
- package-ecosystem: 'npm'
directory: '/examples/_deprecated/entity-explorer'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0
48 changes: 44 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,17 @@ jobs:
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 16.20.1
cache: yarn

- run: corepack enable

- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
.yarn/cache
docs/nuxt/.yarn/cache
key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'docs/nuxt/yarn.lock') }}
restore-keys: |
${{ runner.os }}-yarn-
Comment on lines +30 to +37

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for dir in . docs/nuxt; do
  (
    cd "$dir"
    corepack enable
    cache_folder="$(yarn config get cacheFolder)"
    global_cache="$(yarn config get enableGlobalCache)"
    printf '%s\tcacheFolder=%s\tenableGlobalCache=%s\n' \
      "$PWD" "$cache_folder" "$global_cache"
    case "$cache_folder" in
      ./.yarn/cache|*/.yarn/cache) ;;
      *) exit 1 ;;
    esac
    test "$global_cache" = "false"
  )
done

Repository: druxt/druxt.js

Length of output: 901

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- workflow cache and setup sections ---'
sed -n '1,210p' .github/workflows/ci.yml

printf '%s\n' '--- relevant repository files ---'
git ls-files \
  '.yarnrc.yml' \
  'yarn.lock' \
  'package.json' \
  'docs/nuxt/.yarnrc.yml' \
  'docs/nuxt/yarn.lock' \
  'docs/nuxt/package.json' \
  '.github/workflows/ci.yml'

printf '%s\n' '--- root configuration and manifest ---'
for file in package.json .yarnrc.yml; do
  if test -f "$file"; then
    printf '\n[%s]\n' "$file"
    cat "$file"
  fi
done

printf '%s\n' '--- docs/nuxt configuration and manifest ---'
for file in docs/nuxt/package.json docs/nuxt/.yarnrc.yml; do
  if test -f "$file"; then
    printf '\n[%s]\n' "$file"
    cat "$file"
  fi
done

Repository: druxt/druxt.js

Length of output: 12316

🌐 Web query:

Yarn 3.6.1 configuration defaults cacheFolder enableGlobalCache official documentation

💡 Result:

In Yarn 3.6.1, the enableGlobalCache and cacheFolder settings work together as follows: enableGlobalCache This setting defines whether Yarn uses a system-wide shared cache [1][2][3]. Default: true [1][2][4] Behavior: When enabled (default), Yarn ignores the cacheFolder configuration and stores all cache files within the globalFolder (typically located in your home directory) [1][2][3][5]. cacheFolder This setting defines the directory where downloaded packages are stored when the local cache is active [1][2][3]. Default: "./.yarn/cache" [1][2][3] Behavior: This setting is only respected when enableGlobalCache is set to false [1][2][6][5]. If you wish to store your cache in a custom local directory (often used to commit dependencies to version control), you must set enableGlobalCache: false in your.yarnrc.yml file, after which Yarn will use the path specified in cacheFolder [7][6][5]. To configure these settings, you can add them to your.yarnrc.yml file: enableGlobalCache: false cacheFolder: "./.yarn/cache" Alternatively, you can set them via environment variables using snake case: YARN_ENABLE_GLOBAL_CACHE and YARN_CACHE_FOLDER [1][2]. Note that environment variables take precedence over settings defined in.yarnrc.yml files [1][2].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- available Yarn and Corepack tooling ---'
command -v yarn || true
command -v yarnpkg || true
command -v corepack || true
node --version || true
corepack --version || true

printf '%s\n' '--- repository cache configuration ---'
rg -n --hidden --glob '!yarn.lock' --glob '!docs/nuxt/yarn.lock' \
  '^(cacheFolder|enableGlobalCache):|cacheFolder|enableGlobalCache|packageManager' \
  . .github/workflows/ci.yml || true

printf '%s\n' '--- Yarn cache directories tracked by the repository ---'
for dir in .yarn/cache docs/nuxt/.yarn/cache; do
  if test -d "$dir"; then
    printf '%s: directory exists\n' "$dir"
    find "$dir" -maxdepth 1 -type f | head -n 5
  else
    printf '%s: directory absent\n' "$dir"
  fi
done

Repository: druxt/druxt.js

Length of output: 1505

Set Yarn to use the local cache.

Yarn 3.6.1 enables the global cache by default. Both .yarnrc.yml files omit enableGlobalCache: false, so Yarn does not use the cached .yarn/cache paths. Set this option in both project roots. Apply the change to all four cache steps.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 30 - 37, Add enableGlobalCache: false
to both project-root .yarnrc.yml files so Yarn uses the checked-in local
.yarn/cache directories, and ensure this configuration is applied consistently
for all four cache steps in the CI workflow.

Source: MCP tools


- run: yarn install --immutable
- run: yarn build
Expand Down Expand Up @@ -53,7 +63,17 @@ jobs:
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 16.20.1
cache: yarn

- run: corepack enable

- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
.yarn/cache
docs/nuxt/.yarn/cache
key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'docs/nuxt/yarn.lock') }}
restore-keys: |
${{ runner.os }}-yarn-

- run: yarn install --immutable

Expand Down Expand Up @@ -114,7 +134,17 @@ jobs:
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 16.20.1
cache: yarn

- run: corepack enable

- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
.yarn/cache
docs/nuxt/.yarn/cache
key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'docs/nuxt/yarn.lock') }}
restore-keys: |
${{ runner.os }}-yarn-

- run: yarn install --immutable
- run: yarn build
Expand Down Expand Up @@ -149,7 +179,17 @@ jobs:
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 16.20.1
cache: yarn

- run: corepack enable

- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
.yarn/cache
docs/nuxt/.yarn/cache
key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'docs/nuxt/yarn.lock') }}
restore-keys: |
${{ runner.os }}-yarn-

- run: yarn install --immutable
- run: yarn build
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
Expand All @@ -56,7 +56,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
uses: github/codeql-action/autobuild@4187e74d05793876e9989daffde9c3e66b4acd07 # v3

# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
Expand All @@ -70,4 +70,4 @@ jobs:
# make release

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3
uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
1 change: 0 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ node_modules
# Yarn 2
.yarn/*
!.yarn/patches
!.yarn/releases
!.yarn/plugins
!.yarn/sdks
!.yarn/versions
Expand Down
45 changes: 37 additions & 8 deletions .gitlab-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,35 @@ default:
- 'section_start() { local n="$1" t="${2:-$1}"; printf "\e[0Ksection_start:%s:%s\r\e[0K%s\n" "$(date +%s)" "$n" "$t"; }'
- 'section_end() { printf "\e[0Ksection_end:%s:%s\r\e[0K\n" "$(date +%s)" "$1"; }'

#
# --- Node Job Template ---
#
# All node-based jobs share the same image and Yarn Berry cache. The cache key
# is the yarn.lock hash prefixed with the Node image tag, so a cache hit skips
# both the download and the native addon compilation (deasync, re2, etc.) — and
# the image prefix prevents restoring native binaries compiled under a
# different Node version. enableGlobalCache: false in .yarnrc.yml keeps the
# cache in .yarn/cache/ (project-local, CI-cacheable).
.node:
image: node:16.20.1
cache:
- key:
files:
- yarn.lock
prefix: node-16.20.1
paths:
- .yarn/cache/
- node_modules/
policy: pull-push
- key:
files:
- docs/nuxt/yarn.lock
prefix: node-16.20.1
paths:
- docs/nuxt/.yarn/cache/
- docs/nuxt/node_modules/
policy: pull-push

#
# --- Lint Stage ---
#
Expand Down Expand Up @@ -91,9 +120,9 @@ lint:yaml:
- section_end "yaml-lint"

lint:markdown:
extends: .node
stage: lint
interruptible: true
image: node:16.20.1
script:
- section_start "md-lint" "Linting Markdown files"
- corepack enable
Expand All @@ -102,9 +131,9 @@ lint:markdown:
- section_end "md-lint"

lint:cspell:
extends: .node
stage: lint
interruptible: true
image: node:16.20.1
script:
- section_start "cspell" "Spell checking project files"
- corepack enable
Expand All @@ -113,9 +142,9 @@ lint:cspell:
- section_end "cspell"

lint:js:
extends: .node
stage: lint
interruptible: true
image: node:16.20.1
script:
- section_start "eslint" "Linting JS/Vue sources"
- corepack enable
Expand All @@ -129,9 +158,9 @@ lint:js:
# upgrade. The production-only gate is what actually blocks the pipeline -
# shipped runtime dependencies must stay clean.
lint:dependency-audit:
extends: .node
stage: lint
interruptible: true
image: node:16.20.1
script:
- section_start "audit-full" "Full dependency audit (reporting only, includes devDependencies)"
- corepack enable
Expand All @@ -143,9 +172,9 @@ lint:dependency-audit:
- section_end "audit-production"

lint:knip:
extends: .node
stage: lint
interruptible: true
image: node:16.20.1
script:
- section_start "knip" "Checking for unused/unlisted dependencies"
- corepack enable
Expand All @@ -158,9 +187,9 @@ lint:knip:
#

test:unit:
extends: .node
stage: test
interruptible: true
image: node:16.20.1
needs: []
script:
- section_start "jest" "Running unit tests"
Expand Down Expand Up @@ -191,9 +220,9 @@ test:unit:
# docs:review job below for an on-demand look at a build.

pages:preview:
extends: .node
stage: preview
interruptible: true
image: node:16.20.1
needs: []
rules:
- when: never
Expand Down Expand Up @@ -241,9 +270,9 @@ pages:preview:stop:
# the https://*.trycloudflare.com URL. Stop the job (or let it time out) when
# you're done reviewing - the tunnel dies with it.
docs:review:
extends: .node
stage: preview
interruptible: false
image: node:16.20.1
needs: []
timeout: 1h
rules:
Expand Down
1 change: 1 addition & 0 deletions .gitpod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ tasks:
.gitpod/scripts/drupal-setup.sh

# druxt.js build install and build
corepack enable
yarn install
yarn build

Expand Down
Loading
Loading