Check Transpiled JavaScript workflow fails for Dependabot PRs

[arianvp]

Closely related to #957 but different.

When you use this repo as a template, all dependabot PRs that are opened will fail as they do not regenerate the dist folder.

Is there a way to make dependabot do that or to not have the weird requirement to commit compiled code?

Because currently dependabot creates a lot of churn because all the PRs it opens will fail

[arianvp]

It would be great if there would be a way to not commit the dist folder. Can’t we publish releases to GitHub Packages or something?

[ncalteen]

Yeah it can be a nuisance with dependency updates, since the dist/ directory can be modified when non-development dependencies are updated. I tested this out a few different ways, and it is possible to set up a GitHub Action that ensures the dist/ directory is rebuilt on Dependabot PRs, however I opted not to include this in the template because its way too easy to end up with infinite loops when GitHub Actions runs and updates the PR branch.

I'm waiting on Immutable Actions to go GA before trying another approach. In the meantime, you may want to checkout the container action template instead. This one is pretty straightforward to set up so the container pulls the dependencies and builds as part of your CI pipeline.

[arianvp]

That repo has the same issue no? It also commits dist. It will suffer from the same problems.

[ncalteen]

Yes that is true, sorry. Unfortunately, I don't have a great option for this until immutable actions are live. At that point I should be able to make this easier :) I will keep this issue open for the time being and circle back once that feature is GA.

[darthmaim]

Just stumbled upon this issue and wanted to share my solution for this. I have a workflow that runs on dependabot PRs adds a commit with the updated dist folder in case it changed.

See here for an example: https://github.com/gw2load/generate-manifest-action/blob/main/.github/workflows/dependabot-bundle.yaml

Instead of using actions/create-github-app-token to create a token you can also just use a PAT (its important to not use the default GITHUB_TOKEN, as commits generated using that token in actions will not trigger workflows)

[ncalteen]

Yeah this approach does work well! My main concern with adding it to the template repos is that there is a potential for infinite loops of GitHub Actions workflow runs :(

[arianvp]

Hello it seems that Immutable Actions is completely dropped from the roadmap in favour of Immutable Releases

https://github.blog/news-insights/product-news/whats-coming-to-our-github-actions-2026-security-roadmap/

This means this issue will not be addressed it seems.

Any update on this?

How am I supposed to keep a GitHub Action up to date if it doesn't work with Dependabot?