name: Dependency Change Awareness

on:

pull_request_target: # zizmor: ignore[dangerous-triggers] metadata-only workflow; no checkout or untrusted code execution

pull_request_target: # zizmor: ignore[dangerous-triggers] checks trusted base script only; never checks out PR head

types: [opened, reopened, synchronize, ready_for_review]

permissions:

contents: read

pull-requests: write

issues: write

runs-on: ubuntu-24.04

timeout-minutes: 5

steps:

- name: Label and comment on dependency changes

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9

- name: Check out trusted base workflow scripts

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

with:

script: |

const marker = "<!-- openclaw:dependency-change-awareness -->";

const labelName = "dependencies-changed";

const maxListedFiles = 25;

const pullRequest = context.payload.pull_request;

if (!pullRequest) {

core.info("No pull_request payload found; skipping.");

return;

}

const isDependencyFile = (filename) =>

filename === "package.json" ||

filename === "package-lock.json" ||

filename === "npm-shrinkwrap.json" ||

filename === "pnpm-lock.yaml" ||

filename === "pnpm-workspace.yaml" ||

filename === "ui/package.json" ||

filename.startsWith("patches/") ||

/^packages\/[^/]+\/package\.json$/u.test(filename) ||

/^extensions\/[^/]+\/package-lock\.json$/u.test(filename) ||

/^extensions\/[^/]+\/npm-shrinkwrap\.json$/u.test(filename) ||

/^extensions\/[^/]+\/package\.json$/u.test(filename);

const sanitizeDisplayValue = (value) =>

String(value)

.replace(/[\u0000-\u001f\u007f]/gu, "?")

.slice(0, 240);

const markdownCode = (value) =>

`\`${sanitizeDisplayValue(value).replaceAll("`", "\\`")}\``;

const ignoreUnavailableWritePermission = (action) => (error) => {

if (error?.status === 403) {

core.warning(

`Skipping dependency change ${action}; token does not have issue write permission.`,

);

return;

}

if (error?.status === 404 || error?.status === 422) {

core.warning(`Dependency change ${action} is unavailable.`);

return;

}

throw error;

};

const files = await github.paginate(github.rest.pulls.listFiles, {

owner: context.repo.owner,

repo: context.repo.repo,

pull_number: pullRequest.number,

per_page: 100,

});

const dependencyFiles = files

.map((file) => file.filename)

.filter((filename) => typeof filename === "string" && isDependencyFile(filename))

.sort((left, right) => left.localeCompare(right));

const comments = await github.paginate(github.rest.issues.listComments, {

owner: context.repo.owner,

repo: context.repo.repo,

issue_number: pullRequest.number,

per_page: 100,

});

const existingComment = comments.find(

(comment) =>

comment.user?.login === "github-actions[bot]" && comment.body?.includes(marker),

);

const labels = await github.paginate(github.rest.issues.listLabelsOnIssue, {

owner: context.repo.owner,

repo: context.repo.repo,

issue_number: pullRequest.number,

per_page: 100,

});

const hasLabel = labels.some((label) => label.name === labelName);

if (dependencyFiles.length === 0) {

if (hasLabel) {

await github.rest.issues.removeLabel({

owner: context.repo.owner,

repo: context.repo.repo,

issue_number: pullRequest.number,

name: labelName,

}).catch(ignoreUnavailableWritePermission("label removal"));

}

if (existingComment) {

await github.rest.issues.deleteComment({

owner: context.repo.owner,

repo: context.repo.repo,

comment_id: existingComment.id,

}).catch(ignoreUnavailableWritePermission("comment deletion"));

}

await core.summary

.addHeading("Dependency Change Awareness")

.addRaw("No dependency-related file changes detected.")

.write();

core.info("No dependency-related file changes detected.");

return;

}

if (!hasLabel) {

await github.rest.issues.addLabels({

owner: context.repo.owner,

repo: context.repo.repo,

issue_number: pullRequest.number,

labels: [labelName],

}).catch(ignoreUnavailableWritePermission(`label "${labelName}" update`));

}

const listedFiles = dependencyFiles.slice(0, maxListedFiles);

const omittedCount = dependencyFiles.length - listedFiles.length;

const fileLines = listedFiles.map((filename) => `- ${markdownCode(filename)}`);

if (omittedCount > 0) {

fileLines.push(`- ${omittedCount} additional dependency-related files not shown`);

}

const body = [

marker,

"",

"### Dependency Changes Detected",

"",

"This PR changes dependency-related files. Maintainers should confirm these changes are intentional.",

"",

"Changed files:",

...fileLines,

"",

"Maintainer follow-up:",

"- Review whether the dependency changes are intentional.",

"- Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.",

"- Treat `package-lock.json` and `npm-shrinkwrap.json` diffs as security-review surfaces.",

"- Run `pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json` locally for detailed release-style evidence.",

].join("\n");

if (existingComment) {

await github.rest.issues.updateComment({

owner: context.repo.owner,

repo: context.repo.repo,

comment_id: existingComment.id,

body,

}).catch(ignoreUnavailableWritePermission("comment update"));

} else {

await github.rest.issues.createComment({

owner: context.repo.owner,

repo: context.repo.repo,

issue_number: pullRequest.number,

body,

}).catch(ignoreUnavailableWritePermission("comment creation"));

}

await core.summary

.addHeading("Dependency Change Awareness")

.addRaw(`Detected ${dependencyFiles.length} dependency-related file change(s).`)

.addList(dependencyFiles.map((filename) => markdownCode(filename)))

.write();

core.notice(`Detected ${dependencyFiles.length} dependency-related file change(s).`);

ref: ${{ github.event.pull_request.base.sha }}

persist-credentials: false

- name: Label, comment, and guard dependency changes

env:

GITHUB_TOKEN: ${{ github.token }}

OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant

OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops

run: node scripts/github/dependency-change-awareness.mjs