From 16eaf475131f1048c83d21b2d8e755a2032ec985 Mon Sep 17 00:00:00 2001
From: Elliot <ElliotWorth@protonmail.com>
Date: Sun, 19 Jul 2026 22:22:09 -0500
Subject: [PATCH] ci: weekly dprint plugin auto-update workflow (#236)

Adds .github/workflows/dprint-update.yml per #236.

Schedule: Mondays 09:00 UTC. Each Monday the workflow:
1. Installs the locally-pinned dprint (^0.54.0 via npm).
2. Runs 'npx dprint config update -y' to bump every plugin in
   dprint.json to latest.
3. Runs 'npx dprint fmt' to apply formatting changes from new
   plugin rules (separates 'rule tightening' from version bumps
   in the diff).
4. Detects drift via git status --porcelain. If empty, exits clean
   with no PR.
5. If drift, opens a PR via peter-evans/create-pull-request@v6 with
   branch name 'chore/dprint-plugin-update' (auto-deleted on merge)
   and body referencing #236.

Safety:
- concurrency block cancels in-flight runs on overlap (manual
  trigger + cron can theoretically collide)
- workflow-level permissions: {} default; job-level overrides
  to 'contents: write, pull-requests: write' (least privilege)
- actions pinned to commit SHAs with version comments, matching
  the project's existing convention (ci.yml)
- uses GITHUB_TOKEN explicitly on the create-pull-request step

If a plugin upgrade causes widespread reformat noise, that PR is
the place to review + scope down.
---
 .github/workflows/dprint-update.yml | 94 +++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 .github/workflows/dprint-update.yml

diff --git a/.github/workflows/dprint-update.yml b/.github/workflows/dprint-update.yml
new file mode 100644
index 0000000..cdf4c94
--- /dev/null
+++ b/.github/workflows/dprint-update.yml
@@ -0,0 +1,94 @@
+# .github/workflows/dprint-update.yml
+#
+# Pin dprint plugin manifest to a weekly cron + auto-open a PR if
+# anything drifts. See #236.
+#
+# Implementation:
+# - Mondays 09:00 UTC, run `npx dprint config update -y` which bumps
+#   every plugin in dprint.json to its latest version.
+# - Apply any formatting changes from new plugin rules via `npx dprint fmt`.
+# - If anything changed, open a PR via peter-evans/create-pull-request.
+# - If nothing changed, exit clean (no PR, no spam).
+name: dprint Plugin Updates
+
+on:
+  # Mondays 09:00 UTC. Anchored to a weekday morning so reviewers see it
+  # in their workday queue rather than over a weekend.
+  schedule:
+    - cron: "0 9 * * 1"
+  # Manual trigger for ad-hoc bumps or testing.
+  workflow_dispatch:
+
+# Cancel any in-flight runs if a new dispatch arrives. Manual +
+# cron can theoretically overlap if a manual `gh workflow run` is
+# triggered while the weekly cron job is still running.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+# Workflow-level default: read-only. Override at job level to allow
+# the specific write operations the PR-author needs.
+permissions: {}
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # commit + push to the chore/dprint-plugin-update branch
+      pull-requests: write # open the auto-PR
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      # Pin to the locally-installed dprint (^0.54.0 in package.json devDeps)
+      # rather than curl-installing latest. Local pin = reproducible
+      # behavior matching what devs see; matches the convention used by
+      # lefthook's pre-commit dprint hook.
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "20"
+          cache: "npm"
+      - name: Install dprint
+        run: npm install --no-save dprint@^0.54.0
+
+      # Bump every plugin in dprint.json to current latest.
+      # Output: deterministic diff to dprint.json. -y = non-interactive.
+      - name: Bump dprint plugins
+        run: npx dprint config update -y
+
+      # New plugin versions may have tighter formatting rules. Apply
+      # any drift they introduce to existing files so the diff in the
+      # PR shows just the version bump + rule conformance, not mixed
+      # noise.
+      - name: Apply formatting from new plugin rules
+        run: npx dprint fmt
+
+      # Detect drift across the whole tree. Empty tree = no PR.
+      - name: Detect drift
+        id: drift
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "Files changed:"
+            git status --short
+          fi
+
+      - name: Open PR
+        if: steps.drift.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@5e9f0e25d8c7b97b5d1de33e3308a46f7bb5f04ae # v6.1.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          title: "chore(deps): bump dprint plugins"
+          commit-message: "chore(deps): bump dprint plugins via dprint config update"
+          branch: chore/dprint-plugin-update
+          delete-branch: true
+          body: |
+            Weekly dprint plugin bump via `npx dprint config update -y` +
+            `npx dprint fmt`.
+
+            See #236 for the rationale and the schedule.
+
+            Auto-generated by `.github/workflows/dprint-update.yml`. Review
+            locally with `npm install --no-save dprint@^0.54.0 && npx dprint check .`
+            before merging.