ci: modernize tooling with pnpm, prettier and TypeScript

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/checks.yml

@@ -0,0 +1,18 @@
+name: checks
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
+      - run: pixi run lint
+      - run: pixi run build-docs

.github/workflows/copy-staging-packages.yml

@@ -1,29 +1,36 @@
-name: Copy staging packages
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "42 * * * *"
-
-jobs:
-  copy-packages-noetic:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: prefix-dev/setup-pixi@v0.10.0
-      - env:
-          ANACONDA_API_TOKEN: ${{ secrets.ROBOSTACK_NOETIC_ANACONDA_API_TOKEN }}
-        run: |
-          python copy-to-distro-specific-channel.py noetic 2025-01-01
-        shell: pixi run bash -e {0}
-
-  copy-packages-humble:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: prefix-dev/setup-pixi@v0.10.0
-      - env:
-          ANACONDA_API_TOKEN: ${{ secrets.ROBOSTACK_HUMBLE_ANACONDA_API_TOKEN }}
-        run: |
-          python copy-to-distro-specific-channel.py humble 2025-01-01
-        shell: pixi run bash -e {0}
+name: Copy staging packages
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "42 * * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  copy-packages-noetic:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
+      - env:
+          ANACONDA_API_TOKEN: ${{ secrets.ROBOSTACK_NOETIC_ANACONDA_API_TOKEN }}
+        run: |
+          python scripts/copy-to-distro-specific-channel.py noetic 2025-01-01
+        shell: pixi run bash -e {0}
+
+  copy-packages-humble:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
+      - env:
+          ANACONDA_API_TOKEN: ${{ secrets.ROBOSTACK_HUMBLE_ANACONDA_API_TOKEN }}
+        run: |
+          python scripts/copy-to-distro-specific-channel.py humble 2025-01-01
+        shell: pixi run bash -e {0}

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,23 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Fetch dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Enable auto-merge
+        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/deploy.yml

@@ -0,0 +1,19 @@
+name: deploy
+on:
+  push:
+    branches:
+      - main
+  workflow_run:
+    workflows: ["Update package table"]
+    types: [completed]
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    # `ghp-import --push` pushes the built site to the gh-pages branch
+    permissions:
+      contents: write
+    steps:
+      # ghp-import pushes with the credentials persisted by checkout
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
+      - run: pixi run gh-deploy

.github/workflows/update-package-table.yml

@@ -1,4 +1,4 @@
-name: Update distro tables
+name: Update package table
 
 on:
   schedule:
@@ -8,47 +8,52 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/master'
+    if: github.ref == 'refs/heads/main'
+    # The push step writes the regenerated tables back to the repository
+    permissions:
+      contents: write
     steps:
-    - name: Checkout robostack.github.io
-      uses: actions/checkout@v4
-    - uses: prefix-dev/setup-pixi@v0.10.0
-    # foxy and galactic are end-of-life; public/data/{foxy,galactic}.json are
-    # committed snapshots and deliberately not regenerated here.
-    - name: Create table noetic
-      run: |
-        pixi run compare-completeness noetic robostack-noetic
-    - name: Create table humble
-      run: |
-        pixi run compare-completeness humble robostack-humble
-    - name: Create table jazzy
-      run: |
-        pixi run compare-completeness jazzy robostack-jazzy
-    - name: Create table kilted
-      run: |
-        pixi run compare-completeness kilted robostack-kilted
-    - name: Create table rolling
-      run: |
-        pixi run compare-completeness rolling https://prefix.dev/robostack-rolling
-    - name: Create table lyrical
-      run: |
-        pixi run compare-completeness lyrical https://prefix.dev/robostack-lyrical
-    - name: Commit changes
-      id: commit
-      run: |
-        git config --local user.email "action@github.com"
-        git config --local user.name "GitHub Action"
-        git add public/data/noetic.json
-        git add public/data/humble.json
-        git add public/data/jazzy.json
-        git add public/data/kilted.json
-        git add public/data/rolling.json
-        git add public/data/lyrical.json
-        git commit -m "Update tables"
-      continue-on-error: true
-    - name: Push changes
-      if: steps.commit.outcome == 'success'
-      uses: ad-m/github-push-action@master
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-        branch: ${{ github.ref }}
+      - name: Checkout robostack.github.io
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
+      # foxy and galactic are end-of-life; public/data/{foxy,galactic}.json are
+      # committed snapshots and deliberately not regenerated here.
+      - name: Create table noetic
+        run: |
+          pixi run compare-completeness noetic robostack-noetic
+      - name: Create table humble
+        run: |
+          pixi run compare-completeness humble robostack-humble
+      - name: Create table jazzy
+        run: |
+          pixi run compare-completeness jazzy robostack-jazzy
+      - name: Create table kilted
+        run: |
+          pixi run compare-completeness kilted robostack-kilted
+      - name: Create table rolling
+        run: |
+          pixi run compare-completeness rolling https://prefix.dev/robostack-rolling
+      - name: Create table lyrical
+        run: |
+          pixi run compare-completeness lyrical https://prefix.dev/robostack-lyrical
+      - name: Commit changes
+        id: commit
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          git add public/data/noetic.json
+          git add public/data/humble.json
+          git add public/data/jazzy.json
+          git add public/data/kilted.json
+          git add public/data/rolling.json
+          git add public/data/lyrical.json
+          git commit -m "Update tables"
+        continue-on-error: true
+      - name: Push changes
+        if: steps.commit.outcome == 'success'
+        uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.github/workflows/upgrade-dependencies.yml

@@ -0,0 +1,41 @@
+name: Upgrade dependencies
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  workflow_dispatch:
+  schedule:
+    # At 05:00 on day 1 of the month
+    - cron: 0 5 1 * *
+
+jobs:
+  pixi-upgrade:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Set up pixi
+        uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0
+        with:
+          run-install: false
+      - name: Upgrade dependencies
+        run: |
+          set -o pipefail
+          pixi upgrade --json | pixi exec pixi-diff-to-markdown >> diff.md
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore: upgrade pixi dependencies"
+          title: Upgrade pixi dependencies
+          body-path: diff.md
+          branch: upgrade-pixi
+          base: main
+          labels: pixi
+          delete-branch: true
+          add-paths: |
+            pixi.toml
+            pixi.lock

.gitignore

@@ -9,3 +9,6 @@ RoboStack Website/
 node_modules
 dist
 .astro
+
+# pnpm package store
+.pnpm-store

.prettierignore

@@ -0,0 +1,7 @@
+# Generated package tables
+public/data/*.json
+# Prettier's MDX v1 parser corrupts code fences nested in JSX components
+*.mdx
+# Lockfiles
+pixi.lock
+pnpm-lock.yaml

.prettierrc

@@ -0,0 +1,3 @@
+{
+  "plugins": ["prettier-plugin-astro"]
+}