From 700473823ee8ab6daaeb9c61ffea47cb1b90dc7d Mon Sep 17 00:00:00 2001 From: Adi-204 Date: Thu, 18 Jun 2026 21:57:27 +0530 Subject: [PATCH 1/2] ci: sync lockfile in release PRs and skip AI disclosure on bot PRs Append `npm install --package-lock-only --ignore-scripts` to the Changesets `version` command so the release PR regenerates package-lock.json alongside the bumped manifests, keeping `npm ci` consistent. Add a bot-actor guard to verify-ai-disclosure.yml so the AI-disclosure check does not run on machine-generated PRs (asyncapi-bot, dependabot). Refs: https://github.com/asyncapi/generator/issues/2123 --- .github/workflows/release-with-changesets.yml | 5 ++++- .github/workflows/verify-ai-disclosure.yml | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-with-changesets.yml b/.github/workflows/release-with-changesets.yml index 0f7e72d6fc..2799be34b9 100644 --- a/.github/workflows/release-with-changesets.yml +++ b/.github/workflows/release-with-changesets.yml @@ -122,7 +122,10 @@ jobs: uses: changesets/action@v1 id: release with: - version: npx -p @changesets/cli@2.27.7 changeset version + # `changeset version` only rewrites package.json/CHANGELOG files; it never runs an + # install, so the root package-lock.json drifts out of sync with the bumped manifests. + # Refresh the lockfile (lockfile-only, no scripts) so the release PR carries it too. + version: npx -p @changesets/cli@2.27.7 changeset version && npm install --package-lock-only --ignore-scripts commit: "chore(release): release and bump versions of packages" title: "chore(release): release and bump versions of packages" publish: npx -p @changesets/cli@2.27.7 changeset publish diff --git a/.github/workflows/verify-ai-disclosure.yml b/.github/workflows/verify-ai-disclosure.yml index ec4c148c6a..544b2cfb05 100644 --- a/.github/workflows/verify-ai-disclosure.yml +++ b/.github/workflows/verify-ai-disclosure.yml @@ -31,6 +31,11 @@ permissions: jobs: verify-ai-disclosure: + # it runs only if PR actor is not a bot, at least not a bot that we know + if: | + (github.event.pull_request.user.login != 'asyncapi-bot' && + github.event.pull_request.user.login != 'dependabot[bot]' && + github.event.pull_request.user.login != 'dependabot-preview[bot]') runs-on: ubuntu-latest steps: - name: Check PR body for AI-assistance disclosure From d94a1712da167ab1f862a81aff7b72d2c3f4c383 Mon Sep 17 00:00:00 2001 From: Adi-204 Date: Thu, 18 Jun 2026 22:17:31 +0530 Subject: [PATCH 2/2] chore: sync package-lock.json with released package versions Regenerate the root lockfile so the workspace package versions and pinned internal dependency ranges match the manifests bumped by the last release, resolving the drift described in #2123. Refs: https://github.com/asyncapi/generator/issues/2123 --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 69d5a260d9..249c5a2a96 100644 --- a/package-lock.json +++ b/package-lock.json @@ -21,7 +21,7 @@ }, "apps/generator": { "name": "@asyncapi/generator", - "version": "3.2.1", + "version": "3.3.0", "license": "Apache-2.0", "dependencies": { "@asyncapi/generator-components": "*", @@ -14543,7 +14543,7 @@ }, "packages/components": { "name": "@asyncapi/generator-components", - "version": "0.6.0", + "version": "0.7.0", "license": "Apache-2.0", "dependencies": { "@asyncapi/generator-helpers": "*", @@ -14838,7 +14838,7 @@ "name": "core-template-client-websocket-dart", "license": "Apache-2.0", "dependencies": { - "@asyncapi/generator-components": "0.6.0", + "@asyncapi/generator-components": "0.7.0", "@asyncapi/generator-helpers": "1.1.0", "@asyncapi/generator-react-sdk": "*" }, @@ -14858,7 +14858,7 @@ "name": "core-template-client-websocket-java-quarkus", "license": "Apache-2.0", "dependencies": { - "@asyncapi/generator-components": "0.6.0", + "@asyncapi/generator-components": "0.7.0", "@asyncapi/generator-helpers": "1.1.0", "@asyncapi/generator-react-sdk": "^1.1.2" }, @@ -14880,7 +14880,7 @@ "name": "core-template-client-websocket-javascript", "license": "Apache-2.0", "dependencies": { - "@asyncapi/generator-components": "0.6.0", + "@asyncapi/generator-components": "0.7.0", "@asyncapi/generator-helpers": "1.1.0", "@asyncapi/generator-react-sdk": "*", "@asyncapi/keeper": "0.5.0", @@ -14902,7 +14902,7 @@ "name": "core-template-client-websocket-python", "license": "Apache-2.0", "dependencies": { - "@asyncapi/generator-components": "0.6.0", + "@asyncapi/generator-components": "0.7.0", "@asyncapi/generator-helpers": "1.1.0", "@asyncapi/generator-react-sdk": "*" },