ci: dependabot fixes, lockfile linting by GirlBossRush · Pull Request #20344 · goauthentik/authentik

GirlBossRush · 2026-02-17T04:45:52Z

tl;dr Dependabot's NPM updates can corrupt lockfiles with inconsistent optional dependencies. This PR adds an automated linter + workflow to detect and fix these issues.

Details

Dependabot's NPM package updates sometimes result in a malformed package-lock.json. Optional dependencies get erroneously inserted as direct dependencies, which seems to result in a lockfile that doesn't match the actual package.json constraints. This causes a unexpected behavior in npm ci and npm install. This seemingly appears fine but actually leaves the lockfile in a broken state, causing issues for downstream consumers and CI pipelines.

The issue begins with Dependabot's approach of running of always npm install regardless of dependency constraints:

// web package.json 
{
  "optionalDependencies": {
    "chromedriver": "^145.0.1"
  }
}

Despite the optionalDependencies constraint, and the package-lock.json correctly only including chromedriver as an optional dependency, Dependabot's npm install adds it as a direct dependency in the lockfile:

npm install chromedriver@145.0.3 --ignore-scripts --package-lock-only --save-optional

This bug actually originates in NPM itself, though a fix is in progress.

What this PR does

This PR includes two complementary fixes:

NPM lockfile linter

This script detects the inconsistency scenarios Dependabot creates, especially within NPM packages that make use of a Workspace. The script is also designed to work with our existing linters for web, docs, and other NPM packages.

Automated GitHub workflow

This workflow runs on every Dependabot PR to execute the linter in a permissive mode, automatically reconciling the lockfile if issues are detected. This is more or less what we've been doing manually, now automated and integrated into our CI pipeline.

All together, this keeps Dependabot PRs clean and consistent while we wait for NPM to resolve the underlying issue upstream.

netlify · 2026-02-17T04:46:37Z

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	`5acb401`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/6994a6e17a7ea8000897d5a8
😎 Deploy Preview	https://deploy-preview-20344--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-02-17T04:46:51Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`5acb401`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/6994a6e1cd3f5b00084b8c93
😎 Deploy Preview	https://deploy-preview-20344--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-02-17T04:47:19Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`5acb401`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/6994a6e1f51bc50008139769
😎 Deploy Preview	https://deploy-preview-20344--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-02-17T04:54:57Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.30%. Comparing base (cb9e4e0) to head (204db0c).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #20344   +/-   ##
=======================================
  Coverage   93.30%   93.30%           
=======================================
  Files         981      981           
  Lines       55155    55155           
=======================================
+ Hits        51460    51461    +1     
+ Misses       3695     3694    -1

Flag	Coverage Δ
conformance	`37.45% <ø> (+<0.01%)`	⬆️
e2e	`43.26% <ø> (-0.01%)`	⬇️
integration	`22.43% <ø> (+<0.01%)`	⬆️
unit	`91.50% <ø> (+<0.01%)`	⬆️
unit-migrate	`91.54% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2026-02-17T05:39:19Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-51ea88b2dcd107917f2d283d27ade2cb1c00d070
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-51ea88b2dcd107917f2d283d27ade2cb1c00d070

Afterwards, run the upgrade commands from the latest release notes.

rissson · 2026-02-17T12:00:01Z

Makefile

+	$(SED_INPLACE) 's/^version = ".*"/version = "$(version)"/' pyproject.toml
+	$(SED_INPLACE) 's/^VERSION = ".*"/VERSION = "$(version)"/' authentik/__init__.py
 	$(MAKE) gen-build gen-compose aws-cfn
-	$(SED_INPLACE) "s/\"${current_version}\"/\"$(version)\"/" ${PWD}/package.json ${PWD}/package-lock.json ${PWD}/web/package.json ${PWD}/web/package-lock.json
+	npm version --no-git-tag-version --allow-same-version $(version)
+	cd ${PWD}/web && npm version --no-git-tag-version --allow-same-version $(version)


Don't change this.

Replacing the version string without npm version can break workspace packages which reference their parent or siblings.

.github/workflows/ci-web.yml

rissson · 2026-02-17T12:05:06Z

.github/workflows/ci-web.yml

+env:
+  NPM_VERSION: "11.10.0"


How do we plan on automating upgrading this when a new version is released?

.github/workflows/ci-web.yml

rissson · 2026-02-17T12:05:22Z

.github/workflows/ci-web.yml

      - name: build
        working-directory: web/
        run: npm run build
+


Suggested change

rissson · 2026-02-17T12:05:29Z

.github/workflows/ci-web.yml

      - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # release/v1
        with:
          jobs: ${{ toJSON(needs) }}
+


Suggested change

rissson · 2026-02-17T12:06:01Z

.github/workflows/ci-web.yml

+      - name: Install NPM
+        run: npm install -g npm@${{ env.NPM_VERSION }}


There are plenty of places where we rely on npm packages being installed, not only in ci-web.yml. How do we plan on handling those?

rissson · 2026-02-17T12:06:22Z

.github/workflows/dependabot-lockfile-reconciliation.yml

+      #region Setup
+


Please remove all the "fluff"

.github/workflows/dependabot-lockfile-reconciliation.yml

rissson · 2026-02-17T12:08:22Z

.github/workflows/dependabot-lockfile-reconciliation.yml

+      - name: Detect changed lockfiles
+        id: detect
+        run: |
+          changed=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD)
+
+          npm_matches=$(echo "$changed" | grep -E 'package(-lock)?\.json$' || true)
+          npm_dirs=$(echo "$npm_matches" | xargs -I{} dirname {} | sort -u)
+
+          echo "npm_dirs=$(echo "$npm_dirs" | tr '\n' ' ')" >> "$GITHUB_OUTPUT"


You can use tj-actions/changed-files like in packages-npm-publish.yml

rissson · 2026-02-17T12:09:37Z

scripts/lint-lockfile.mjs

@@ -0,0 +1,289 @@
+#!/usr/bin/env node


Should this still live in web/scripts maybe?

Leaving this in scripts allows the repo root, web, website, etc to invoke this without NPM workspace stuff causing trouble

This reverts commit 68d4d6d.

Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>

GirlBossRush requested a review from a team as a code owner February 17, 2026 04:45

GirlBossRush added the area:frontend Features or issues related to the browser, TypeScript, Node.js, etc label Feb 17, 2026

GirlBossRush requested review from a team as code owners February 17, 2026 04:45

GirlBossRush added the area:docs Features or issues related to Docusaurus label Feb 17, 2026

GirlBossRush added this to authentik Core Feb 17, 2026

GirlBossRush added the area:infrastructure label Feb 17, 2026

github-project-automation bot moved this to Todo in authentik Core Feb 17, 2026

GirlBossRush force-pushed the npm-dependabot-patches branch 3 times, most recently from e47eeeb to 2bd54e9 Compare February 17, 2026 07:28

rissson reviewed Feb 17, 2026

View reviewed changes

rissson requested changes Feb 17, 2026

View reviewed changes

github-project-automation bot moved this from Todo to In Progress in authentik Core Feb 17, 2026

rissson changed the title ~~core: Depedabot fixes, lockfile linting~~ ci: dependabot fixes, lockfile linting Feb 17, 2026

GirlBossRush added 9 commits February 17, 2026 18:32

Revert "root: do not rely on npm cli for version bump (#20276)"

390c73e

This reverts commit 68d4d6d.

Flesh out lockfile linting script.

f0759cd

Flesh out.

78b714b

Flesh out dependabot action.

f22cc47

Revise.

adedec8

Bump package.json

112b5ed

Clarify logs.

4a41e65

Add dev engines.

a946b93

Log NPM version.

4778113

GirlBossRush added 2 commits February 17, 2026 18:32

Install latest NPM

49ed3fe

Fix newlines.

5acb401

GirlBossRush force-pushed the npm-dependabot-patches branch from 2bd54e9 to 5acb401 Compare February 17, 2026 17:35

GirlBossRush and others added 2 commits February 17, 2026 18:42

Apply suggestions from code review

51ea88b

Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>

Remove comments.

204db0c

		- name: Install NPM
		run: npm install -g npm@${{ env.NPM_VERSION }}

Uh oh!

Conversation

GirlBossRush commented Feb 17, 2026

Details

What this PR does

NPM lockfile linter

Automated GitHub workflow

Uh oh!

netlify bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-integrations ready!

Uh oh!

netlify bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

netlify bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs ready!

Uh oh!

codecov bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

GirlBossRush Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify bot commented Feb 17, 2026 •

edited

Loading

netlify bot commented Feb 17, 2026 •

edited

Loading

netlify bot commented Feb 17, 2026 •

edited

Loading

codecov bot commented Feb 17, 2026 •

edited

Loading

github-actions bot commented Feb 17, 2026 •

edited

Loading

GirlBossRush Feb 17, 2026 •

edited

Loading