This page documents the automated workflows that maintain repository health through scheduled and on-demand tasks. These workflows handle dependency updates for package-lock.json, test baseline updates, branch synchronization, version stamping, and issue management. For the main CI validation pipeline, see page 13.1.
The TypeScript repository utilizes GitHub Actions to automate routine maintenance tasks. These workflows are designed to reduce manual overhead for maintainers and ensure the repository remains in a clean, buildable state.
| Workflow file | Trigger | Primary purpose |
|---|---|---|
update-package-lock.yaml | Scheduled (Daily 06:00 UTC) | Update package-lock.json, run tests, and commit changes .github/workflows/update-package-lock.yaml4-7 |
accept-baselines-fix-lints.yaml | Manual (workflow_dispatch) | Batch-accept test baselines, auto-fix lints, and format code .github/workflows/accept-baselines-fix-lints.yaml4 |
twoslash-repros.yaml | Scheduled + Dispatch | Re-run twoslash repros attached to issues and optionally bisect regressions .github/workflows/twoslash-repros.yaml4-17 |
sync-branch.yaml | Manual (Bot-triggered) | Merge main into a release branch and update LKG .github/workflows/sync-branch.yaml4-27 |
set-version.yaml | Manual (Bot-triggered) | Stamp version strings in package.json and corePublic.ts and update LKG .github/workflows/set-version.yaml4-35 |
lkg.yml | Manual (workflow_dispatch) | Update Last Known Good (LKG) artifacts on a specific release branch .github/workflows/lkg.yml4-9 |
Diagram: Maintenance Workflow Logic
Sources: .github/workflows/update-package-lock.yaml .github/workflows/accept-baselines-fix-lints.yaml .github/workflows/sync-branch.yaml .github/workflows/set-version.yaml .github/workflows/twoslash-repros.yaml
The update-package-lock.yaml workflow ensures that the repository's dependencies are kept up-to-date by regenerating the lockfile daily.
package-lock.json .github/workflows/update-package-lock.yaml44npm install to generate a fresh lockfile .github/workflows/update-package-lock.yaml45npm test and npx hereby LKG to ensure the new dependencies don't break the compiler or build process .github/workflows/update-package-lock.yaml51-52typescript-automation[bot] and pushed back to the repository .github/workflows/update-package-lock.yaml53-56Sources: .github/workflows/update-package-lock.yaml41-58
The accept-baselines-fix-lints.yaml workflow is a utility for maintainers to perform bulk updates to the test suite and code style.
git rm -r --quiet tests/baselines/reference .github/workflows/accept-baselines-fix-lints.yaml36npx hereby runtests-parallel --ci --fix followed by npx hereby baseline-accept .github/workflows/accept-baselines-fix-lints.yaml37-38npx hereby format to ensure consistency with dprint rules .github/workflows/accept-baselines-fix-lints.yaml39Sources: .github/workflows/accept-baselines-fix-lints.yaml31-43
Release branches require specific automated updates to maintain their integrity and versioning.
The sync-branch.yaml workflow merges main into a target release branch .github/workflows/sync-branch.yaml64 Because merging main often introduces compiler changes, it automatically triggers npx hereby LKG to refresh the Last Known Good binaries on that branch .github/workflows/sync-branch.yaml66
The set-version.yaml and new-release-branch.yaml workflows automate the tedious process of updating version strings across multiple files:
package.json: Updates the "version" field .github/workflows/set-version.yaml79src/compiler/corePublic.ts: Updates versionMajorMinor and the version constant .github/workflows/set-version.yaml80-82tests/baselines/reference/api/typescript.d.ts: Updates the public API baseline to match the new version .github/workflows/set-version.yaml81Diagram: Version Update Data Flow
Sources: .github/workflows/set-version.yaml75-94 .github/workflows/new-release-branch.yaml70-91
The twoslash-repros.yaml workflow integrates with the TypeScript-Twoslash-Repro-Action to automate the verification of bug reports.
bisect mode. If a maintainer provides a "good" and "bad" revision, the workflow performs a git bisect to identify the specific commit that introduced a regression .github/workflows/twoslash-repros.yaml14-17Sources: .github/workflows/twoslash-repros.yaml1-90
The repository maintains automated security scanning through two primary workflows:
The codeql.yml workflow runs weekly and on every PR to perform static analysis for security vulnerabilities .github/workflows/codeql.yml4-22 It uses a custom configuration file at .github/codeql/codeql-configuration.yml .github/workflows/codeql.yml51
The scorecard.yml workflow evaluates the repository against OpenSSF Scorecard criteria, checking for branch protection, binary artifacts, and dangerous workflow patterns .github/workflows/scorecard.yml5-15 It publishes results to the OpenSSF REST API .github/workflows/scorecard.yml45
Sources: .github/workflows/codeql.yml .github/workflows/scorecard.yml
Refresh this wiki