Merge pull request #13 from docker/dependabot/npm_and_yarn/semver-7.3.5

Bump semver from 7.3.4 to 7.3.5

.dockerignore

@@ -1,6 +1,2 @@
-/.dev
 /coverage
-/dist
-/lib
 /node_modules
-/.env

.github/CONTRIBUTING.md

@@ -2,7 +2,8 @@
 
 Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
 
-Contributions to this project are [released](https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license) to the public under the [project's open source license](LICENSE).
+Contributions to this project are [released](https://docs.github.com/en/github/site-policy/github-terms-of-service#6-contributions-under-repository-license)
+to the public under the [project's open source license](LICENSE).
 
 ## Submitting a pull request
 
@@ -18,6 +19,7 @@ Contributions to this project are [released](https://help.github.com/articles/gi
 
 Here are a few things you can do that will increase the likelihood of your pull request being accepted:
 
+- Write tests.
 - Make sure the `README.md` and any other relevant **documentation are kept up-to-date**.
 - We try to follow [SemVer v2.0.0](https://semver.org/). Randomly breaking public APIs is not an option.
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as **separate pull requests**.
@@ -26,5 +28,5 @@ Here are a few things you can do that will increase the likelihood of your pull
 ## Resources
 
 - [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
-- [Using Pull Requests](https://help.github.com/articles/about-pull-requests/)
-- [GitHub Help](https://help.github.com)
+- [Using Pull Requests](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests)
+- [GitHub Help](https://docs.github.com/en)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -30,4 +30,5 @@ about: Create a report to help us improve
 
 ### Logs
 
-> Download the [log file of your build](https://help.github.com/en/actions/configuring-and-managing-workflows/managing-a-workflow-run#downloading-logs) and [attach it](https://help.github.com/en/github/managing-your-work-on-github/file-attachments-on-issues-and-pull-requests) to this issue.
+> Download the [log file of your build](https://docs.github.com/en/actions/managing-workflow-runs/using-workflow-run-logs#downloading-logs)
+> and [attach it](https://docs.github.com/en/github/managing-your-work-on-github/file-attachments-on-issues-and-pull-requests) to this issue.

.github/labels.yml

@@ -1,79 +0,0 @@
-## more info https://github.com/crazy-max/ghaction-github-labeler
-- # automerge
-  name: ":bell: automerge"
-  color: "8f4fbc"
-  description: ""
-- # bot
-  name: ":robot: bot"
-  color: "69cde9"
-  description: ""
-- # bug
-  name: ":bug: bug"
-  color: "b60205"
-  description: ""
-- # dependencies
-  name: ":game_die: dependencies"
-  color: "0366d6"
-  description: ""
-  from_name: "dependencies"
-- # documentation
-  name: ":memo: documentation"
-  color: "c5def5"
-  description: ""
-- # duplicate
-  name: ":busts_in_silhouette: duplicate"
-  color: "cccccc"
-  description: ""
-- # enhancement
-  name: ":sparkles: enhancement"
-  color: "0054ca"
-  description: ""
-- # feature request
-  name: ":bulb: feature request"
-  color: "0e8a16"
-  description: ""
-- # feedback
-  name: ":mega: feedback"
-  color: "03a9f4"
-  description: ""
-- # future maybe
-  name: ":rocket: future maybe"
-  color: "fef2c0"
-  description: ""
-- # good first issue
-  name: ":hatching_chick: good first issue"
-  color: "7057ff"
-  description: ""
-- # help wanted
-  name: ":pray: help wanted"
-  color: "4caf50"
-  description: ""
-- # hold
-  name: ":hand: hold"
-  color: "24292f"
-  description: ""
-- # invalid
-  name: ":no_entry_sign: invalid"
-  color: "e6e6e6"
-  description: ""
-- # maybe bug
-  name: ":interrobang: maybe bug"
-  color: "ff5722"
-  description: ""
-- # needs more info
-  name: ":thinking: needs more info"
-  color: "795548"
-  description: ""
-- # question
-  name: ":question: question"
-  color: "3f51b5"
-  description: ""
-  from_name: "question"
-- # upstream
-  name: ":eyes: upstream"
-  color: "fbca04"
-  description: ""
-- # wontfix
-  name: ":coffin: wontfix"
-  color: "ffffff"
-  description: ""

.github/stale.yml

@@ -1,18 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 30
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - ":hand: hold"
-# Set to true to ignore issues in a milestone (defaults to false)
-exemptMilestones: true
-# Label to use when marking an issue as stale
-staleLabel: ":skull: stale"
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false

.github/workflows/ci.yml

@@ -1,12 +1,18 @@
 name: ci
 
 on:
+  schedule:
+    - cron: '0 10 * * *' # everyday at 10am
   push:
     branches:
-      - master
+      - 'master'
+      - 'releases/v*'
+    tags:
+      - 'v*'
   pull_request:
     branches:
-      - master
+      - 'master'
+      - 'releases/v*'
 
 jobs:
   bake:

.github/workflows/labels.yml

@@ -1,20 +0,0 @@
-name: labels
-
-on:
-  push:
-    branches:
-      - 'master'
-    paths:
-      - '.github/labels.yml'
-      - '.github/workflows/labels.yml'
-
-jobs:
-  labeler:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
-      -
-        name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@v3

.github/workflows/test.yml

@@ -5,13 +5,10 @@ on:
     branches:
       - 'master'
       - 'releases/v*'
-    paths-ignore:
-      - '**.md'
   pull_request:
     branches:
       - 'master'
-    paths-ignore:
-      - '**.md'
+      - 'releases/v*'
 
 jobs:
   test:
@@ -22,10 +19,11 @@ jobs:
         uses: actions/checkout@v2
       -
         name: Test
-        run: docker buildx bake test
+        uses: docker/bake-action@v1
+        with:
+          targets: test
       -
         name: Upload coverage
         uses: codecov/codecov-action@v1
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
           file: ./coverage/clover.xml

.github/workflows/validate.yml

@@ -5,13 +5,10 @@ on:
     branches:
       - 'master'
       - 'releases/v*'
-    paths-ignore:
-      - '**.md'
   pull_request:
     branches:
       - 'master'
-    paths-ignore:
-      - '**.md'
+      - 'releases/v*'
 
 jobs:
   validate:
@@ -22,4 +19,6 @@ jobs:
         uses: actions/checkout@v2
       -
         name: Validate
-        run: docker buildx bake validate
+        uses: docker/bake-action@v1
+        with:
+          targets: validate

Dockerfile.dev

@@ -1,59 +0,0 @@
-#syntax=docker/dockerfile:1.2
-
-FROM node:12 AS deps
-WORKDIR /src
-COPY package.json yarn.lock ./
-RUN --mount=type=cache,target=/src/node_modules \
-  yarn install
-
-FROM scratch AS update-yarn
-COPY --from=deps /src/yarn.lock /
-
-FROM deps AS validate-yarn
-COPY .git .git
-RUN status=$(git status --porcelain -- yarn.lock); if [ -n "$status" ]; then echo $status; exit 1; fi
-
-FROM deps AS base
-COPY . .
-
-FROM base AS build
-RUN --mount=type=cache,target=/src/node_modules \
-  yarn build
-
-FROM deps AS test
-COPY --from=docker /usr/local/bin/docker /usr/bin/
-ARG TARGETOS
-ARG TARGETARCH
-ENV RUNNER_TEMP=/tmp/github_runner
-ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
-ARG BUILDX_VERSION=v0.5.1
-RUN mkdir -p /usr/local/lib/docker/cli-plugins \
-  && curl -fsSL https://github.com/docker/buildx/releases/download/$BUILDX_VERSION/buildx-$BUILDX_VERSION.$TARGETOS-$TARGETARCH > /usr/local/lib/docker/cli-plugins/docker-buildx \
-  && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx \
-  && docker buildx version
-COPY . .
-RUN --mount=type=cache,target=/src/node_modules \
-  yarn run test
-
-FROM scratch AS test-coverage
-COPY --from=test /src/coverage /coverage/
-
-FROM base AS run-format
-RUN --mount=type=cache,target=/src/node_modules \
-  yarn run format
-
-FROM scratch AS format
-COPY --from=run-format /src/src/*.ts /src/
-
-FROM base AS validate-format
-RUN --mount=type=cache,target=/src/node_modules \
-  yarn run format-check
-
-FROM scratch AS dist
-COPY --from=build /src/dist/ /dist/
-
-FROM build AS validate-build
-RUN status=$(git status --porcelain -- dist); if [ -n "$status" ]; then echo $status; exit 1; fi
-
-FROM base AS dev
-ENTRYPOINT ["bash"]

dist/index.js

@@ -4856,7 +4856,7 @@ class Parser extends Transform {
       recordDelimiterMaxLength: options.record_delimiter.length === 0 ? 2 : Math.max(...options.record_delimiter.map( (v) => v.length)),
       trimChars: [Buffer.from(' ', options.encoding)[0], Buffer.from('\t', options.encoding)[0]],
       wasQuoting: false,
-      wasRecordDelimiter: false
+      wasRowDelimiter: false
     }
   }
   // Implementation of `Transform._transform`
@@ -4929,12 +4929,12 @@ class Parser extends Transform {
       if(this.__needMoreData(pos, bufLen, end)){
         break
       }
-      if(this.state.wasRecordDelimiter === true){
+      if(this.state.wasRowDelimiter === true){
         this.info.lines++
         if(info === true && this.state.record.length === 0 && this.state.field.length === 0 && this.state.wasQuoting === false){
           this.state.info = Object.assign({}, this.info)
         }
-        this.state.wasRecordDelimiter = false
+        this.state.wasRowDelimiter = false
       }
       if(to_line !== -1 && this.info.lines > to_line){
         this.state.stop = true
@@ -4952,8 +4952,8 @@ class Parser extends Transform {
       if(raw === true){
         rawBuffer.append(chr)
       }
-      if((chr === cr || chr === nl) && this.state.wasRecordDelimiter === false ){
-        this.state.wasRecordDelimiter = true
+      if((chr === cr || chr === nl) && this.state.wasRowDelimiter === false ){
+        this.state.wasRowDelimiter = true
       }
       // Previous char was a valid escape char
       // treat the current char as a regular char
@@ -5041,25 +5041,24 @@ class Parser extends Transform {
               this.info.comment_lines++
               // Skip full comment line
             }else{
+              // Activate records emition if above from_line
+              if(this.state.enabled === false && this.info.lines + (this.state.wasRowDelimiter === true ? 1: 0) >= from_line){
+                this.state.enabled = true
+                this.__resetField()
+                this.__resetRecord()
+                pos += recordDelimiterLength - 1
+                continue
+              }
               // Skip if line is empty and skip_empty_lines activated
               if(skip_empty_lines === true && this.state.wasQuoting === false && this.state.record.length === 0 && this.state.field.length === 0){
                 this.info.empty_lines++
                 pos += recordDelimiterLength - 1
                 continue
               }
-              // Activate records emition if above from_line
-              if(this.state.enabled === false && this.info.lines + (this.state.wasRecordDelimiter === true ? 1: 0 ) >= from_line){
-                this.state.enabled = true
-                this.__resetField()
-                this.__resetRecord()
-                pos += recordDelimiterLength - 1
-                continue
-              }else{
-                const errField = this.__onField()
-                if(errField !== undefined) return errField
-                const errRecord = this.__onRecord()
-                if(errRecord !== undefined) return errRecord
-              }
+              const errField = this.__onField()
+              if(errField !== undefined) return errField
+              const errRecord = this.__onRecord()
+              if(errRecord !== undefined) return errRecord
               if(to !== -1 && this.info.records >= to){
                 this.state.stop = true
                 this.push(null)
@@ -5134,7 +5133,7 @@ class Parser extends Transform {
           if(errField !== undefined) return errField
           const errRecord = this.__onRecord()
           if(errRecord !== undefined) return errRecord
-        }else if(this.state.wasRecordDelimiter === true){
+        }else if(this.state.wasRowDelimiter === true){
           this.info.empty_lines++
         }else if(this.state.commenting === true){
           this.info.comment_lines++
@@ -5143,9 +5142,9 @@ class Parser extends Transform {
     }else{
       this.state.previousBuf = buf.slice(pos)
     }
-    if(this.state.wasRecordDelimiter === true){
+    if(this.state.wasRowDelimiter === true){
       this.info.lines++
-      this.state.wasRecordDelimiter = false
+      this.state.wasRowDelimiter = false
     }
   }
   __onRecord(){
@@ -5828,22 +5827,30 @@ module.exports = clean
 /***/ (function(module, __unusedexports, __webpack_require__) {
 
 const Range = __webpack_require__(828)
-const { ANY } = __webpack_require__(532)
+const Comparator = __webpack_require__(532)
+const { ANY } = Comparator
 const satisfies = __webpack_require__(55)
 const compare = __webpack_require__(309)
 
 // Complex range `r1 || r2 || ...` is a subset of `R1 || R2 || ...` iff:
-// - Every simple range `r1, r2, ...` is a subset of some `R1, R2, ...`
+// - Every simple range `r1, r2, ...` is a null set, OR
+// - Every simple range `r1, r2, ...` which is not a null set is a subset of
+//   some `R1, R2, ...`
 //
 // Simple range `c1 c2 ...` is a subset of simple range `C1 C2 ...` iff:
 // - If c is only the ANY comparator
 //   - If C is only the ANY comparator, return true
-//   - Else return false
+//   - Else if in prerelease mode, return false
+//   - else replace c with `[>=0.0.0]`
+// - If C is only the ANY comparator
+//   - if in prerelease mode, return true
+//   - else replace C with `[>=0.0.0]`
 // - Let EQ be the set of = comparators in c
 // - If EQ is more than one, return true (null set)
 // - Let GT be the highest > or >= comparator in c
 // - Let LT be the lowest < or <= comparator in c
 // - If GT and LT, and GT.semver > LT.semver, return true (null set)
+// - If any C is a = range, and GT or LT are set, return false
 // - If EQ
 //   - If GT, and EQ does not satisfy GT, return true (null set)
 //   - If LT, and EQ does not satisfy LT, return true (null set)
@@ -5852,13 +5859,16 @@ const compare = __webpack_require__(309)
 // - If GT
 //   - If GT.semver is lower than any > or >= comp in C, return false
 //   - If GT is >=, and GT.semver does not satisfy every C, return false
+//   - If GT.semver has a prerelease, and not in prerelease mode
+//     - If no C has a prerelease and the GT.semver tuple, return false
 // - If LT
 //   - If LT.semver is greater than any < or <= comp in C, return false
 //   - If LT is <=, and LT.semver does not satisfy every C, return false
-// - If any C is a = range, and GT or LT are set, return false
+//   - If GT.semver has a prerelease, and not in prerelease mode
+//     - If no C has a prerelease and the LT.semver tuple, return false
 // - Else return true
 
-const subset = (sub, dom, options) => {
+const subset = (sub, dom, options = {}) => {
   if (sub === dom)
     return true
 
@@ -5887,8 +5897,21 @@ const simpleSubset = (sub, dom, options) => {
   if (sub === dom)
     return true
 
-  if (sub.length === 1 && sub[0].semver === ANY)
-    return dom.length === 1 && dom[0].semver === ANY
+  if (sub.length === 1 && sub[0].semver === ANY) {
+    if (dom.length === 1 && dom[0].semver === ANY)
+      return true
+    else if (options.includePrerelease)
+      sub = [ new Comparator('>=0.0.0-0') ]
+    else
+      sub = [ new Comparator('>=0.0.0') ]
+  }
+
+  if (dom.length === 1 && dom[0].semver === ANY) {
+    if (options.includePrerelease)
+      return true
+    else
+      dom = [ new Comparator('>=0.0.0') ]
+  }
 
   const eqSet = new Set()
   let gt, lt
@@ -5931,10 +5954,32 @@ const simpleSubset = (sub, dom, options) => {
 
   let higher, lower
   let hasDomLT, hasDomGT
+  // if the subset has a prerelease, we need a comparator in the superset
+  // with the same tuple and a prerelease, or it's not a subset
+  let needDomLTPre = lt &&
+    !options.includePrerelease &&
+    lt.semver.prerelease.length ? lt.semver : false
+  let needDomGTPre = gt &&
+    !options.includePrerelease &&
+    gt.semver.prerelease.length ? gt.semver : false
+  // exception: <1.2.3-0 is the same as <1.2.3
+  if (needDomLTPre && needDomLTPre.prerelease.length === 1 &&
+      lt.operator === '<' && needDomLTPre.prerelease[0] === 0) {
+    needDomLTPre = false
+  }
+
   for (const c of dom) {
     hasDomGT = hasDomGT || c.operator === '>' || c.operator === '>='
     hasDomLT = hasDomLT || c.operator === '<' || c.operator === '<='
     if (gt) {
+      if (needDomGTPre) {
+        if (c.semver.prerelease && c.semver.prerelease.length &&
+            c.semver.major === needDomGTPre.major &&
+            c.semver.minor === needDomGTPre.minor &&
+            c.semver.patch === needDomGTPre.patch) {
+          needDomGTPre = false
+        }
+      }
       if (c.operator === '>' || c.operator === '>=') {
         higher = higherGT(gt, c, options)
         if (higher === c && higher !== gt)
@@ -5943,6 +5988,14 @@ const simpleSubset = (sub, dom, options) => {
         return false
     }
     if (lt) {
+      if (needDomLTPre) {
+        if (c.semver.prerelease && c.semver.prerelease.length &&
+            c.semver.major === needDomLTPre.major &&
+            c.semver.minor === needDomLTPre.minor &&
+            c.semver.patch === needDomLTPre.patch) {
+          needDomLTPre = false
+        }
+      }
       if (c.operator === '<' || c.operator === '<=') {
         lower = lowerLT(lt, c, options)
         if (lower === c && lower !== lt)
@@ -5963,6 +6016,12 @@ const simpleSubset = (sub, dom, options) => {
   if (lt && hasDomGT && !gt && gtltComp !== 0)
     return false
 
+  // we needed a prerelease range in a specific tuple, but didn't get one
+  // then this isn't a subset.  eg >=1.2.3-pre is not a subset of >=1.0.0,
+  // because it includes prereleases in the 1.2.3 tuple
+  if (needDomGTPre || needDomLTPre)
+    return false
+
   return true
 }
 

docker-bake.hcl

@@ -1,54 +1,67 @@
+variable "NODE_VERSION" {
+  default = "12"
+}
+
+target "node-version" {
+  args = {
+    NODE_VERSION = NODE_VERSION
+  }
+}
+
 group "default" {
   targets = ["build"]
 }
 
 group "pre-checkin" {
-  targets = ["update-yarn", "format", "build"]
+  targets = ["vendor-update", "format", "build"]
 }
 
 group "validate" {
-  targets = ["validate-format", "validate-build", "validate-yarn"]
-}
-
-target "dockerfile" {
-  dockerfile = "Dockerfile.dev"
-}
-
-target "update-yarn" {
-  inherits = ["dockerfile"]
-  target = "update-yarn"
-  output = ["."]
+  targets = ["format-validate", "build-validate", "vendor-validate"]
 }
 
 target "build" {
-  inherits = ["dockerfile"]
-  target = "dist"
+  inherits = ["node-version"]
+  dockerfile = "./hack/build.Dockerfile"
+  target = "build-update"
   output = ["."]
 }
 
-target "test" {
-  inherits = ["dockerfile"]
-  target = "test-coverage"
-  output = ["."]
+target "build-validate" {
+  inherits = ["node-version"]
+  dockerfile = "./hack/build.Dockerfile"
+  target = "build-validate"
 }
 
 target "format" {
-  inherits = ["dockerfile"]
-  target = "format"
+  inherits = ["node-version"]
+  dockerfile = "./hack/build.Dockerfile"
+  target = "format-update"
   output = ["."]
 }
 
-target "validate-format" {
-  inherits = ["dockerfile"]
-  target = "validate-format"
+target "format-validate" {
+  inherits = ["node-version"]
+  dockerfile = "./hack/build.Dockerfile"
+  target = "format-validate"
 }
 
-target "validate-build" {
-  inherits = ["dockerfile"]
-  target = "validate-build"
+target "vendor-update" {
+  inherits = ["node-version"]
+  dockerfile = "./hack/vendor.Dockerfile"
+  target = "update"
+  output = ["."]
 }
 
-target "validate-yarn" {
-  inherits = ["dockerfile"]
-  target = "validate-yarn"
+target "vendor-validate" {
+  inherits = ["node-version"]
+  dockerfile = "./hack/vendor.Dockerfile"
+  target = "validate"
+}
+
+target "test" {
+  inherits = ["node-version"]
+  dockerfile = "./hack/test.Dockerfile"
+  target = "test-coverage"
+  output = ["./coverage"]
 }

hack/build.Dockerfile

@@ -0,0 +1,42 @@
+# syntax=docker/dockerfile:1.2
+ARG NODE_VERSION
+
+FROM node:${NODE_VERSION}-alpine AS base
+RUN apk add --no-cache cpio findutils git
+WORKDIR /src
+
+FROM base AS deps
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn install
+
+FROM deps AS build
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn run build && mkdir /out && cp -Rf dist /out/
+
+FROM scratch AS build-update
+COPY --from=build /out /
+
+FROM build AS build-validate
+RUN --mount=type=bind,target=.,rw \
+  git add -A && cp -rf /out/* .; \
+  if [ -n "$(git status --porcelain -- dist)" ]; then \
+    echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'; \
+    git status --porcelain -- dist; \
+    exit 1; \
+  fi
+
+FROM deps AS format
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn run format \
+  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' | cpio -pdm /out
+
+FROM scratch AS format-update
+COPY --from=format /out /
+
+FROM deps AS format-validate
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn run format-check \

hack/test.Dockerfile

@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1.2
+ARG NODE_VERSION
+
+FROM node:${NODE_VERSION}-alpine AS base
+RUN apk add --no-cache git
+WORKDIR /src
+
+FROM base AS deps
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn install
+
+FROM deps AS test
+ENV RUNNER_TEMP=/tmp/github_runner
+ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  --mount=type=bind,from=crazymax/docker,source=/usr/libexec/docker/cli-plugins/docker-buildx,target=/usr/libexec/docker/cli-plugins/docker-buildx \
+  --mount=type=bind,from=crazymax/docker,source=/usr/local/bin/docker,target=/usr/bin/docker \
+  yarn run test --coverageDirectory=/tmp/coverage
+
+FROM scratch AS test-coverage
+COPY --from=test /tmp/coverage /

hack/vendor.Dockerfile

@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1.2
+ARG NODE_VERSION
+
+FROM node:${NODE_VERSION}-alpine AS base
+RUN apk add --no-cache git
+WORKDIR /src
+
+FROM base AS vendored
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn install && mkdir /out && cp yarn.lock /out
+
+FROM scratch AS update
+COPY --from=vendored /out /
+
+FROM vendored AS validate
+RUN --mount=type=bind,target=.,rw \
+  git add -A && cp -rf /out/* .; \
+  if [ -n "$(git status --porcelain -- yarn.lock)" ]; then \
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'; \
+    git status --porcelain -- yarn.lock; \
+    exit 1; \
+  fi

package.json

@@ -30,8 +30,8 @@
   "dependencies": {
     "@actions/core": "^1.2.6",
     "@actions/exec": "^1.0.4",
-    "csv-parse": "^4.15.0",
-    "semver": "^7.3.4"
+    "csv-parse": "^4.15.3",
+    "semver": "^7.3.5"
   },
   "devDependencies": {
     "@types/jest": "^26.0.3",

yarn.lock

@@ -1114,10 +1114,10 @@ cssstyle@^2.2.0:
   dependencies:
     cssom "~0.3.6"
 
-csv-parse@^4.15.0:
-  version "4.15.0"
-  resolved "https://registry.yarnpkg.com/csv-parse/-/csv-parse-4.15.0.tgz#d86d447e88d5f9a539e8768874f89a8d86d8fd78"
-  integrity sha512-y2wGeU/ybvUlyw6F+eanM6lxxE4JthCuHuaoTgPXdw6ImmfYXqtP0nrCLqd6Ew/a0FgPEz36y5HznI0W5oJ+cg==
+csv-parse@^4.15.3:
+  version "4.15.3"
+  resolved "https://registry.yarnpkg.com/csv-parse/-/csv-parse-4.15.3.tgz#8a62759617a920c328cb31c351b05053b8f92b10"
+  integrity sha512-jlTqDvLdHnYMSr08ynNfk4IAUSJgJjTKy2U5CQBSu4cN9vQOJonLVZP4Qo4gKKrIgIQ5dr07UwOJdi+lRqT12w==
 
 dashdash@^1.12.0:
   version "1.14.1"
@@ -3108,10 +3108,10 @@ saxes@^5.0.0:
   resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7"
   integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==
 
-semver@7.x, semver@^7.3.2, semver@^7.3.4:
-  version "7.3.4"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.4.tgz#27aaa7d2e4ca76452f98d3add093a72c943edc97"
-  integrity sha512-tCfb2WLjqFAtXn4KEdxIhalnRtoKFN7nAwj0B3ZXCbQloV2tq5eDbcTmT68JJD3nRJq24/XgxtQKFIpQdtvmVw==
+semver@7.x, semver@^7.3.2, semver@^7.3.5:
+  version "7.3.5"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.5.tgz#0b621c879348d8998e4b0e4be94b3f12e6018ef7"
+  integrity sha512-PoeGJYh8HK4BTO/a9Tf6ZG3veo/A7ZVsYrSA6J8ny9nb3B1VrpkuN+z9OE5wfE5p6H4LchYZsegiQgbJD94ZFQ==
   dependencies:
     lru-cache "^6.0.0"