ci: update PRs merge themselves when they ship nothing, and report the rest

.github/dependabot.yml

@@ -6,8 +6,19 @@
 # A merge to main is a release (auto-release.yml) when it changes what the
 # extension ships - a vendored library such as pako does, a test or build tool
 # does not and merges without one. Minor and patch updates are grouped into one
-# PR per ecosystem per week; a major update still gets a PR of its own, because
-# it is a decision rather than routine.
+# PR per week; a major update still gets a PR of its own, because it is a
+# decision rather than routine.
+#
+# What happens to each PR once CI has run is update-prs.yml's job: a red one is
+# reported to the owner, a green one merged when it is routine - minor or patch,
+# package.json and pnpm-lock.yaml only, and the built extension identical to the
+# latest release, so nothing reaches Firefox - and otherwise handed to the owner.
+# The libraries the extension ships (tools/sync-vendor.mjs copies them into it)
+# are grouped apart for that reason, so a tooling update is not held back by one.
+#
+# cooldown: a release is proposed once it is 5 days old. A package taken over to
+# publish malware is usually caught and pulled within days, and routine PRs now
+# merge without anyone reading them. Security updates skip the wait.
 #
 # Security updates are separate from this file (Settings > Code security >
 # Dependabot security updates) and still open a PR for any vulnerable package,
@@ -18,11 +29,19 @@ updates:
     directory: '/'
     schedule:
       interval: 'weekly'
+    cooldown:
+      default-days: 5
     open-pull-requests-limit: 10
     labels:
       - 'dependencies'
     groups:
-      npm-minor-and-patch:
+      # Keep in step with tools/sync-vendor.mjs: the unpatched libraries it copies.
+      # The patched ones are ignored below.
+      shipped-minor-and-patch:
+        patterns: ['fuse.js', 'pako', 'sortablejs']
+        update-types: ['minor', 'patch']
+      tooling-minor-and-patch:
+        exclude-patterns: ['fuse.js', 'pako', 'sortablejs']
         update-types: ['minor', 'patch']
     # These libraries ship with a pnpm patch (pnpm-workspace.yaml,
     # patchedDependencies), and each patch is keyed to its exact version. A bump
@@ -57,12 +76,16 @@ updates:
   # so a moved or hijacked tag cannot change what runs next to the AMO signing
   # keys. Nothing arrives on its own any more; Dependabot updates the SHA and
   # the comment together - minor and patch releases as one grouped PR a week, a
-  # new major on its own. (The actionlint image in ci.yml is pinned by digest;
-  # bump it by hand with actionlint's release.)
+  # new major on its own. These always wait for the owner: they change workflow
+  # files, which are reviewed by a person (and which a workflow's token may not
+  # merge). (The actionlint image in ci.yml is pinned by digest; bump it by hand
+  # with actionlint's release.)
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
       interval: 'weekly'
+    cooldown:
+      default-days: 5
     open-pull-requests-limit: 5
     labels:
       - 'dependencies'

.github/workflows/amo-signing-failsafe.yml

@@ -172,7 +172,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         if: steps.release.outputs.complete == 'true'
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
 
       - name: Check the update path Firefox follows
@@ -230,7 +230,7 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         if: steps.release.outputs.complete == 'false'
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm
 

.github/workflows/ci.yml

@@ -67,12 +67,14 @@ jobs:
       # local installs cannot drift apart.
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      # check-latest: otherwise the action takes the Node 22 cached in the runner
-      # image, which lags - 22.23.2 on 2026-09-25, two days after 22.23.3 was out.
-      # Every workflow here asks for the newest, as tools/linux/setup.sh does.
+      # The Node major is .nvmrc's, in every workflow: a Node update is a one-line
+      # change to that file, which the toolchain workflow's token may push (it may not
+      # edit a workflow). check-latest: otherwise the action takes the Node cached in
+      # the runner image, which lags - 22.23.2 on 2026-09-25, two days after 22.23.3
+      # was out. Every workflow here asks for the newest, as tools/linux/setup.sh does.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm
 
@@ -190,7 +192,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm
 

.github/workflows/firefox-beta.yml

@@ -54,7 +54,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm
 

.github/workflows/firefox-stable.yml

@@ -77,7 +77,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm
 

.github/workflows/live-streams.yml

@@ -53,7 +53,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm
 

.github/workflows/patched-libraries.yml

@@ -19,7 +19,9 @@ name: Patched libraries
 # is never raised twice, as an issue or a pull request, open or closed: closing one is how
 # a version is skipped (a major rewrite not worth porting, say), and it stays closed.
 # Both are closed on their own once the patched version has caught up with them, however
-# that happened, or the library is no longer patched.
+# that happened, or the library is no longer patched. A newer version supersedes them: its
+# pull request closes the library's older issue and pull request, its issue only the older
+# issue (an older pull request is still a step forward while the newer version needs work).
 
 on:
   schedule:
@@ -57,7 +59,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm
 
@@ -79,8 +81,8 @@ jobs:
 
           # --- Close what has been caught up with: issues, and pull requests.
           for kind in issue pr; do
-            gh "$kind" list --state open --limit 200 --json number,title \
-              --jq ".[] | select(.title | startswith(\"$PREFIX\")) | \"\(.number) \(.title[${#PREFIX}:])\"" |
+            gh "$kind" list --state open --limit 200 --json number,title,author \
+              --jq ".[] | select((.title | startswith(\"$PREFIX\")) and .author.login == \"app/github-actions\") | \"\(.number) \(.title[${#PREFIX}:])\"" |
             while read -r number name version; do
               current=$(jq -r --arg n "$name" 'select(.name == $n) | .current' "$RUNNER_TEMP/libraries.jsonl")
               if [ -z "$current" ]; then
@@ -93,17 +95,53 @@ jobs:
             done
           done
 
+          # --- Supersede. An open pull request replaces its library's older open issues and pull
+          # requests; an open issue, only its older issues (an older pull request is still a step
+          # forward while the newer version needs work). On every run, and again after raising,
+          # so a close that failed once is done the next time.
+          supersede() {
+            {
+              gh pr list --state open --limit 200 --json number,title,url,author \
+                --jq ".[] | select((.title | startswith(\"$PREFIX\")) and .author.login == \"app/github-actions\") | \"pr \(.number) \(.url) \(.title[${#PREFIX}:])\""
+              gh issue list --state open --limit 200 --json number,title,url,author \
+                --jq ".[] | select((.title | startswith(\"$PREFIX\")) and .author.login == \"app/github-actions\") | \"issue \(.number) \(.url) \(.title[${#PREFIX}:])\""
+            } > "$RUNNER_TEMP/open-items.txt"
+            local kind number name version k url n v by by_url
+            while read -r kind number _ name version <&3; do
+              by=''
+              by_url=''
+              while read -r k _ url n v; do
+                if [ "$n" != "$name" ] || [ "$v" = "$version" ]; then continue; fi
+                if [ "$kind" = pr ] && [ "$k" = issue ]; then continue; fi
+                if [ "$(printf '%s\n%s\n' "$version" "$v" | sort -V | tail -1)" != "$v" ]; then continue; fi
+                if [ -z "$by" ] || [ "$(printf '%s\n%s\n' "$by" "$v" | sort -V | tail -1)" = "$v" ]; then
+                  by=$v
+                  by_url=$url
+                fi
+              done < "$RUNNER_TEMP/open-items.txt"
+              if [ -z "$by" ]; then continue; fi
+              if [ "$kind" = pr ]; then
+                gh pr close "$number" --delete-branch --comment "Superseded by $name $by: $by_url" ||
+                  echo "::warning::Could not close #$number as superseded by $name $by; the next run tries again."
+              else
+                gh issue close "$number" --comment "Superseded by $name $by: $by_url" ||
+                  echo "::warning::Could not close #$number as superseded by $name $by; the next run tries again."
+              fi
+            done 3< "$RUNNER_TEMP/open-items.txt"
+          }
+          supersede
+
           if [ "$EVENT" = push ]; then
             echo 'A push only closes; the daily run re-cuts.'
             exit 0
           fi
 
-          # --- Every title raised before, as an issue or a pull request, open or closed. The
-          # whole lists, filtered exactly: the search index can lag behind one made minutes ago.
-          {
-            gh issue list --state all --limit 1000 --json title --jq '.[].title'
-            gh pr list --state all --limit 1000 --json title --jq '.[].title'
-          } > "$RUNNER_TEMP/titles.txt"
+          # --- Every title raised before, as an issue or a pull request, open or closed: the issues
+          # endpoint lists pull requests too, and pages through all of them. Not the search index,
+          # which can lag behind one made minutes ago.
+          # Only this workflow's own: anyone's pull request with such a title blocks nothing.
+          gh api --paginate "repos/$GITHUB_REPOSITORY/issues?state=all&per_page=100" \
+            --jq '.[] | select(.user.login == "github-actions[bot]") | .title' > "$RUNNER_TEMP/titles.txt"
 
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
@@ -173,3 +211,4 @@ jobs:
             git checkout -q -f "$start"
             git clean -q -fd
           done 3< "$RUNNER_TEMP/behind.jsonl"
+          supersede

.github/workflows/release.yml

@@ -67,7 +67,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           check-latest: true
           cache: pnpm