Skip to content

Commit 6a8ea42

Browse files
jonobr1jonobr1
committed
Merge branch 'dev' into 796-vuepress-2x
2 parents bfd226c + 80fb368 commit 6a8ea42

14 files changed

Lines changed: 9566 additions & 6492 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# CODEOWNERS — all files require review from the project maintainer.
2+
# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
3+
4+
* @jonobr1

‎.github/dependabot.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
version: 2
2+
3+
updates:
4+
# Root npm package
5+
- package-ecosystem: "npm"
6+
directory: "/"
7+
schedule:
8+
interval: "weekly"
9+
open-pull-requests-limit: 10
10+
groups:
11+
dev-dependencies:
12+
patterns:
13+
- "*"
14+
15+
# tests/types npm package
16+
- package-ecosystem: "npm"
17+
directory: "/tests/types"
18+
schedule:
19+
interval: "weekly"
20+
open-pull-requests-limit: 5
21+
groups:
22+
dev-dependencies:
23+
patterns:
24+
- "*"
25+
26+
# tests/typescript npm package
27+
- package-ecosystem: "npm"
28+
directory: "/tests/typescript"
29+
schedule:
30+
interval: "weekly"
31+
open-pull-requests-limit: 5
32+
groups:
33+
dev-dependencies:
34+
patterns:
35+
- "*"
36+
37+
# GitHub Actions
38+
- package-ecosystem: "github-actions"
39+
directory: "/"
40+
schedule:
41+
interval: "weekly"
42+
open-pull-requests-limit: 10
43+
groups:
44+
github-actions:
45+
patterns:
46+
- "*"

‎.github/workflows/codeql.yml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,16 @@ jobs:
2222
language: [ javascript ]
2323

2424
steps:
25-
# checkout@v5
2625
- name: Checkout repository
27-
uses: jonobr1/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
26+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
2827

29-
# setup-node@v5
3028
- name: Set up Node.js
31-
uses: jonobr1/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
29+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
3230
with:
3331
node-version: '24.14.1'
3432

35-
# cache@v4
3633
- name: Cache node modules
37-
uses: jonobr1/cache@0400d5f644dc74513175e3cd8d07132dd4860809
34+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
3835
with:
3936
path: |
4037
node_modules
@@ -43,19 +40,16 @@ jobs:
4340
- name: Install dependencies
4441
run: npm ci
4542

46-
# codeql-action/init@v3
4743
- name: Initialize CodeQL
48-
uses: jonobr1/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3
44+
uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3
4945
with:
5046
languages: ${{ matrix.language }}
5147
queries: security-and-quality
5248

53-
# codeql-action/autobuild@v3
5449
- name: Autobuild
55-
uses: jonobr1/codeql-action/autobuild@192325c86100d080feab897ff886c34abd4c83a3
50+
uses: github/codeql-action/autobuild@192325c86100d080feab897ff886c34abd4c83a3 # v3
5651

57-
# codeql-action/analyze@v3
5852
- name: Perform CodeQL Analysis
59-
uses: jonobr1/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3
53+
uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3
6054
with:
6155
category: "/language:${{ matrix.language }}"

‎.github/workflows/copilot-setup-steps.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,10 @@ jobs:
1818

1919
steps:
2020
- name: Checkout code
21-
# checkout@v5
22-
uses: jonobr1/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
21+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
2322

2423
- name: Set up Node.js
25-
# setup-node@v5
26-
uses: jonobr1/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
24+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
2725
with:
2826
node-version: "20"
2927
cache: "npm"

‎.github/workflows/lint.yml‎

Lines changed: 34 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,37 @@ jobs:
88
validate:
99
runs-on: ubuntu-latest
1010
steps:
11-
# checkout@v6
12-
- uses: jonobr1/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
13-
# setup-node@v6
14-
- uses: jonobr1/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
15-
with:
16-
node-version: '24.14.1'
17-
cache: 'npm'
18-
- name: Install modules
19-
run: npm ci
20-
- name: Run ESLint
21-
run: npm run lint
22-
- name: Check TypeScript sample
23-
run: npx tsc --noEmit --skipLibCheck tests/typescript/index.ts
11+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
12+
- name: Install modules
13+
run: npm ci
14+
- name: Run ESLint
15+
run: npm run lint
16+
17+
check-dependency-files:
18+
name: Check dependency manifest/lockfile pairs
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
22+
- name: Verify each Dependabot-managed npm directory has package.json and package-lock.json
23+
shell: bash
24+
run: |
25+
dirs=("." "tests/types" "tests/typescript")
26+
ok=true
27+
for dir in "${dirs[@]}"; do
28+
if [ ! -f "$dir/package.json" ]; then
29+
echo "ERROR: $dir/package.json is missing"
30+
ok=false
31+
fi
32+
if [ ! -f "$dir/package-lock.json" ]; then
33+
echo "ERROR: $dir/package-lock.json is missing"
34+
ok=false
35+
fi
36+
done
37+
if [ "$ok" != "true" ]; then
38+
echo ""
39+
echo "Every npm directory managed by Dependabot must contain both"
40+
echo "package.json and package-lock.json. Run 'npm install' in the"
41+
echo "affected directory and commit the result."
42+
exit 1
43+
fi
44+
echo "All dependency file pairs are present."

‎.github/workflows/publish.yml‎

Lines changed: 45 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,21 +11,56 @@ jobs:
1111
publish:
1212
runs-on: ubuntu-latest
1313
permissions:
14-
id-token: write # Required for OIDC
15-
contents: read
14+
id-token: write # Required for OIDC (npm provenance + GitHub attestation)
15+
contents: write # Required to create GitHub releases and upload assets
16+
attestations: write # Required for actions/attest-build-provenance
17+
1618
steps:
17-
# checkout@v6
18-
- uses: jonobr1/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
19-
# setup-node@v6
20-
- uses: jonobr1/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
19+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
20+
- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
2121
with:
2222
node-version: '24.14.1'
2323
registry-url: 'https://registry.npmjs.org'
2424

2525
# Ensure npm 11.5.1 or later is installed
2626
- name: Update npm
27-
run: npm install -g npm@latest
27+
run: npm install -g npm@11.5.1
2828
- run: npm ci
29-
- run: npm run build --if-present
30-
# - run: npm test
31-
- run: npm publish
29+
- run: npm run build
30+
31+
- name: Generate SLSA provenance attestation
32+
id: attest
33+
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
34+
with:
35+
subject-path: |
36+
build/two.js
37+
build/two.module.js
38+
build/two.min.js
39+
40+
- name: Stage provenance bundle for release
41+
env:
42+
BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
43+
TAG: ${{ github.ref_name }}
44+
run: cp "$BUNDLE_PATH" "two.js-${TAG}.intoto.jsonl"
45+
46+
- name: Upload provenance bundle as artifact
47+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
48+
with:
49+
name: provenance-bundle-${{ github.ref_name }}
50+
path: two.js-${{ github.ref_name }}.intoto.jsonl
51+
52+
- name: Publish to npm with provenance
53+
run: npm publish --provenance
54+
55+
- name: Create GitHub Release
56+
env:
57+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
TAG: ${{ github.ref_name }}
59+
run: |
60+
gh release create "$TAG" \
61+
--title "Official Stable Release of $TAG" \
62+
--generate-notes \
63+
build/two.js \
64+
build/two.module.js \
65+
build/two.min.js \
66+
"two.js-${TAG}.intoto.jsonl"

‎.github/workflows/scorecard.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,19 +20,19 @@ jobs:
2020

2121
steps:
2222
- name: Checkout code
23-
uses: jonobr1/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
23+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2424
with:
2525
persist-credentials: false
2626

2727
- name: Run Scorecard analysis
28-
uses: jonobr1/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
28+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
2929
with:
3030
results_file: results.sarif
3131
results_format: sarif
3232
publish_results: true
3333

3434
- name: Upload results to GitHub Security tab
35-
uses: jonobr1/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.35.1
35+
uses: github/codeql-action/upload-sarif@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3.35.1
3636
with:
3737
sarif_file: results.sarif
3838
wait-for-processing: true

0 commit comments

Comments
 (0)