chore: default read permissions

Author: fengmk2

.github/workflows/release.yml

@@ -2,12 +2,17 @@ name: Release
 
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - 09-17-chore_default_read_permissions
 
 permissions: {}
 
 jobs:
   build-rust:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -121,7 +126,7 @@ jobs:
           sed -i 's/"version": "0.0.0"/"version": "0.0.0-${{ github.sha }}"/' packages/cli/package.json
 
       # Setup node correctly for publishing to github registry
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: .node-version
           registry-url: "https://npm.pkg.github.com"

package.json

@@ -9,7 +9,7 @@
     "copy-bindings": "cp -r ./packages/cli/binding/*.node ./packages/cli/dist && cp -r ./packages/cli/binding/*.node ./packages/global/dist",
     "install-global-cli": "npm install -g ./packages/global",
     "typecheck": "tsc -b tsconfig.json",
-    "lint": "vite lint && vite run typecheck",
+    "lint": "vite lint --type-aware && vite run typecheck",
     "test": "vite test && pnpm -r snap-test",
     "prepare": "husky"
   },

packages/global/package.json

@@ -22,12 +22,12 @@
     "snap-test": "snap-test"
   },
   "dependencies": {
+    "@voidzero-dev/vite-plus": "workspace:*",
     "oxlint": "catalog:",
     "rolldown-vite": "catalog:",
     "vitest": "catalog:"
   },
   "devDependencies": {
-    "@voidzero-dev/vite-plus": "workspace:*",
     "@voidzero-dev/vite-plus-tools": "workspace:",
     "rolldown": "catalog:"
   },