ci: harden CI and automate the release scripts

.github/workflows/ci.yml

@@ -13,9 +13,9 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: voidzero-dev/setup-vp@v1.18.0
+      - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:
           node-version: "24"
           cache: true
@@ -33,3 +33,15 @@ jobs:
       - run: vp run type-perf
 
       - run: vp run ts-compatibility
+
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      # The versions pinned in mise.toml, so CI lints with the ones the hook runs.
+      - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        with:
+          install_args: actionlint shellcheck
+
+      - run: actionlint

.github/workflows/docs.yml

@@ -31,15 +31,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: voidzero-dev/setup-vp@v1.18.0
+      - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:
           node-version: "24"
           cache: true
 
       # mdbook and mdbook-linkcheck2, pinned in mise.toml.
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
 
       - run: vp install
 

.github/workflows/release.yml

@@ -9,20 +9,20 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write # the release is created below
-      id-token: write # npm provenance
+      id-token: write # npm trusted publishing and provenance
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0 # needed to check the tag is an ancestor of main
 
-      - uses: voidzero-dev/setup-vp@v1.18.0
+      - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:
           node-version: "24"
           cache: true
           registry-url: "https://registry.npmjs.org"
 
       # setup-vp puts `vp` on PATH but not pnpm, which the publish step needs.
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: 11.25.0
 
@@ -50,10 +50,9 @@ jobs:
           pkg="$(node -p "require('./package.json').version")"
           test "$tag" = "$pkg" || { echo "tag $tag != package.json $pkg"; exit 1; }
 
-      # --no-git-checks: the tag is checked out detached, not on the publish branch.
+      # No token: npm trusts this workflow through OIDC. --no-git-checks: the tag is checked out
+      # detached, not on the publish branch.
       - run: pnpm publish --provenance --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       # Last: a release pointing at a version npm rejected would be a lie. The notes come from the
       # PRs merged since the previous tag, grouped by `.github/release.yml`.
@@ -72,25 +71,27 @@ jobs:
     concurrency:
       group: gh-pages # two releases must not push the site at once
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: voidzero-dev/setup-vp@v1.18.0
+      - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:
           node-version: "24"
           cache: true
 
       # mdbook and mdbook-linkcheck2, pinned in mise.toml.
-      - uses: jdx/mise-action@v3
+      - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
 
       - run: vp install
 
       - run: vp run docs:build
 
       - name: Check out the published site
         run: |
-          git fetch --quiet origin gh-pages &&
-            git worktree add site FETCH_HEAD ||
+          if git fetch --quiet origin gh-pages; then
+            git worktree add site FETCH_HEAD
+          else
             git worktree add --orphan -b gh-pages site
+          fi
 
       - name: Add this version
         run: |

mise.toml

@@ -4,6 +4,10 @@ mdbook = "0.5.4"
 # Upstream ships a linux-x64 binary only, and the source build takes minutes.
 "github:marxin/mdbook-linkcheck2" = { version = "0.13.0", os = ["linux/x64"] }
 "cargo:mdbook-linkcheck2" = { version = "0.13.0", os = ["macos", "linux/arm64"] }
+pinact = "5.0.0"
+actionlint = "1.7.12"
+# actionlint runs it over each `run:` script.
+shellcheck = "0.11.0"
 
 [settings]
 lockfile = true

package.json

@@ -51,8 +51,8 @@
     "type-perf": "node scripts/type-perf/index.ts",
     "prepublishOnly": "vp run build",
     "prepare": "vp config && vp fmt AGENTS.md",
-    "bump-version": "git branch --show-current | grep -qxv main || { echo 'run this on a branch, not main'; exit 1; }; bumpp --no-tag",
-    "push-tag": "git branch --show-current | grep -qx main || { echo 'run this on main'; exit 1; }; git diff --quiet HEAD -- || { echo 'tracked files differ from HEAD; commit them before tagging'; exit 1; }; git tag v$npm_package_version && git push origin v$npm_package_version"
+    "bump-version": "scripts/bump-version.sh",
+    "push-tag": "git diff --quiet HEAD -- || { echo 'tracked files differ from HEAD; commit them before tagging'; exit 1; }; git switch main && git pull --ff-only && tag=v$(node -p \"require('./package.json').version\") && git tag $tag && git push origin $tag"
   },
   "devDependencies": {
     "@types/node": "^26.5.0",

scripts/bump-version.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+# Bumps the version on a release branch cut from the latest main, and opens its PR.
+set -eu
+
+git diff --quiet HEAD -- || { echo 'tracked files differ from HEAD; commit them first'; exit 1; }
+
+git switch main
+git pull --ff-only
+
+# bumpp only picks the version; the branch is named after it, so it is cut afterwards.
+bumpp --no-commit --no-tag --no-push
+version="$(node -p "require('./package.json').version")"
+
+git switch -c "chore/release-$version"
+git commit -am "chore: release v$version"
+git push -u origin HEAD
+gh pr create --fill --label skip-changelog

vite.config.ts

@@ -5,6 +5,7 @@ import lint from "./oxlint.config.ts";
 export default defineConfig({
   staged: {
     "*": "vp check --fix",
+    ".github/workflows/*.yml": "actionlint",
   },
   pack: {
     // Named, so the import path is the name a user writes rather than where the file sits.