From 2fcac946f8a252f903af2be05f21bac31105db80 Mon Sep 17 00:00:00 2001 From: Santiago Molina Date: Fri, 21 Aug 2026 11:01:47 -0500 Subject: [PATCH 1/2] chore: harden repository automation --- .cspell.json | 2 +- .github/dependabot.yml | 9 +- .github/labeler.yml | 20 -- .github/workflows/changeset-check.yml | 43 ---- .github/workflows/ci.yml | 227 ++++++++++++++++----- .github/workflows/codeql.yml | 32 ++- .github/workflows/deploy-docs.yml | 66 ------ .github/workflows/infisical-connection.yml | 27 --- .github/workflows/labeler.yml | 18 -- .github/workflows/pr-title.yml | 40 ---- .github/workflows/release.yml | 45 +++- package.json | 1 + pnpm-lock.yaml | 82 ++++---- pnpm-workspace.yaml | 10 +- 14 files changed, 302 insertions(+), 320 deletions(-) delete mode 100644 .github/labeler.yml delete mode 100644 .github/workflows/changeset-check.yml delete mode 100644 .github/workflows/deploy-docs.yml delete mode 100644 .github/workflows/infisical-connection.yml delete mode 100644 .github/workflows/labeler.yml delete mode 100644 .github/workflows/pr-title.yml diff --git a/.cspell.json b/.cspell.json index 5f3c3fe..74664ee 100644 --- a/.cspell.json +++ b/.cspell.json @@ -4,7 +4,6 @@ "useGitignore": true, "ignorePaths": ["apps/docs/public/**/*.svg", "pnpm-lock.yaml"], "words": [ - "amannn", "astrojs", "Autobuild", "autorelease", @@ -23,6 +22,7 @@ "publint", "santi", "Turborepo", + "undici", "unrs", "vitest", "workerd", diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 47d4931..3f56e6e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,11 +3,16 @@ updates: - package-ecosystem: npm directory: / schedule: - interval: weekly + interval: monthly groups: development-dependencies: dependency-type: development + open-pull-requests-limit: 2 - package-ecosystem: github-actions directory: / schedule: - interval: weekly + interval: monthly + groups: + actions: + patterns: ["*"] + open-pull-requests-limit: 2 diff --git a/.github/labeler.yml b/.github/labeler.yml deleted file mode 100644 index 8eb42fb..0000000 --- a/.github/labeler.yml +++ /dev/null @@ -1,20 +0,0 @@ -cli: - - changed-files: - - any-glob-to-any-file: "packages/commitprompt/**" - -docs: - - changed-files: - - any-glob-to-any-file: "apps/docs/**" - -ci: - - changed-files: - - any-glob-to-any-file: ".github/**" - -dependencies: - - changed-files: - - any-glob-to-any-file: - - "package.json" - - "packages/*/package.json" - - "apps/*/package.json" - - "pnpm-lock.yaml" - - "pnpm-workspace.yaml" diff --git a/.github/workflows/changeset-check.yml b/.github/workflows/changeset-check.yml deleted file mode 100644 index 149086d..0000000 --- a/.github/workflows/changeset-check.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Changeset Check - -on: - pull_request: - branches: [main] - types: [opened, synchronize, reopened, labeled, unlabeled] - -permissions: - contents: read - -concurrency: - group: changeset-check-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -jobs: - changeset: - name: Require changeset - runs-on: ubuntu-latest - timeout-minutes: 10 - if: >- - ${{ - !contains(github.event.pull_request.labels.*.name, 'skip-changelog') && - !startsWith(github.head_ref, 'changeset-release/') - }} - steps: - - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Install pnpm - uses: pnpm/action-setup@v6 - - - name: Setup Node.js - uses: actions/setup-node@v6 - with: - node-version: 22.x - cache: pnpm - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - - name: Assert changeset present - run: pnpm changeset status --since=origin/main diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a28d63d..0dcd7fc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,8 @@ on: branches: [main] pull_request: branches: [main] + types: [opened, synchronize, reopened, edited, labeled, unlabeled] + workflow_dispatch: {} permissions: contents: read @@ -14,81 +16,206 @@ concurrency: cancel-in-progress: true jobs: - build: - name: Build and validate + changes: + name: Detect affected areas runs-on: ubuntu-latest - timeout-minutes: 15 - strategy: - matrix: - node-version: [22.x, 24.x] + outputs: + docs: ${{ steps.paths.outputs.docs }} + package: ${{ steps.paths.outputs.package }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 + with: + fetch-depth: 2 + - id: paths + name: Classify changed paths + env: + BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }} + run: | + if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then + echo "docs=true" >> "$GITHUB_OUTPUT" + echo "package=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + if [[ "$BASE_SHA" == "0000000000000000000000000000000000000000" ]]; then + BASE_SHA="$(git rev-parse HEAD^)" + fi + git fetch --no-tags --depth=1 origin "$BASE_SHA" + git diff --name-only "$BASE_SHA" HEAD > /tmp/changed-files + if grep -Eq '^(apps/docs/|packages/|\.github/workflows/ci\.yml$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|turbo\.json$|tsconfig\.base\.json$|wrangler\.jsonc$)' /tmp/changed-files; then + echo "docs=true" >> "$GITHUB_OUTPUT" + else + echo "docs=false" >> "$GITHUB_OUTPUT" + fi + if grep -Eq '^(packages/commitprompt/|scripts/|\.github/workflows/ci\.yml$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|turbo\.json$|tsconfig\.base\.json$|eslint\.config\.)' /tmp/changed-files; then + echo "package=true" >> "$GITHUB_OUTPUT" + else + echo "package=false" >> "$GITHUB_OUTPUT" + fi + + full: + name: Full validation (22.x) + needs: changes + runs-on: ubuntu-latest + timeout-minutes: 20 env: TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} TURBO_TEAM: ${{ secrets.TURBO_TEAM }} steps: - - uses: actions/checkout@v6 - - - name: Install pnpm - uses: pnpm/action-setup@v6 - - - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 with: - node-version: ${{ matrix.node-version }} - cache: pnpm - - - name: Cache Turborepo - uses: actions/cache@v5 + fetch-depth: 0 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0 with: - path: .turbo - key: ${{ runner.os }}-turbo-${{ matrix.node-version }}-${{ hashFiles('pnpm-lock.yaml', 'turbo.json') }} - restore-keys: | - ${{ runner.os }}-turbo-${{ matrix.node-version }}- - ${{ runner.os }}-turbo- - + node-version: 22.x + cache: pnpm - name: Install dependencies run: pnpm install --frozen-lockfile - + - name: Audit dependencies + run: pnpm audit --audit-level moderate - name: Install accessibility test browser run: pnpm --filter commitprompt-docs exec playwright install --with-deps chromium - - - name: Run package checks + - name: Validate pull request title + if: github.event_name == 'pull_request' + env: + PR_TITLE: ${{ github.event.pull_request.title }} + run: printf '%s\n' "$PR_TITLE" | pnpm exec commitlint + - name: Require a changeset + if: >- + github.event_name == 'pull_request' && + !contains(github.event.pull_request.labels.*.name, 'skip-changelog') && + !startsWith(github.head_ref, 'changeset-release/') + run: pnpm changeset status --since=origin/main + - name: Run package and documentation checks run: pnpm exec turbo run build typecheck lint test:coverage check:exports - - name: Run repository checks - if: matrix.node-version == '22.x' run: pnpm exec turbo run //#lint:repo //#lint:spell //#lint:knip + - name: Check packed installation + run: pnpm run check:packed-install + compatibility: + name: Package compatibility (24.x) + needs: changes + if: needs.changes.outputs.package == 'true' + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0 + with: + node-version: 24.x + cache: pnpm + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build, typecheck, and test the package + run: pnpm exec turbo run build typecheck test --filter=@santi020k/commitprompt - name: Check packed installation - if: matrix.node-version == '22.x' run: pnpm run check:packed-install - windows-smoke: - name: Windows smoke + windows: + name: Windows package smoke + needs: changes + if: needs.changes.outputs.package == 'true' runs-on: windows-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v6 - - - name: Install pnpm - uses: pnpm/action-setup@v6 - - - name: Setup Node.js - uses: actions/setup-node@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0 with: node-version: 22.x cache: pnpm - - name: Install dependencies run: pnpm install --frozen-lockfile - - - name: Install accessibility test browser - run: pnpm --filter commitprompt-docs exec playwright install chromium - - - name: Build and typecheck - run: pnpm exec turbo run build typecheck - - - name: Test - run: pnpm exec turbo run test --concurrency=1 - + - name: Build, typecheck, and test the package + run: pnpm exec turbo run build typecheck test --filter=@santi020k/commitprompt --concurrency=1 - name: Check packed installation run: pnpm run check:packed-install + + deploy-docs: + name: Deploy documentation + needs: [changes, full, compatibility, windows] + if: >- + always() && github.event_name == 'push' && + needs.changes.outputs.docs == 'true' && + needs.full.result == 'success' && + (needs.compatibility.result == 'success' || needs.compatibility.result == 'skipped') && + (needs.windows.result == 'success' || needs.windows.result == 'skipped') + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + id-token: write + environment: + name: docs-production + url: https://commitprompt.santi020k.com + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0 + with: + node-version: 22.x + cache: pnpm + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Fetch production secrets + uses: Infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995 # v1.0.16 + with: + method: oidc + identity-id: ${{ vars.INFISICAL_IDENTITY_ID }} + project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }} + env-slug: prod + secret-path: / + recursive: true + - name: Build and deploy documentation + env: + CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.CLOUDFLARE_PAGES_PROJECT_NAME || 'commitprompt' }} + run: | + test -n "$CLOUDFLARE_API_TOKEN" + test -n "$CLOUDFLARE_ACCOUNT_ID" + pnpm run docs:build + pnpm exec wrangler pages deploy apps/docs/dist \ + --project-name="$CLOUDFLARE_PAGES_PROJECT_NAME" \ + --branch="$GITHUB_REF_NAME" \ + --commit-hash="$GITHUB_SHA" \ + --commit-dirty=true + + gate: + name: Required checks + if: always() + needs: [changes, full, compatibility, windows, deploy-docs] + runs-on: ubuntu-latest + steps: + - name: Verify relevant jobs + env: + CHANGES: ${{ needs.changes.result }} + FULL: ${{ needs.full.result }} + COMPATIBILITY: ${{ needs.compatibility.result }} + WINDOWS: ${{ needs.windows.result }} + DEPLOY: ${{ needs.deploy-docs.result }} + run: | + for result in "$CHANGES" "$FULL" "$COMPATIBILITY" "$WINDOWS" "$DEPLOY"; do + if [[ "$result" != "success" && "$result" != "skipped" ]]; then + exit 1 + fi + done + + report-dispatched-validation: + name: Report dispatched validation + if: github.event_name == 'workflow_dispatch' + needs: gate + runs-on: ubuntu-latest + permissions: + contents: read + statuses: write + steps: + - name: Report successful validation + env: + GH_TOKEN: ${{ github.token }} + run: >- + gh api --method POST + "repos/${GITHUB_REPOSITORY}/statuses/${GITHUB_SHA}" + -f state=success + -f context='Required checks' + -f description='Dispatched release validation passed' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3d3b895..9e39a57 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -3,10 +3,32 @@ name: CodeQL on: push: branches: [main] + paths: + - "packages/**" + - "apps/**" + - "scripts/**" + - "**/*.js" + - "**/*.mjs" + - "**/*.ts" + - "**/*.json" + - "**/*.jsonc" + - "pnpm-lock.yaml" + - ".github/workflows/codeql.yml" pull_request: branches: [main] + paths: + - "packages/**" + - "apps/**" + - "scripts/**" + - "**/*.js" + - "**/*.mjs" + - "**/*.ts" + - "**/*.json" + - "**/*.jsonc" + - "pnpm-lock.yaml" + - ".github/workflows/codeql.yml" schedule: - - cron: "21 7 * * 0" + - cron: "21 7 1 * *" permissions: actions: read @@ -23,17 +45,17 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@4c0873ef8656cb3c50b3f42fb63bc1ade0cfa827 # v4 with: languages: javascript-typescript - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@4c0873ef8656cb3c50b3f42fb63bc1ade0cfa827 # v4 - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@4c0873ef8656cb3c50b3f42fb63bc1ade0cfa827 # v4 with: category: /language:javascript-typescript diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml deleted file mode 100644 index 606ebd3..0000000 --- a/.github/workflows/deploy-docs.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Deploy Docs - -on: - push: - branches: [main] - paths: - - "apps/docs/**" - - "packages/**" - - ".github/workflows/deploy-docs.yml" - - "package.json" - - "pnpm-lock.yaml" - - "pnpm-workspace.yaml" - - "turbo.json" - - "tsconfig.base.json" - - "wrangler.jsonc" - workflow_dispatch: {} - -permissions: - contents: read - -concurrency: - group: deploy-docs-${{ github.ref }} - cancel-in-progress: true - -env: - CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.CLOUDFLARE_PAGES_PROJECT_NAME || 'commitprompt' }} - DOCS_DIST_DIR: apps/docs/dist - NODE_VERSION: 22.x - PUBLIC_SITE_URL: ${{ vars.PUBLIC_SITE_URL || 'https://commitprompt.santi020k.com' }} - -jobs: - build-and-deploy: - name: Build and deploy docs - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@v6 - - - name: Install pnpm - uses: pnpm/action-setup@v6 - - - name: Setup Node.js - uses: actions/setup-node@v6 - with: - node-version: ${{ env.NODE_VERSION }} - cache: pnpm - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - - name: Build docs - run: pnpm run docs:build - - - name: Deploy to Cloudflare Pages - env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - run: | - test -n "$CLOUDFLARE_API_TOKEN" - test -n "$CLOUDFLARE_ACCOUNT_ID" - - pnpm exec wrangler pages deploy "$DOCS_DIST_DIR" \ - --project-name="$CLOUDFLARE_PAGES_PROJECT_NAME" \ - --branch="$GITHUB_REF_NAME" \ - --commit-hash="$GITHUB_SHA" \ - --commit-dirty=true diff --git a/.github/workflows/infisical-connection.yml b/.github/workflows/infisical-connection.yml deleted file mode 100644 index 57387a8..0000000 --- a/.github/workflows/infisical-connection.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Infisical Connection Check - -on: - workflow_dispatch: {} - -permissions: - contents: read - id-token: write - -jobs: - verify: - name: Verify Infisical OIDC - runs-on: ubuntu-latest - steps: - - name: Authenticate and fetch development secrets - uses: Infisical/secrets-action@v1.0.16 - with: - method: oidc - identity-id: ${{ vars.INFISICAL_IDENTITY_ID }} - project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }} - env-slug: dev - secret-path: / - recursive: true - - - name: Confirm connection - run: echo "Infisical OIDC authentication completed successfully." - diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml deleted file mode 100644 index a5097c2..0000000 --- a/.github/workflows/labeler.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: PR Labeler - -on: - pull_request_target: - types: [opened, synchronize, reopened] - -permissions: - contents: read - pull-requests: write - -jobs: - label: - runs-on: ubuntu-latest - timeout-minutes: 5 - steps: - - uses: actions/labeler@v6 - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml deleted file mode 100644 index 7bf2ea0..0000000 --- a/.github/workflows/pr-title.yml +++ /dev/null @@ -1,40 +0,0 @@ -# Managed by the santi020k PR title standard. -name: PR Title - -on: - pull_request_target: - types: [opened, reopened, edited, synchronize, labeled, unlabeled] - -permissions: - pull-requests: read - statuses: write - -jobs: - lint: - name: Lint PR title - runs-on: ubuntu-latest - timeout-minutes: 5 - steps: - - uses: amannn/action-semantic-pull-request@v6 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - types: | - feat - fix - docs - style - chore - refactor - perf - test - ci - build - revert - requireScope: false - subjectPattern: ^(?![A-Z]).+$ - subjectPatternError: > - The subject must start with a lowercase letter. - Example: "feat: add repository-aware prompts" - ignoreLabels: | - autorelease: pending diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 40c7f14..42093be 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,8 +3,15 @@ name: Release on: push: branches: [main] + paths: + - ".changeset/**" + - "packages/*/package.json" + - "packages/*/CHANGELOG.md" workflow_dispatch: {} +permissions: + contents: read + concurrency: group: release cancel-in-progress: false @@ -15,20 +22,37 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 permissions: + actions: write contents: write id-token: write pull-requests: write + environment: release steps: + - name: Fetch publishing secrets + uses: Infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995 # v1.0.16 + with: + method: oidc + identity-id: ${{ vars.INFISICAL_IDENTITY_ID }} + project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }} + env-slug: prod + secret-path: / + recursive: true + + - name: Prepare npm authentication + run: | + test -n "$NPM_TOKEN" + printf 'NODE_AUTH_TOKEN=%s\n' "$NPM_TOKEN" >> "$GITHUB_ENV" + - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 with: fetch-depth: 0 - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0 with: node-version: 22.x registry-url: https://registry.npmjs.org @@ -37,14 +61,11 @@ jobs: - name: Install dependencies run: pnpm install --frozen-lockfile - - name: Install accessibility test browser - run: pnpm --filter commitprompt-docs exec playwright install --with-deps chromium - - name: Create release pull request or publish id: changesets - uses: changesets/action@v1 + uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 with: - publish: pnpm run publish-packages + publish: pnpm run publish-packages:ci version: pnpm run version-packages commit: "chore(release): version packages" title: "chore(release): version packages" @@ -52,10 +73,14 @@ jobs: env: HUSKY: 0 GITHUB_TOKEN: ${{ secrets.CHANGESETS_TOKEN || github.token }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} NPM_CONFIG_PROVENANCE: "true" + - name: Validate release pull request + if: steps.changesets.outputs.pullRequestNumber != '' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run ci.yml --ref changeset-release/main + - name: Create repository version tag if: steps.changesets.outputs.published == 'true' env: diff --git a/package.json b/package.json index 6d827ce..dfa2a53 100644 --- a/package.json +++ b/package.json @@ -23,6 +23,7 @@ "changeset": "changeset", "version-packages": "changeset version && pnpm install --lockfile-only", "publish-packages": "pnpm run validate && changeset publish && pnpm run verify:published", + "publish-packages:ci": "pnpm --filter commitprompt-docs exec playwright install --with-deps chromium && pnpm run publish-packages", "release": "pnpm run publish-packages", "verify:published": "node scripts/verify-published-package.mjs", "docs:dev": "pnpm --filter commitprompt-docs dev", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0dd1a26..310109f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -122,7 +122,15 @@ catalogs: version: 1.22.22 overrides: + brace-expansion@<2.0.0: ^1.1.18 + brace-expansion@>=2.0.0 <3.0.0: ^2.1.4 + brace-expansion@>=4.0.0 <6.0.0: ^5.0.9 + fast-uri: ^3.1.5 glob@10.5.0: 13.0.6 + js-yaml@<4.0.0: ^3.15.1 + js-yaml@>=4.0.0 <5.0.0: ^4.3.1 + nanoid: ^3.3.18 + undici: ^7.29.0 importers: @@ -3576,14 +3584,14 @@ packages: boolbase@1.0.0: resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==} - brace-expansion@1.1.17: - resolution: {integrity: sha512-w+aeW/mkgM4PyRMOJCgi3fOrTm5Q8QY1OSfn2TO2iuDj3ezIHqejmuxbjfPrqUkgqRew1iqkyAn0tr0ZwHD9+w==} + brace-expansion@1.1.18: + resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.1.3: - resolution: {integrity: sha512-DRdx5neNsG/QXbniLFWi2YmC/68oeOOmKz6zOjVk6ZS1ZLXgLIKqVEc6hWsmkjBbgii0SwaBTcJ5XKj5gzY/4A==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.8: - resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} engines: {node: 20 || >=22} braces@3.0.3: @@ -4630,8 +4638,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -5244,12 +5252,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.0: - resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} + js-yaml@3.15.1: + resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} hasBin: true - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true jsdoc-type-pratt-parser@7.2.0: @@ -5741,8 +5749,8 @@ packages: muggle-string@0.4.1: resolution: {integrity: sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -6790,8 +6798,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} unenv@2.0.0-rc.24: @@ -7491,7 +7499,7 @@ snapshots: dependencies: '@types/hast': 3.0.5 '@types/mdast': 4.0.4 - js-yaml: 4.3.0 + js-yaml: 4.3.1 picomatch: 4.0.5 retext-smartypants: 6.2.0 shiki: 4.3.1 @@ -7826,7 +7834,7 @@ snapshots: '@changesets/parse@0.4.3': dependencies: '@changesets/types': 6.1.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 '@changesets/pre@2.0.2': dependencies: @@ -10510,14 +10518,14 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -10670,7 +10678,7 @@ snapshots: github-slugger: 2.0.0 html-escaper: 3.0.3 http-cache-semantics: 4.2.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 jsonc-parser: 3.3.1 magic-string: 1.1.0 magicast: 0.5.3 @@ -10764,16 +10772,16 @@ snapshots: boolbase@1.0.0: {} - brace-expansion@1.1.17: + brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.3: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.8: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -10952,7 +10960,7 @@ snapshots: cosmiconfig@8.3.6(typescript@6.0.3): dependencies: import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.3.1 parse-json: 5.2.0 path-type: 4.0.0 optionalDependencies: @@ -10962,7 +10970,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.3.1 parse-json: 5.2.0 optionalDependencies: typescript: 6.0.3 @@ -12009,7 +12017,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fast-wrap-ansi@0.2.2: dependencies: @@ -12620,12 +12628,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.0: + js-yaml@3.15.1: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -13357,7 +13365,7 @@ snapshots: dependencies: '@cspotcode/source-map-support': 0.8.1 sharp: 0.35.2 - undici: 7.28.0 + undici: 7.29.0 workerd: 1.20260722.1 ws: 8.21.0 youch: 4.1.0-beta.10 @@ -13367,15 +13375,15 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.9 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.17 + brace-expansion: 1.1.18 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.3 + brace-expansion: 2.1.4 minimist@1.2.8: {} @@ -13391,7 +13399,7 @@ snapshots: muggle-string@0.4.1: {} - nanoid@3.3.16: {} + nanoid@3.3.18: {} napi-postinstall@0.3.4: {} @@ -13787,7 +13795,7 @@ snapshots: postcss@8.5.25: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -13849,7 +13857,7 @@ snapshots: read-yaml-file@1.1.0: dependencies: graceful-fs: 4.2.11 - js-yaml: 3.15.0 + js-yaml: 3.15.1 pify: 4.0.1 strip-bom: 3.0.0 @@ -14609,7 +14617,7 @@ snapshots: undici-types@8.3.0: {} - undici@7.28.0: {} + undici@7.29.0: {} unenv@2.0.0-rc.24: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index bec9a36..70e855e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -7,7 +7,7 @@ allowBuilds: sharp: true unrs-resolver: true workerd: true - yarn: set this to true or false + yarn: true allowedDeprecatedVersions: node-domexception: 1.0.0 @@ -56,4 +56,12 @@ minimumReleaseAgeExclude: - '@santi020k/eslint-config-typescript' overrides: + "brace-expansion@<2.0.0": ^1.1.18 + "brace-expansion@>=2.0.0 <3.0.0": ^2.1.4 + "brace-expansion@>=4.0.0 <6.0.0": ^5.0.9 + fast-uri: ^3.1.5 glob@10.5.0: 13.0.6 + "js-yaml@<4.0.0": ^3.15.1 + "js-yaml@>=4.0.0 <5.0.0": ^4.3.1 + nanoid: ^3.3.18 + undici: ^7.29.0 From 1999fdf3e53eabc921da918c2bedaf65e67f12fc Mon Sep 17 00:00:00 2001 From: Santiago Molina Date: Fri, 21 Aug 2026 11:07:25 -0500 Subject: [PATCH 2/2] fix: preserve manual documentation deployments --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0dcd7fc..bfba599 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -137,7 +137,9 @@ jobs: name: Deploy documentation needs: [changes, full, compatibility, windows] if: >- - always() && github.event_name == 'push' && + always() && + (github.event_name == 'push' || + (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')) && needs.changes.outputs.docs == 'true' && needs.full.result == 'success' && (needs.compatibility.result == 'success' || needs.compatibility.result == 'skipped') &&