diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 96d640ac..be4617fe 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,24 @@ updates: directory: "/" schedule: interval: "weekly" + # Hold back brand-new releases: the hours after publication are the window + # in which a compromised package version is most likely to still be live. + cooldown: + default-days: 7 # Bundle all npm updates into a single grouped PR per run. groups: npm-dependencies: patterns: - "*" + + # Keeps the exact action versions pinned in .github/workflows from going stale. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/command.yml b/.github/workflows/command.yml index 2eaa7ae9..546da5c1 100644 --- a/.github/workflows/command.yml +++ b/.github/workflows/command.yml @@ -7,7 +7,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Slash Command Dispatch - uses: peter-evans/slash-command-dispatch@v3 + uses: peter-evans/slash-command-dispatch@v3.0.2 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} reaction-token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 52247c91..00e65947 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,10 +14,10 @@ jobs: WOOSMAP_PUBLIC_API_KEY: "${{ secrets.WOOSMAP_PUBLIC_API_KEY }}" WOOSMAP_PRIVATE_API_KEY: "${{ secrets.WOOSMAP_PRIVATE_API_KEY }}" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v4.3.0 with: version: 9.15.9 - name: Install dependencies @@ -25,7 +25,7 @@ jobs: - run: pnpm run build - run: pnpm test - name: Semantic Release - uses: cycjimmy/semantic-release-action@v4 + uses: cycjimmy/semantic-release-action@v4.2.2 with: extra_plugins: | "@semantic-release/commit-analyzer" diff --git a/.github/workflows/schema-change-notification.yml b/.github/workflows/schema-change-notification.yml index 834d1505..af5928d3 100644 --- a/.github/workflows/schema-change-notification.yml +++ b/.github/workflows/schema-change-notification.yml @@ -13,7 +13,7 @@ jobs: actions: read steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 with: fetch-depth: 0 @@ -33,7 +33,7 @@ jobs: echo "EOF" >> $GITHUB_OUTPUT - name: Find PR - uses: jwalton/gh-find-current-pr@master + uses: jwalton/gh-find-current-pr@v1.3.5 id: findPr with: state: all @@ -44,7 +44,7 @@ jobs: - name: Comment on PR or linked Issue if schemas changed if: steps.schema_changes.outputs.changed_files && steps.findPr.outputs.number != '' - uses: actions/github-script@v6 + uses: actions/github-script@v6.4.1 with: github-token: ${{ secrets.HELPER_TOKEN }} script: | @@ -89,7 +89,7 @@ jobs: - name: Create issue in Woosmap/woosmap if schemas changed if: steps.schema_changes.outputs.changed_files && steps.findPr.outputs.number != '' - uses: actions/github-script@v6 + uses: actions/github-script@v6.4.1 with: github-token: ${{ secrets.HELPER_TOKEN }} script: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index dcc67816..54be65d7 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -5,8 +5,8 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 + - uses: actions/checkout@v4.4.0 + - uses: pnpm/action-setup@v4.3.0 with: version: 9.15.9 - name: Install dependencies diff --git a/.github/workflows/update-devdoc.yml b/.github/workflows/update-devdoc.yml index d49cd4c1..8b08cf5a 100644 --- a/.github/workflows/update-devdoc.yml +++ b/.github/workflows/update-devdoc.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Dispatch Release Event - uses: peter-evans/repository-dispatch@v2 + uses: peter-evans/repository-dispatch@v2.1.2 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} repository: woosmap/developers.woosmap.com diff --git a/.github/workflows/update-dist.yml b/.github/workflows/update-dist.yml index d1ee71fc..0bd409f3 100644 --- a/.github/workflows/update-dist.yml +++ b/.github/workflows/update-dist.yml @@ -6,12 +6,12 @@ jobs: update-dist: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }} ref: ${{ github.event.client_payload.pull_request.head.ref }} - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v4.3.0 with: version: 9.15.9 - name: Install dependencies @@ -25,7 +25,7 @@ jobs: git commit -m "chore: update dist folder [skip ci]" || true git push origin - name: Add reaction - uses: peter-evans/create-or-update-comment@v2 + uses: peter-evans/create-or-update-comment@v2.1.1 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} repository: ${{ github.event.client_payload.github.payload.repository.full_name }} diff --git a/.npmrc b/.npmrc index cc818e55..82531035 100644 --- a/.npmrc +++ b/.npmrc @@ -1 +1,7 @@ -hoist=false \ No newline at end of file +hoist=false + +# Delay adopting newly published versions; a compromised release is usually +# caught within days. min-release-age is npm >= 11.10, minimum-release-age is +# pnpm >= 10.16 — both inert on the pinned pnpm 9.15.9, effective after a bump. +min-release-age=7 +minimum-release-age=7