457cb04fd0
chore(deps): bump the all-actions group across 1 directory with 5 updates ( #1672 )
...
Bumps the all-actions group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `7.0.0` | `7.0.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.3` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.3` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.3` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1 )
Updates `github/codeql-action/init` from 4.37.0 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
Updates `github/codeql-action/autobuild` from 4.37.0 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
- dependency-name: github/codeql-action/init
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
- dependency-name: github/codeql-action/autobuild
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-22 14:06:28 -04:00
331dbe8339
chore(deps): bump the all-actions group across 2 directories with 3 updates ( #1637 )
...
Bumps the all-actions group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node ), [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) and [actions/stale](https://github.com/actions/stale ).
Bumps the all-actions group with 1 update in the /.github/actions/start-app directory: [actions/setup-node](https://github.com/actions/setup-node ).
Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020 )
Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228 )
Updates `actions/stale` from 10.3.0 to 10.4.0
- [Release notes](https://github.com/actions/stale/releases )
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629 )
Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all-actions
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
- dependency-name: actions/stale
dependency-version: 10.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all-actions
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-15 21:24:39 -04:00
21633b87e3
ci: credit changelog contributors inline and harden empty pr fromJSON ( #1625 )
...
Release publish runs leave steps.release.outputs.pr empty, so fromJSON crashed
even when the credit step was gated off. Credit external issue openers with an
inline thanks suffix on logical changelog bullets instead of a Thanks section.
Keep fatal API lookup logs status-only.
2026-07-13 15:49:04 -04:00
9385720ef0
chore: auto-credit external contributors in changelog ( #1585 )
2026-07-06 19:55:09 -04:00
f00ed71988
chore(deps): bump the all-actions group with 4 updates ( #1039 )
...
Bumps the all-actions group with 4 updates: [actions/create-github-app-token](https://github.com/actions/create-github-app-token ), [github/codeql-action](https://github.com/github/codeql-action ), [actions/dependency-review-action](https://github.com/actions/dependency-review-action ) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ).
Updates `actions/create-github-app-token` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases )
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/create-github-app-token/compare/1b10c78c7865c340bc4f6099eb2f838309f1e8c3...bcd2ba49218906704ab6c1aa796996da409d3eb1 )
Updates `github/codeql-action` from 4.35.3 to 4.35.4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e )
Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases )
- [Commits](https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294 )
Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003...6f9f17788090df1f26f669e9d70d6ae9567deba6 )
---
updated-dependencies:
- dependency-name: actions/create-github-app-token
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all-actions
- dependency-name: github/codeql-action
dependency-version: 4.35.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
- dependency-name: actions/dependency-review-action
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all-actions
- dependency-name: sigstore/cosign-installer
dependency-version: 4.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Anso <dev@saelix.com >
2026-05-14 10:20:25 -04:00
7b7edc72bb
ci: add workflow_dispatch trigger to release-please ( #865 )
...
release-please-action v5.0.0 (release-please library 17.6.0) returns
exit code 1 when it tries to create a GitHub Release whose tag already
exists, even when the underlying state is consistent (release already
published, manifest current, label state correct). This causes the
action to abort before the "open or update release PR" step, leaving
new conventional commits unprocessed.
Adding workflow_dispatch lets a maintainer re-run the action manually
from the Actions tab once the inconsistent state is cleared (typically
by removing the autorelease label from the prior release PR), without
needing to push a no-op commit to main to retrigger.
The workflow's internal state checks still run on every dispatch, so
manual triggers cannot double-publish a release. release-please-action
is already at latest (v5.0.0, 2026-04-22) so a version bump is not an
option until upstream ships a fix for the duplicate-tag handling.
2026-05-01 21:21:19 -04:00
4c4394b97e
chore(deps): bump the all-actions group with 3 updates ( #794 )
...
Bumps the all-actions group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action ), [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) and [googleapis/release-please-action](https://github.com/googleapis/release-please-action ).
Updates `github/codeql-action` from 3.35.2 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a...95e58e9a2cdfd71adc6e0353d5c52f41a045d225 )
Updates `softprops/action-gh-release` from 2.6.2 to 3.0.0
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/3bb12739c298aeb8a4eeaf626c5b8d85266b0e65...b4309332981a82ec1c5618f44dd2e27cc8bfbfda )
Updates `googleapis/release-please-action` from 4.4.1 to 5.0.0
- [Release notes](https://github.com/googleapis/release-please-action/releases )
- [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/googleapis/release-please-action/compare/5c625bfb5d1ff62eadeeb3772007f7f66fdcf071...45996ed1f6d02564a971a2fa1b5860e934307cf7 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all-actions
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all-actions
- dependency-name: googleapis/release-please-action
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-27 00:04:52 -04:00
b0807fbb5e
chore(deps): bump the all-actions group across 1 directory with 4 updates ( #724 )
...
Bumps the all-actions group with 4 updates in the / directory: [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ), [actions/download-artifact](https://github.com/actions/download-artifact ), [actions/create-github-app-token](https://github.com/actions/create-github-app-token ) and [googleapis/release-please-action](https://github.com/googleapis/release-please-action ).
Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/57a97c7e7821a5776cebc9bb87c984fa69cba8f1...ed142fd0673e97e23eac54620cfb913e5ce36c25 )
Updates `actions/download-artifact` from 7 to 8
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8 )
Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases )
- [Commits](https://github.com/actions/create-github-app-token/compare/f8d387b68d61c58ab83c6c016672934102569859...1b10c78c7865c340bc4f6099eb2f838309f1e8c3 )
Updates `googleapis/release-please-action` from 4.4.0 to 4.4.1
- [Release notes](https://github.com/googleapis/release-please-action/releases )
- [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/googleapis/release-please-action/compare/16a9c90856f42705d54a6fda1823352bdc62cf38...5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-version: 0.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all-actions
- dependency-name: actions/download-artifact
dependency-version: '8'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all-actions
- dependency-name: actions/create-github-app-token
dependency-version: 3.1.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all-actions
- dependency-name: googleapis/release-please-action
dependency-version: 4.4.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-26 15:56:01 -04:00
af4b17cc37
ci: migrate DOCS_REPO_TOKEN to sencho-token-app installation token ( #490 )
...
Replace the long-lived DOCS_REPO_TOKEN personal access token with
short-lived installation tokens minted per-job from the sencho-token-app
GitHub App (owned by the AnsoCode org, installed on both Sencho and
sencho-docs).
Why this is better than the PAT:
- Scoped per-job to only the repo the job actually touches, not one
token that works everywhere. update-screenshots and release-please
mint against Sencho; sync-docs mints against sencho-docs.
- Scoped per-job to only the permission scopes the job actually needs
(contents:write and sometimes pull-requests:write), not the broader
scope a PAT carries.
- Auto-revoked at job end by the action's post-run step, so a leaked
log line or artifact is useful for at most the remainder of that job.
- Not tied to any individual user account: no more risk of the token
silently dying when the human who minted it leaves or rotates keys.
- Like a PAT but unlike GITHUB_TOKEN, installation tokens DO trigger
downstream workflow runs, so the release-please tag push still
cascades into docker-publish.yml exactly as before.
Jobs migrated:
- release-please.yml: single mint, passed to release-please-action.
- ci.yml update-screenshots: one mint reused by checkout, peter-evans
create-pull-request, and the gh pr merge step.
- ci.yml sync-docs: one mint targeting sencho-docs, fed to the git
clone URL as x-access-token.
DOCS_REPO_TOKEN can be deleted from repo secrets after the first full
release cycle under this migration validates release-please,
update-screenshots, and sync-docs all succeed end-to-end.
actions/create-github-app-token pinned to v3.0.0 at SHA
f8d387b68d61c58ab83c6c016672934102569859, consistent with the
SHA-pinning convention established in the supply-chain hardening PR.
2026-04-10 15:48:33 -04:00
c1ce13758f
ci: harden supply chain (SHA pin actions, least-privilege permissions) ( #475 )
...
Pin three third-party actions to full commit SHAs with version comments
so dependabot can update them in place without exposing the pipeline to
upstream tag tampering:
- aquasecurity/trivy-action@v0.35 .0
- peter-evans/create-pull-request@v8.1.1
- googleapis/release-please-action@v4.4.0
Add a workflow-level permissions: contents: read default to ci.yml, with
update-screenshots keeping its explicit contents: write + pull-requests:
write override. Add the same default to docker-publish.yml (single job).
Expand .dockerignore to explicitly exclude .env*, *.key, *.pem, .github/,
docs/, website/, e2e/, tests/, test-results/, and playwright-report/ as
defense in depth against accidental build-context leaks. None of these
paths are read by any COPY step in Dockerfile.
2026-04-10 13:41:49 -04:00
79fde6e2bd
fix(editor): bundle Monaco locally to fix stuck Loading state and CSP block
...
- Add monaco-editor to frontend deps and configure @monaco-editor/react
to use the local bundle via loader.config({ monaco }) instead of
fetching from cdn.jsdelivr.net (blocked by CSP scriptSrc: self)
- Wire editorWorker via Vite ?worker syntax — blob: URLs already
permitted by existing workerSrc CSP directive, no CSP changes needed
- fix(ci): use DOCS_REPO_TOKEN in release-please so tag creation
cascades to docker-publish.yml (GITHUB_TOKEN cannot trigger workflows)
- fix(ci): auto-merge screenshots PR via gh pr merge --auto --squash
2026-03-24 19:43:55 -04:00
c294def7cc
feat(ci): add release-please automated versioning workflow
2026-03-24 19:01:09 -04:00
dependabot[bot]