@blamejs/blamejs-shop 0.2.12 → 0.2.14

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.2.12",
+  "version": "0.2.14",
   "assets": {
     "css/admin.css": {
-      "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
-      "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
+      "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",
+      "fingerprinted": "css/admin.72c808274ebcefd9.css"
     },
     "css/main.css": {
-      "integrity": "sha384-4n7LcnY4MZQmhe0dlnwm50HaOyzJ0QMqtb7b70N9qO20B4LJ858lMOxXuua7aFYz",
-      "fingerprinted": "css/main.666c51fd74364739.css"
+      "integrity": "sha384-E56XcvNC5nbTWyHJJcepF6sVA1KjRNo/MWFL5F5w2PDN10JNaHdzIAP9a46m2Md8",
+      "fingerprinted": "css/main.a76d36ac566703d6.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/catalog.js

@@ -591,6 +591,19 @@ function _pricesModule(query) {
       );
       return r.rows;
     },
+
+    // The distinct currencies this variant has ever been priced in, so a
+    // caller (the admin price manager) can render current + history per
+    // currency without first knowing which currencies exist. Ordered for a
+    // stable display.
+    currencies: async function (variantId) {
+      _id(variantId, "variant_id");
+      var r = await query(
+        "SELECT DISTINCT currency FROM prices WHERE variant_id = ?1 ORDER BY currency ASC",
+        [variantId],
+      );
+      return r.rows.map(function (row) { return row.currency; });
+    },
   };
 }
 
@@ -753,6 +766,12 @@ function _mediaModule(query) {
       return { id: id, product_id: pid, variant_id: vid, r2_key: input.r2_key, content_type: input.content_type, width: width, height: height, position: position, alt_text: altText, created_at: ts };
     },
 
+    get: async function (id) {
+      _id(id, "media id");
+      var r = await query("SELECT * FROM media WHERE id = ?1", [id]);
+      return r.rows[0] || null;
+    },
+
     listForProduct: async function (productId) {
       _id(productId, "product_id");
       var r = await query("SELECT * FROM media WHERE product_id = ?1 ORDER BY position ASC, created_at ASC", [productId]);

package/lib/storefront.js

@@ -696,7 +696,7 @@ var PRODUCT_CARD_IMAGE =
 var PRODUCT_CARD =
   "<a class=\"product-card\" href=\"/products/{{slug}}\">\n" +
   "  <figure class=\"product-card__media product-card__media--placeholder\">\n" +
-  "    <svg class=\"media-ph__svg\" viewBox=\"0 0 160 120\" aria-hidden=\"true\"><rect width=\"160\" height=\"120\" fill=\"none\"/><g stroke=\"currentColor\" stroke-opacity=\"0.10\" stroke-width=\"1\"><path d=\"M0 30 H160 M0 60 H160 M0 90 H160 M40 0 V120 M80 0 V120 M120 0 V120\"/></g><g fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M80 38 L104 50 L104 76 L80 88 L56 76 L56 50 Z\"/><path d=\"M56 50 L80 62 L104 50 M80 62 V88\" stroke=\"#732A8D\"/><path d=\"M70 47 L74 50 L70 53\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M77 54 H86\" stroke=\"currentColor\" stroke-width=\"2\"/></g><text x=\"80\" y=\"106\" text-anchor=\"middle\" font-family=\"ui-monospace,Menlo,Consolas,monospace\" font-size=\"9\" letter-spacing=\"1.5\" fill=\"#6b6b78\">no image yet</text></svg>\n" +
+  "    <svg class=\"media-ph__svg\" viewBox=\"0 0 160 120\" aria-hidden=\"true\"><rect width=\"160\" height=\"120\" fill=\"none\"/><g stroke=\"currentColor\" stroke-opacity=\"0.18\" stroke-width=\"1\"><path d=\"M0 30 H160 M0 60 H160 M0 90 H160 M40 0 V120 M80 0 V120 M120 0 V120\"/></g><g fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M80 38 L104 50 L104 76 L80 88 L56 76 L56 50 Z\"/><path d=\"M56 50 L80 62 L104 50 M80 62 V88\" stroke=\"#C75BE8\"/><path d=\"M70 47 L74 50 L70 53\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M77 54 H86\" stroke=\"currentColor\" stroke-width=\"2\"/></g><text x=\"80\" y=\"106\" text-anchor=\"middle\" font-family=\"ui-monospace,Menlo,Consolas,monospace\" font-size=\"9\" letter-spacing=\"1.5\" fill=\"#9b9ba7\">no image yet</text></svg>\n" +
   "  </figure>\n" +
   "  <div class=\"product-card__meta\">\n" +
   "    <h3 class=\"product-card__title\">{{title}}</h3>\n" +

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.22",
-      "tag": "v0.13.22",
+      "version": "0.13.32",
+      "tag": "v0.13.32",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-28"
+      "bundledAt": "2026-05-29"
     }
   }
 }

package/lib/vendor/blamejs/.github/workflows/actions-lint.yml

@@ -50,6 +50,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install pinact (release binary + sha256 verify)
         # Install pinact directly from the upstream release binary
@@ -106,32 +108,43 @@ jobs:
     name: zizmor — workflow security audit
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    permissions:
-      contents: read
-      security-events: write   # required for SARIF upload to Code Scanning
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
-      - name: Install uv (zizmor distribution)
-        uses: astral-sh/setup-uv@69d3e2780fa0ea7da961bfbb898be32a9b1d10b1  # v7.0.0
+      - name: Install zizmor (release binary + sha256 verify)
+        # Direct release-binary install instead of astral-sh/setup-uv + uvx.
+        # setup-uv (a third-party action) startup_failures the whole
+        # workflow on the current runner — the same class of failure as the
+        # raven-actions/actionlint composite that took down the actionlint
+        # job (no jobs, no logs). A run: step cannot startup_failure.
+        # zizmor publishes no checksums file, so the expected sha256 is
+        # pinned inline; a mismatch fails closed.
+        env:
+          ZIZMOR_VERSION: v1.18.0
+          ZIZMOR_SHA256:  8e7901319ab7b71c38d6d388a48e02ff65791e5971b2ee6577c9b5c3ab44c65f
+        run: |
+          set -euo pipefail
+          curl -fsSLo /tmp/zizmor.tar.gz "https://github.com/zizmorcore/zizmor/releases/download/${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+          ACTUAL=$(sha256sum /tmp/zizmor.tar.gz | awk '{print $1}')
+          if [ "$ACTUAL" != "$ZIZMOR_SHA256" ]; then
+            echo "::error::zizmor tarball sha256 ${ACTUAL} does not match pinned ${ZIZMOR_SHA256}"
+            exit 1
+          fi
+          mkdir -p /tmp/zizmor-bin
+          tar -xzf /tmp/zizmor.tar.gz -C /tmp/zizmor-bin ./zizmor
+          sudo install -m 0755 /tmp/zizmor-bin/zizmor /usr/local/bin/zizmor
+          zizmor --version
 
       - name: Run zizmor (fail on level=low across every rule class)
-        # `--min-severity low` flags every documented class. Suppression
-        # requires an inline `# zizmor: ignore[<rule>] — <reason>` per
-        # the spec.
+        # Pure run-gate: zizmor exits non-zero on any finding, failing the
+        # job. Inline `# zizmor: ignore[<rule>] — <reason>` is the
+        # suppression mechanism for reviewed exceptions.
         run: |
           set -euo pipefail
-          uvx zizmor@1.18.0 --min-severity low --format sarif . > zizmor.sarif || EXIT=$?
-          uvx zizmor@1.18.0 --min-severity low . || true   # human-readable output for the step log
-          if [ "${EXIT:-0}" != "0" ]; then exit "$EXIT"; fi
-
-      - name: Upload SARIF to Code Scanning
-        if: always()
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
-        with:
-          sarif_file: zizmor.sarif
-          category: zizmor
+          zizmor --min-severity low --no-progress .github/workflows/
 
   actionlint:
     name: actionlint — YAML + expression + shellcheck on `run:` blocks
@@ -140,9 +153,44 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-
-      - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8  # v2.1.2
         with:
-          fail_on_error: true
-          shellcheck: true
+          persist-credentials: false
+
+      - name: Install actionlint (release binary + sha256 verify)
+        # Direct release-binary install instead of the
+        # raven-actions/actionlint composite action. That composite (v2.1.2,
+        # the latest release) startup_failures on the current runner, taking
+        # the whole workflow down before any job runs — which is why this
+        # gate never ran from v0.11.21 onward. The binary path also drops the
+        # composite's transitive github-script / cache action surface, which
+        # fits the gate whose entire purpose is pinning discipline. Mirrors
+        # the pinact install step above.
+        env:
+          ACTIONLINT_VERSION: v1.7.12
+        run: |
+          set -euo pipefail
+          V="${ACTIONLINT_VERSION#v}"
+          curl -fsSLo /tmp/actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/${ACTIONLINT_VERSION}/actionlint_${V}_linux_amd64.tar.gz"
+          curl -fsSLo /tmp/actionlint-checksums.txt "https://github.com/rhysd/actionlint/releases/download/${ACTIONLINT_VERSION}/actionlint_${V}_checksums.txt"
+          ACTUAL=$(sha256sum /tmp/actionlint.tar.gz | awk '{print $1}')
+          EXPECTED=$(grep "actionlint_${V}_linux_amd64.tar.gz\$" /tmp/actionlint-checksums.txt | awk '{print $1}')
+          if [ -z "$EXPECTED" ]; then
+            echo "::error::could not find actionlint_${V}_linux_amd64.tar.gz line in upstream checksums"
+            exit 1
+          fi
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "::error::actionlint tarball sha256 ${ACTUAL} does not match upstream-published ${EXPECTED}"
+            exit 1
+          fi
+          mkdir -p /tmp/actionlint-bin
+          tar -xzf /tmp/actionlint.tar.gz -C /tmp/actionlint-bin actionlint
+          sudo install -m 0755 /tmp/actionlint-bin/actionlint /usr/local/bin/actionlint
+          actionlint --version
+
+      - name: Run actionlint (+ shellcheck on every run block)
+        # shellcheck ships preinstalled on ubuntu-latest; actionlint invokes
+        # it automatically on each `run:` block. Non-zero exit on any finding
+        # keeps this a hard gate (the raven composite's fail_on_error: true).
+        run: |
+          set -euo pipefail
+          actionlint -color

package/lib/vendor/blamejs/.github/workflows/cflite_batch.yml

@@ -69,6 +69,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/lib/vendor/blamejs/.github/workflows/cflite_pr.yml

@@ -80,6 +80,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/lib/vendor/blamejs/.github/workflows/ci.yml

@@ -52,6 +52,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -106,6 +108,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -126,6 +130,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -149,6 +155,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -168,6 +176,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           # gitleaks scans full history on a non-shallow checkout, so an
           # accidentally-committed secret in any prior commit on the
           # branch is caught even if a later commit reverts it. The
@@ -225,6 +234,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -254,6 +265,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -294,6 +307,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Run Hadolint (strict, all severities)
         # `--no-fail` is OFF; any error or warning fails the job.
@@ -336,6 +351,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Detect shell scripts
         id: sh

package/lib/vendor/blamejs/.github/workflows/npm-publish.yml

@@ -94,6 +94,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -102,11 +104,14 @@ jobs:
 
       - name: Compute version + is_tag flag
         id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF: ${{ github.ref }}
         run: |
           set -euo pipefail
           PKG_VERSION=$(node -e "console.log(require('./package.json').version)")
           echo "version=$PKG_VERSION" >> "$GITHUB_OUTPUT"
-          if [ "${{ github.event_name }}" = "push" ] && [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+          if [ "$EVENT_NAME" = "push" ] && [[ "$REF" == refs/tags/v* ]]; then
             TAG_VERSION="${GITHUB_REF#refs/tags/v}"
             echo "is_tag=true" >> "$GITHUB_OUTPUT"
             if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
@@ -132,7 +137,7 @@ jobs:
 
       - name: ShellCheck
         if: steps.shells.outputs.found == 'true'
-        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca  # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # 2.0.0
         with:
           severity: error
 
@@ -229,7 +234,7 @@ jobs:
         id: subjects
         run: |
           set -euo pipefail
-          TARBALL=$(basename "$(ls dist/*.tgz | head -1)")
+          TARBALL=$(basename "$(find dist -maxdepth 1 -name '*.tgz' | head -1)")
           HASHES=$(
             (cd dist && sha256sum "$TARBALL") && \
             sha256sum sbom.cdx.json sbom.vendored.cdx.json
@@ -292,7 +297,9 @@ jobs:
     # repo specifically so the SLSA tag-pin call is permitted. The
     # `slsa-action-not-pinned` codebase-patterns detector allowlists
     # this specific callsite (see test/layer-0-primitives/codebase-patterns.test.js).
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # allow:slsa-framework-action-not-sha-pinned — SLSA's internal builder-fetch refuses non-tag refs; mitigated by slsa-framework's upstream tag-protection + immutable-release rules
+    # SLSA's reusable builder workflow refuses non-tag refs (cannot be
+    # SHA-pinned); upstream tag-protection + immutable releases mitigate.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # zizmor: ignore[unpinned-uses] allow:slsa-framework-action-not-sha-pinned — SLSA's internal builder-fetch refuses non-tag refs; mitigated by slsa-framework's upstream tag-protection + immutable-release rules
     with:
       base64-subjects:    "${{ needs.validate.outputs.hashes }}"
       upload-assets:      false
@@ -410,6 +417,7 @@ jobs:
         # and failed immediately on the first PQC release run.
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           path: src
 
       - name: Release-digest sidecars (SHA-256 + SHA3-512)
@@ -424,7 +432,7 @@ jobs:
         # Both written in `<sha>  <filename>` sha-sum-compatible format.
         run: |
           set -euo pipefail
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           node src/scripts/sha3-digest.js "$TARBALL"
 
       - name: PQC sidecar — ML-DSA-65 signature of the tarball
@@ -463,7 +471,7 @@ jobs:
             echo "available=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           # The signer expects keys/release-pqc-pub.json at the
           # framework root for the self-verify cross-check. Symlink
           # the checked-out src/keys/ into the working directory so
@@ -514,11 +522,11 @@ jobs:
           set -euo pipefail
           if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "::error::Release $TAG already exists. The workflow is authoritative for release creation as of v0.11.7."
-            echo "::error::Manual `gh release create` was removed from the release workflow in v0.11.7."
-            echo "::error::Either delete the existing release (`gh release delete $TAG`) and re-run this workflow, OR push a new tag."
+            echo "::error::Manual 'gh release create' was removed from the release workflow in v0.11.7."
+            echo "::error::Either delete the existing release with 'gh release delete $TAG' and re-run this workflow, OR push a new tag."
             exit 1
           fi
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           # Title comes from the structured release-notes JSON's
           # `headline` field — single source of truth. Format:
           # `vX.Y.Z — <headline>`.
@@ -594,7 +602,7 @@ jobs:
         # mis-classifies a relative path containing `/` as a git
         # spec.
         run: |
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           echo "Publishing: $TARBALL"
           npm publish "./${TARBALL}" --provenance --access public
         env:

package/lib/vendor/blamejs/.github/workflows/release-container.yml

@@ -57,6 +57,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -73,6 +75,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Run Hadolint (strict, all severities)
         uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5  # v3.3.0
         with:
@@ -88,6 +92,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Detect shell scripts
         id: sh
         run: |
@@ -97,7 +103,7 @@ jobs:
           echo "found=$count" >> "$GITHUB_OUTPUT"
       - name: Run ShellCheck
         if: steps.sh.outputs.found != '0'
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # 2.0.0
         with:
           severity: style
           format:   tty
@@ -118,16 +124,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU (for ARM64 cross-build)
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
 
       - name: Log in to GHCR
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -162,7 +170,7 @@ jobs:
       # Note: load: true forces single-arch (amd64). The multi-arch
       # build happens on the post-scan push step below.
       - name: Build (local-only, for Trivy)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -210,7 +218,7 @@ jobs:
       - name: Push (multi-arch, after Trivy gate)
         id: push
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -236,7 +244,7 @@ jobs:
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' && steps.push.outputs.digest }}
         env:
           DIGEST: ${{ steps.push.outputs.digest }}
-        run: cosign sign --yes "${{ env.IMAGE }}@${DIGEST}"
+        run: cosign sign --yes "${IMAGE}@${DIGEST}"
 
       - name: Generate SHA3-512 digest
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' && steps.push.outputs.digest }}
@@ -245,8 +253,8 @@ jobs:
           DIGEST: ${{ steps.push.outputs.digest }}
         run: |
           set -euo pipefail
-          docker pull "${{ env.IMAGE }}@${DIGEST}"
-          HASH=$(docker save "${{ env.IMAGE }}@${DIGEST}" | openssl dgst -sha3-512 | awk '{print $NF}')
+          docker pull "${IMAGE}@${DIGEST}"
+          HASH=$(docker save "${IMAGE}@${DIGEST}" | openssl dgst -sha3-512 | awk '{print $NF}')
           echo "SHA3-512: $HASH"
           echo "sha3=$HASH" >> "$GITHUB_OUTPUT"
           {
@@ -275,8 +283,8 @@ jobs:
             echo "|---|---|"
             echo "| **Version**   | ${VERSION} |"
             echo "| **Platforms** | linux/amd64, linux/arm64 |"
-            echo "| **Registry**  | ${{ env.IMAGE }} |"
-            echo "| **Commit**    | ${{ github.sha }} |"
+            echo "| **Registry**  | ${IMAGE} |"
+            echo "| **Commit**    | ${GITHUB_SHA} |"
             echo "| **Dry run**   | ${DRY_RUN} |"
             echo "| **Tag push**  | ${IS_TAG} |"
             echo ""
@@ -297,6 +305,11 @@ jobs:
     if: ${{ !inputs.dry_run && needs.publish.outputs.digest != '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    env:
+      # Hoisted so run: blocks reference $DIGEST instead of inlining the
+      # ${{ needs.publish.outputs.digest }} expression (template-injection
+      # hardening — keeps GitHub-context values out of shell-parsed text).
+      DIGEST: ${{ needs.publish.outputs.digest }}
     steps:
       # Smoke-test runs on a fresh runner — it doesn't inherit the
       # publish job's GHCR auth. Log in first so `docker pull` works
@@ -304,19 +317,19 @@ jobs:
       # against a public package, so this is the right shape regardless
       # of visibility.
       - name: Log in to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Pull published image
-        run: docker pull "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}"
+        run: docker pull "${IMAGE}@${DIGEST}"
 
       - name: Verify OCI labels
         run: |
           set -euo pipefail
-          LABELS=$(docker inspect "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}" --format '{{json .Config.Labels}}')
+          LABELS=$(docker inspect "${IMAGE}@${DIGEST}" --format '{{json .Config.Labels}}')
           echo "$LABELS" | python3 -m json.tool
           echo "$LABELS" | python3 -c "
           import sys, json
@@ -342,7 +355,7 @@ jobs:
             --security-opt no-new-privileges:true \
             --cap-drop ALL \
             -p 3008:3008 \
-            "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}"
+            "${IMAGE}@${DIGEST}"
 
           echo "Waiting for /healthz..."
           for i in $(seq 1 30); do
@@ -396,7 +409,7 @@ jobs:
           {
             echo "### Post-publish smoke ❌"
             echo ""
-            echo "Smoke test failed for ${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}."
+            echo "Smoke test failed for ${IMAGE}@${DIGEST}."
             echo "See the 'Capture container diagnostics on failure' step above for"
             echo "docker ps / inspect / logs output."
           } >> "$GITHUB_STEP_SUMMARY"

package/lib/vendor/blamejs/.github/workflows/sha-to-tag-verify.yml

@@ -39,6 +39,7 @@ jobs:
       - name: Checkout (full history needed for first-parent walk)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
@@ -53,10 +54,15 @@ jobs:
       - name: Resolve tag + verify chain
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          # Hoisted: a workflow_dispatch input is operator-supplied text;
+          # inlining ${{ github.event.inputs.tag }} into the shell is the
+          # template-injection vector. Reference $INPUT_TAG instead.
+          INPUT_TAG: ${{ github.event.inputs.tag }}
         run: |
           set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ github.event.inputs.tag }}"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF#refs/tags/}"
           fi
@@ -77,7 +83,20 @@ jobs:
           #    pass that test. The strict first-parent invariant is
           #    what the project's squash-merge policy actually
           #    produces; check it directly.
-          if ! git rev-list --first-parent origin/main | grep -qx "$SHA"; then
+          #
+          #    Capture rev-list output first, then grep against a
+          #    here-string. The obvious-looking
+          #      `git rev-list --first-parent origin/main | grep -qx "$SHA"`
+          #    is a `set -o pipefail` + `grep -q` trap: when grep -q
+          #    finds the match it exits early and closes its stdin,
+          #    rev-list gets SIGPIPE and exits 141, and pipefail then
+          #    propagates 141 as the pipeline's exit. The outer
+          #    `if !` negates 141 → enters the false-fail branch
+          #    every time on a long first-parent chain. (False-failed
+          #    every release v0.13.18-.22.) The here-string consumes
+          #    rev-list to completion first; no pipe, no SIGPIPE.
+          FIRST_PARENT=$(git rev-list --first-parent origin/main)
+          if ! grep -qFx "$SHA" <<<"$FIRST_PARENT"; then
             echo "::error::tag $TAG points at $SHA which is NOT on main's first-parent history"
             echo "::error::this means the tag was created from a side-branch commit that never merged via the project's squash-merge flow"
             echo "::error::the publish workflow refuses to proceed; investigate before re-tagging"

package/lib/vendor/blamejs/.github/zizmor.yml

@@ -0,0 +1,29 @@
+# zizmor configuration (auto-discovered at .github/zizmor.yml).
+#
+# Suppressions live here rather than as inline `# zizmor: ignore[...]`
+# comments because the affected lines are `uses:` references that
+# already carry a pinact version comment (`# vX.Y.Z`). zizmor only
+# honors an ignore pragma when `zizmor:` is the first token of the
+# YAML comment; a `# vX.Y.Z  # zizmor: ignore[...]` line reads as the
+# comment text "vX.Y.Z  # zizmor: ..." and the pragma is never seen.
+# A config-file ignore is the only placement that does not collide
+# with the SHA-pin version comment that pinact requires.
+
+rules:
+  cache-poisoning:
+    # actions/setup-node carries an optional `cache:` input that, when
+    # set, restores a dependency cache. zizmor flags the *capability*
+    # whenever the workflow also has a release-class trigger
+    # (`push: tags: ["v*"]`), because a poisoned cache restored during a
+    # publishing run is high-impact. None of these workflows set a
+    # `cache:` input — no dependency cache is created or restored, so
+    # there is nothing to poison. The finding is capability-driven, not
+    # an observed cache.
+    #
+    # Invariant for future edits: if any step in one of these files adds
+    # a `cache:` input to a setup-* action, remove that file from this
+    # list and review the cache-poisoning exposure for real.
+    ignore:
+      - ci.yml
+      - npm-publish.yml
+      - release-container.yml