@daiyam/artifact-vsx-ts 0.9.5 → 0.9.6

package/configs/.github/workflows/preview.yml

@@ -1,14 +1,22 @@
 name: Preview
+
 on:
-  workflow_dispatch: null
+  workflow_dispatch: {}
+
+permissions:
+  contents: write   # Release
+
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: release
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
+
       - name: Get Version
         run: |
           # Get the latest tag
@@ -20,10 +28,13 @@ jobs:
           fi
           echo "VERSION=$LATEST_TAG" >> $GITHUB_ENV
           echo "Using version: $LATEST_TAG"
+
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: .nvmrc
+          package-manager-cache: false
+
       - name: Update package.json
         run: |
           TIME_PATCH="$(date +%-y)$(printf "%04d" $(($(date +%-j) * 24 + $(date +%-H))))"
@@ -36,6 +47,7 @@ jobs:
           jq -r '"version: \(.version)\npreview: \(.preview)"' package.json
 
           echo "RELEASE_TAG=v$VERSION" >> $GITHUB_ENV
+
       - name: Build
         run: |
           npm ci
@@ -46,8 +58,9 @@ jobs:
           echo "VSIX_NAME=$VSIX_NAME" >> $GITHUB_ENV
           echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
           echo "$CHECKSUM" > "$VSIX_NAME.sha256"
+
       - name: Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           files: |
             ${{ env.VSIX_NAME }}

package/configs/.github/workflows/publish.yml

@@ -1,23 +1,28 @@
 name: Publish Extension
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   push:
     tags:
-      - "*"
+      - v*
 
 env:
   PUBLISH_OPENVSX: ${{ vars.PUBLISH_OPENVSX }}
   PUBLISH_VSCODE: ${{ vars.PUBLISH_VSCODE }}
 
+permissions:
+  contents: write   # Release
+
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: release
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get Version
         run: |
@@ -33,7 +38,7 @@ jobs:
       - name: Check Existing Release
         run: |
           # Try to get the release information
-          RELEASE_INFO=$(gh release view ${{ env.VERSION }} --json assets,url 2>/dev/null || echo "")
+          RELEASE_INFO=$(gh release view ${VERSION} --json assets,url 2>/dev/null || echo "")
           if [ ! -z "$RELEASE_INFO" ]; then
             echo "Release exists"
             echo "RELEASE_EXISTS=yes" >> $GITHUB_ENV
@@ -53,16 +58,17 @@ jobs:
       - name: Download Existing VSIX
         if: env.RELEASE_EXISTS == 'yes' && env.VSIX_URL != ''
         run: |
-          gh api ${{ env.VSIX_URL }} --header 'Accept: application/octet-stream' > ${{ env.VSIX_NAME }}
-          echo "CHECKSUM=$(sha256sum ${{ env.VSIX_NAME }} | cut -d ' ' -f 1)" >> $GITHUB_ENV
+          gh api ${VSIX_URL} --header 'Accept: application/octet-stream' > ${VSIX_NAME}
+          echo "CHECKSUM=$(sha256sum ${VSIX_NAME} | cut -d ' ' -f 1)" >> $GITHUB_ENV
         env:
           GH_TOKEN: ${{ github.token }}
 
       - name: Setup Node.js
         if: env.RELEASE_EXISTS == 'no'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 20
+          node-version-file: .nvmrc
+          package-manager-cache: false
 
       - name: Build
         if: env.RELEASE_EXISTS == 'no'
@@ -79,7 +85,7 @@ jobs:
       - name: Get Changelog
         if: env.RELEASE_EXISTS == 'no'
         run: |
-          CHANGELOG_ENTRY=$(node .github/scripts/get-changelog.js ${{ env.VERSION }})
+          CHANGELOG_ENTRY=$(node .github/scripts/get-changelog.js ${VERSION})
           # Properly handle multiline output in GitHub Actions
           EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
           echo "CHANGELOG_ENTRY<<$EOF" >> $GITHUB_ENV
@@ -88,7 +94,7 @@ jobs:
 
       - name: Release
         if: env.RELEASE_EXISTS == 'no'
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           files: |
             ${{ env.VSIX_NAME }}
@@ -113,7 +119,7 @@ jobs:
 
       - name: Publish to Open VSX Registry
         if: env.PUBLISH_OPENVSX == 'yes'
-        uses: HaaLeo/publish-vscode-extension@v2
+        uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2.0.0
         with:
           extensionFile: ${{ env.VSIX_NAME }}
           pat: ${{ secrets.TOKEN_OPENVSX }}
@@ -121,7 +127,7 @@ jobs:
 
       - name: Publish to Visual Studio Code Marketplace
         if: env.PUBLISH_VSCODE == 'yes'
-        uses: HaaLeo/publish-vscode-extension@v2
+        uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2.0.0
         with:
           extensionFile: ${{ env.VSIX_NAME }}
           pat: ${{ secrets.TOKEN_VSCODE }}

package/configs/.github/zizmor.yml

@@ -0,0 +1,6 @@
+rules:
+  superfluous-actions:
+    ignore:
+      # allows `softprops/action-gh-release` action
+      - preview.yml:63
+      - publish.yml:97

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@daiyam/artifact-vsx-ts",
-	"version": "0.9.5",
+	"version": "0.9.6",
 	"description": "The configuration to create Visual Studio extensions and publish them on Visual Studio Marketplace and Open VSX Registry.",
 	"author": {
 		"name": "Baptiste Augrain",
@@ -31,5 +31,5 @@
 		"project-template",
 		"scaffold"
 	],
-	"gitHead": "5e6fc473f959bb218d6d5c1b37bb99f0182e0e3d"
+	"gitHead": "6c3e6970d79755e6a60f51a0653fc66702973eb2"
 }