@joshuafolkken/kit 1.1094.0 → 1.1128.0

package/scripts/test/test-declared.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env tsx
 import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
-import { parseArgs } from 'node:util'
 import { project_checks } from '#scripts/gate/project-checks'
+import { cli_flags } from '#scripts/lib/cli-flags'
 import { test_declared_changed } from './test-declared-changed'
 import { test_declared_logic, type Verdict } from './test-declared-logic'
 import { test_declared_match, type MatchResult } from './test-declared-match'
@@ -55,13 +55,9 @@ interface Options {
 // The parsed flags, or `undefined` when an unknown one was passed — the strict parse is what turns a
 // typo into a refusal rather than a silent re-print of the verdict.
 function parse(argv: ReadonlyArray<string>): Options | undefined {
-	try {
-		const { values } = parseArgs({ args: [...argv], options: PARSE_ARGS_OPTIONS, strict: true })
+	const values = cli_flags.values_of(argv, PARSE_ARGS_OPTIONS)
 
-		return { is_help: values.help, is_match: values.match }
-	} catch {
-		return undefined
-	}
+	return values === undefined ? undefined : { is_help: values.help, is_match: values.match }
 }
 
 // The next command a verdict leaves to run, or `undefined` when there is nothing to do next. Only

package/scripts/version/version-commands.ts

@@ -24,6 +24,8 @@ import { version_targets } from './version-targets'
 const FAILURE_EXIT_CODE = 1
 const ALREADY_UP_TO_DATE = 'Already up to date'
 const NO_QUARANTINE_MINUTES = 0
+// A global install that goes to the network — the same ten minutes `lane-install.ts` gives one.
+const UPGRADE_TIMEOUT_MS = 600_000
 
 // What the local minimum-release-age policy permits for one package. Resolved per package because
 // the newest installable release is a property of that package's own publish history. Returns a hold
@@ -195,8 +197,16 @@ function run_check(config: VersionCommandConfig): void {
 	)
 }
 
+// Through `sh -c` because an upgrade command is the user's own configured string — `pnpm add -g …`,
+// or a chain with `&&` — so it is inside the trust boundary and needs a shell to mean what it says.
+// The bound keeps a registry that never answers from holding `josh version` open forever; a timed-out
+// run has no exit code, so it falls through to the failure code like any other failed step.
 function run_upgrade_command(command: string): number {
-	const result = execaSync('sh', ['-c', command], { stdio: 'inherit', reject: false })
+	const result = execaSync('sh', ['-c', command], {
+		stdio: 'inherit',
+		reject: false,
+		timeout: UPGRADE_TIMEOUT_MS,
+	})
 
 	return result.exitCode ?? FAILURE_EXIT_CODE
 }

package/templates/CLAUDE.basic.md

@@ -1,8 +1,8 @@
 # Project instructions
 
-- 既存のファイルと利用者の設定を尊重し、変更する前に内容を確認する。
-- 変更には検証を付け、実行した結果を報告する。
-- HTML、CSS、JavaScript のファイルがある場合は Prettier で整形する。
-- 画面に見える変更をした場合はブラウザーで表示と操作を確認する。
-- JavaScript または TypeScript の動作を変更した場合は、その動作を確認する自動テストを追加する。
-- Git や GitHub を使う場合だけ、それぞれのワークフローを利用する。
+- Respect existing files and the user's settings, and read a file's contents before changing it.
+- Verify every change, and report the results you actually observed.
+- Format HTML, CSS and JavaScript files with Prettier when the project has any.
+- After a change that is visible on screen, check its display and interaction in a browser.
+- After changing JavaScript or TypeScript behavior, add an automated test that checks that behavior.
+- Use the Git or GitHub workflow only when you use Git or GitHub.

package/templates/workflows/ci.yml

@@ -29,12 +29,11 @@ concurrency:
 # list (e.g. `chromium firefox webkit`) instead of editing this file, which josh sync overwrites.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
-  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
-  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
-  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
-  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
+
+# Every job that needs pnpm prepares it through `.github/actions/setup-pnpm`, which `josh sync`
+# writes beside this file: the pnpm version resolution, the store cache, the hash-verified safe-chain
+# installer and the install. kit's own `ci.yml` calls the same action, so the path a consumer runs is
+# the path kit runs (joshuafolkken/kit#3095).
 
 jobs:
   playwright-image:
@@ -126,37 +125,11 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup ESLint cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
@@ -188,17 +161,10 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # A `basic` project has no `prepare`, no build and no SvelteKit, so the ordered steps below
       # would fail on its first pull request (joshuafolkken/kit#2814). The profile is read from
@@ -399,37 +365,11 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: build-cache
@@ -441,17 +381,10 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-build-cache-e2e-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # --ignore-scripts suppresses the install-time `prepare`, so generated framework
       # files never appear. Playwright >= 1.62 hard-throws when a tsconfig `extends`
@@ -679,6 +612,7 @@ jobs:
       needs.e2e-detect.result == 'success' &&
       (needs.e2e.result == 'success' || needs.e2e.result == 'skipped')
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       contents: write
     steps:

package/templates/workflows/dependabot-auto-merge.yml

@@ -27,6 +27,7 @@ jobs:
   # what stays restricted to Dependabot's own events, on the step below.
   auto-merge:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       # Whether the pull request touches a workflow some upstream package overwrites. Decided from

package/templates/workflows/github-release.yml

@@ -57,9 +57,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.release.outputs.tag != ''
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         if: steps.release.outputs.tag != ''

package/tsconfig.sonar.json

@@ -1,29 +1,11 @@
 {
+	"extends": "@joshuafolkken/kit/tsconfig/base",
 	"compilerOptions": {
-		"target": "ES2020",
-		"module": "ES2020",
-		"lib": ["ES2020", "DOM", "DOM.Iterable"],
-		"moduleResolution": "node",
-		"allowImportingTsExtensions": false,
+		"target": "ES2022",
+		"lib": ["ES2023", "DOM", "DOM.Iterable"],
+		"types": ["node"],
 		"allowJs": true,
 		"checkJs": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"resolveJsonModule": true,
-		"skipLibCheck": true,
-		"sourceMap": true,
-		"strict": true,
-		"noUncheckedIndexedAccess": true,
-		"noImplicitOverride": true,
-		"noUnusedLocals": true,
-		"noUnusedParameters": true,
-		"exactOptionalPropertyTypes": true,
-		"noFallthroughCasesInSwitch": true,
-		"noImplicitReturns": true,
-		"noPropertyAccessFromIndexSignature": true,
-		"allowUnusedLabels": false,
-		"allowUnreachableCode": false,
-		"isolatedModules": true,
 		"paths": {
 			"$lib": ["./src/lib"],
 			"$lib/*": ["./src/lib/*"]