@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/.github/workflows/ci.yml

@@ -51,6 +51,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm and install dependencies
         uses: ./.github/actions/setup-pnpm
@@ -87,6 +89,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # The MCR image lags the npm publish by days, so a version-derived tag is not
       # guaranteed to exist. Probe it first and fall back to a plain runner instead of
@@ -150,6 +154,9 @@ jobs:
       pull-requests: read
     outputs:
       reuse: ${{ steps.prove.outputs.reuse }}
+      run-id: ${{ steps.prove.outputs.run-id }}
+      pull-number: ${{ steps.prove.outputs.pull-number }}
+      author-association: ${{ steps.prove.outputs.author-association }}
     steps:
       - name: Prove the pushed tree passed PR Checks
         id: prove
@@ -165,7 +172,7 @@ jobs:
             exit 0
           fi
           if ! pull=$(printf '%s' "${pulls}" | jq -r --arg sha "${CURRENT_SHA}" \
-            '[.[] | select(.merged_at != null and .merge_commit_sha == $sha and .base.ref == "main")] | if length == 1 then .[0] | [.number, .head.sha, .head.ref, .created_at, .merged_at] | @tsv else empty end'); then
+            '[.[] | select(.merged_at != null and .merge_commit_sha == $sha and .base.ref == "main")] | if length == 1 then .[0] | [.number, .head.sha, .head.ref, .created_at, .merged_at, .author_association] | @tsv else empty end'); then
             echo '::notice::Could not parse the pull request; running the verification jobs.'
             exit 0
           fi
@@ -173,7 +180,7 @@ jobs:
             echo 'No unique merged pull request matched this push; running the verification jobs.'
             exit 0
           fi
-          IFS=$'\t' read -r pull_number head_sha head_ref created_at merged_at <<< "${pull}"
+          IFS=$'\t' read -r pull_number head_sha head_ref created_at merged_at author_association <<< "${pull}"
 
           if ! current_tree=$(gh api "repos/${REPOSITORY}/git/commits/${CURRENT_SHA}" --jq '.tree.sha') || \
             ! pr_tree=$(gh api "repos/${REPOSITORY}/git/commits/${head_sha}" --jq '.tree.sha'); then
@@ -217,6 +224,9 @@ jobs:
           fi
 
           echo 'reuse=true' >> "$GITHUB_OUTPUT"
+          echo "run-id=${run_id}" >> "$GITHUB_OUTPUT"
+          echo "pull-number=${pull_number}" >> "$GITHUB_OUTPUT"
+          echo "author-association=${author_association}" >> "$GITHUB_OUTPUT"
           echo "Reusing successful PR Checks for tree ${current_tree}."
 
   # joshuafolkken/kit#1226 split the gate's four checks across two runners. The unit suite is the only
@@ -232,12 +242,23 @@ jobs:
   # needed a ruleset edit to stay as strict as it was, and left every merge between the two
   # unguarded. So the two halves run under new names and `Checks` stays exactly what the ruleset
   # already requires: a job that is green only when both halves are.
+  #
+  # **The static half is a matrix of three legs** (joshuafolkken/kit#5215). On one runner its seven
+  # checks took 4.1 minutes while every unit shard was done in about two, so it was the critical path
+  # to `Checks`. Each leg is still `josh gate`, narrowed by `--static-group` to the partition
+  # `scripts/gate/gate-static-group.ts` defines, and restores only the caches its checks write — a leg
+  # that restored a cache it never writes would save it back unchanged under the same sha-keyed name,
+  # racing the leg that does write it. `needs.static-checks.result` is `success` only when every leg is.
   static-checks:
-    name: Static Checks
+    name: Static Checks (${{ matrix.group }})
     needs: reuse-pr-checks
     if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
+    strategy:
+      fail-fast: false
+      matrix:
+        group: [lint, types, rest]
     permissions:
       contents: read
       packages: read
@@ -250,13 +271,16 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Setup Node.js
+        id: setup-node
         uses: ./.github/actions/setup-node
         with:
           registry-url: 'https://npm.pkg.github.com'
 
       - name: Setup ESLint cache
+        if: matrix.group == 'lint'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
         with:
@@ -273,11 +297,19 @@ jobs:
           # first — so the cache tracks `main` instead of freezing on the first commit that hit the
           # config-hash key and never re-saving. The config-hash body above still cold-invalidates on a
           # rule edit exactly as before; the sha only ever adds a save, never suppresses one.
-          key: ${{ runner.os }}-eslint-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-${{ github.sha }}
+          # joshuafolkken/kit#4346: ESLint hashes `process.version` into every entry, and runner
+          # images carry different Node.js patch releases for `'24'`. Restored across two of them,
+          # every entry was stale and lint ran cold (~340s against ~60s), so the resolved version
+          # leads every key and restore-key: each release keeps its own lineage.
+          # joshuafolkken/kit#4496: the key is not built from `scripts/gate/toolchain-inputs.ts`, the
+          # list every local reuse reads — the cache is restored before the install, with no tsx to run
+          # it. The lockfile and eslint config hashes move it with the two inputs ESLint's own
+          # per-entry check does not cover.
+          key: ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-${{ github.sha }}
           restore-keys: |
-            ${{ runner.os }}-eslint-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
-            ${{ runner.os }}-eslint-cache-${{ hashFiles('pnpm-lock.yaml') }}-
-            ${{ runner.os }}-eslint-cache-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-
 
       # `.tsbuildinfo` and `.cspellcache` were not cached in CI at all, so the type check and spell
       # check ran cold on every run. Both are content-addressed — `tsc` records its compiler options
@@ -289,6 +321,7 @@ jobs:
       # `josh check` runs `tsc --noEmit --incremental --tsBuildInfoFile .tsbuildinfo` and `josh
       # cspell:dot` runs `cspell . --dot --cache --cache-strategy content --cache-location .cspellcache`.
       - name: Setup TypeScript build cache
+        if: matrix.group == 'types'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: tsbuildinfo-cache
         with:
@@ -300,6 +333,7 @@ jobs:
             ${{ runner.os }}-tsbuildinfo-
 
       - name: Setup cspell cache
+        if: matrix.group == 'rest'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cspell-cache
         with:
@@ -310,6 +344,25 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
+      # joshuafolkken/kit#5116: `josh lint --changed` runs `prettier --check . --cache --cache-strategy
+      # content --cache-location .prettiercache` beside eslint, and with no restored cache it walked
+      # the whole tree cold on every run. Prettier hashes each file's absolute path into its entry
+      # (`scripts/josh/josh-command-types.ts` → `GATE_CACHE_SPECS`), which is why no lane shares it,
+      # but the runner checks out to the same path on every run, so an earlier run's entries hit. The
+      # key is the eslint cache's shape: lockfile and prettier config hashes, then the sha.
+      - name: Setup prettier cache
+        if: matrix.group == 'lint'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        id: prettier-cache
+        with:
+          path: |
+            .prettiercache
+          key: ${{ runner.os }}-prettier-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('prettier.config.js', 'prettier/**/*.js') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-prettier-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('prettier.config.js', 'prettier/**/*.js') }}-
+            ${{ runner.os }}-prettier-cache-${{ hashFiles('pnpm-lock.yaml') }}-
+            ${{ runner.os }}-prettier-cache-
+
       - name: Setup pnpm and install dependencies
         uses: ./.github/actions/setup-pnpm
         with:
@@ -356,9 +409,144 @@ jobs:
       # default branch itself. A name that does not resolve fails the step rather than comparing
       # with nothing.
       - name: Run verification gate
-        run: pnpm josh gate --verbose --no-unit
+        run: pnpm josh gate --verbose --no-unit "--static-group=${STATIC_GROUP}"
         env:
           JOSH_METRICS_BASE: HEAD^1
+          STATIC_GROUP: ${{ matrix.group }}
+
+      # joshuafolkken/kit#4449: a main push that reuses this run skips the job above, so it saves no
+      # ESLint cache, and a later pull request restored an entry several merges old. Since
+      # joshuafolkken/kit#4415 every entry whose imports changed since then is linted afresh — 1,180 to
+      # 2,281 of about 3,200 files at 38 to 58 changed ones. The cache this run leaves is the cache of
+      # the tree the push carries, so it is handed to `seed-eslint-cache` below rather than linted
+      # again there. The prefix is the cache key above without its sha; the seed job saves it under
+      # the push's sha, and the test pins the two together. The upload only saves time, so a
+      # transient artifact-service error must not turn this required job red; it continues on error.
+      - name: Write ESLint cache prefix
+        id: eslint-cache-prefix
+        if: github.event_name == 'pull_request' && matrix.group == 'lint'
+        env:
+          ESLINT_CACHE_PREFIX: ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
+        run: printf '%s\n' "${ESLINT_CACHE_PREFIX}" > eslint-cache-prefix
+
+      - name: Upload ESLint cache
+        if: github.event_name == 'pull_request' && matrix.group == 'lint'
+        continue-on-error: true
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: eslint-cache-${{ github.event.pull_request.number }}
+          path: |
+            .eslintcache
+            eslint-cache-prefix
+          include-hidden-files: true
+          retention-days: 1
+
+  # joshuafolkken/kit#4449: the other half of the hand-off above. It runs only on a push that reused
+  # a pull request's Checks, reads that exact run's cache, and saves it under this push's sha, so the
+  # next pull request restores the cache of the tree it branched from. `actions/cache` misses on the
+  # fresh key and saves the downloaded file in its post step; the prefix is checked before it becomes
+  # a key. A missing artifact — a run from before this — or a prefix that is not a key saves nothing
+  # and leaves the push green; the next pull request then restores an older entry, as it did before.
+  # Only a pull request whose author holds a trusted association (OWNER / MEMBER / COLLABORATOR) is promoted:
+  # an outside author's run can write any `.eslintcache` it likes, and main's scope would then let
+  # later pull requests skip lint on that forged record (joshuafolkken/kit#5050).
+  seed-eslint-cache:
+    name: Seed ESLint Cache
+    needs: reuse-pr-checks
+    if: ${{ needs.reuse-pr-checks.outputs.reuse == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      actions: read
+    steps:
+      - name: Download the reused run's ESLint cache
+        id: download
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ needs.reuse-pr-checks.outputs.run-id }}
+          PULL_NUMBER: ${{ needs.reuse-pr-checks.outputs.pull-number }}
+          AUTHOR_ASSOCIATION: ${{ needs.reuse-pr-checks.outputs.author-association }}
+        run: |
+          case "${AUTHOR_ASSOCIATION}" in
+            OWNER | MEMBER | COLLABORATOR) ;;
+            *)
+              echo "::notice::The pull request's author association (${AUTHOR_ASSOCIATION:-unknown}) is not trusted; saving nothing."
+              exit 0
+              ;;
+          esac
+          if ! gh run download "${RUN_ID}" --repo "${REPOSITORY}" --name "eslint-cache-${PULL_NUMBER}"; then
+            echo '::notice::The reused run left no ESLint cache; saving nothing.'
+            exit 0
+          fi
+          prefix=$(cat eslint-cache-prefix)
+          if ! printf '%s' "${prefix}" | grep -Eq '^[A-Za-z]+-eslint-cache-v[0-9.]+-[0-9a-f]+-[0-9a-f]+-$'; then
+            echo '::warning::The ESLint cache prefix is not a cache key; saving nothing.'
+            exit 0
+          fi
+          echo "prefix=${prefix}" >> "$GITHUB_OUTPUT"
+
+      - name: Save the ESLint cache under this push
+        id: save
+        if: steps.download.outputs.prefix != ''
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            .eslintcache
+          key: ${{ steps.download.outputs.prefix }}${{ github.sha }}
+
+  # joshuafolkken/kit#5189: the seed above saves the pull request's cache under the Node.js release
+  # *that* run resolved. When the runner images move to a new patch release, main holds no lineage
+  # for it, and the first pull request on the new release lints cold (Static Checks 3.7 → 6.6 min).
+  # This job restores with the static-checks key on its own runner, after the seed has saved: an
+  # exact hit means the seed already wrote this release's lineage for this push, and nothing runs.
+  # A miss — a new release, or a seed that saved nothing — lints here, and `actions/cache` saves the
+  # result in its post step, so the cold lint is paid on main instead of on a pull request. The lint
+  # only saves time, so its step continues on error: a red lint still saves, and leaves the job green.
+  warm-eslint-lineage:
+    name: Warm ESLint Lineage
+    needs: [reuse-pr-checks, seed-eslint-cache]
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        id: setup-node
+        uses: ./.github/actions/setup-node
+        with:
+          registry-url: 'https://npm.pkg.github.com'
+
+      - name: Setup ESLint cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        id: eslint-cache
+        with:
+          path: |
+            .eslintcache
+          key: ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-
+
+      - name: Setup pnpm and install dependencies
+        if: steps.eslint-cache.outputs.cache-hit != 'true'
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Lint to write this release's lineage
+        id: lint
+        if: steps.eslint-cache.outputs.cache-hit != 'true'
+        continue-on-error: true
+        run: pnpm josh lint
 
   # The other half of the gate, on a runner of its own. A GitHub job is its own machine, so this job
   # sets Node up again; the pnpm preamble is the shared `.github/actions/setup-pnpm` action
@@ -366,24 +554,29 @@ jobs:
   # `scripts/ci/ci-yml-action-parity.test.ts` compares the two files without the action's own pins
   # (joshuafolkken/kit#3095).
   #
-  # No ESLint cache here — nothing in this job lints — and no `--maxWorkers`: `gate-plan.ts` leaves
-  # any machine below its measured 11 cores uncapped, so vitest sizes its own pool from the runner
-  # exactly as it did inside the gate step.
+  # No ESLint cache here — nothing in this job lints — and no `--maxWorkers`: `josh test:unit` sizes a
+  # lone run's claim on a 4-core runner at vitest's own default, three workers plus vitest itself
+  # (`gate_plan.direct_unit_weight`, joshuafolkken/kit#4607).
   # **Sharded across runners, because one runner is already saturated** (joshuafolkken/kit#3220).
   # Alone on a 4-core runner vitest takes every core, so the suite can only get faster by spreading
   # its files over more machines. `fail-fast: false` keeps a red shard from cancelling the others,
   # so one run reports every failing file. The `Checks` aggregate below reads `needs.unit.result`,
   # which for a matrix is `success` only when every shard succeeded — no change there is needed.
+  # The shards split by the recorded per-file durations in `tools/test/unit-durations.json`, not by
+  # file count, so they finish together (`tools/test/duration-shard.ts`, joshuafolkken/kit#4467).
+  # Six shards (joshuafolkken/kit#5090): at three (joshuafolkken/kit#4610) the slowest shard had
+  # become the last check `Checks` waited on, past Static Checks. Six bring a shard's recorded load
+  # to about two minutes; past that the longest single file, not the shard count, sets the floor.
   # Only kit shards: the distributed template runs the unit suite inside its single `checks` job,
   # where a small consumer suite would pay the duplicated setup and could leave a shard with no file.
   unit:
-    name: Unit Tests (${{ matrix.shard }}/3)
+    name: Unit Tests (${{ matrix.shard }}/6)
     needs: reuse-pr-checks
     if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3]
+        shard: [1, 2, 3, 4, 5, 6]
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -392,6 +585,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -413,7 +608,7 @@ jobs:
       # `scripts/ci/ci-yml-unit-job.test.ts` pins the command; the guard itself is
       # `scripts/test/test-unit-guard.ts`.
       - name: Run unit tests
-        run: pnpm josh test:unit --shard=${{ matrix.shard }}/3
+        run: pnpm josh test:unit --shard=${{ matrix.shard }}/6
 
       # One shard is enough: the check does not depend on which test files ran beside it.
       - name: Verify optional ESLint consumer install
@@ -440,21 +635,30 @@ jobs:
   # shell body is the pattern to keep out of a workflow regardless of the value's provenance.
   checks:
     name: Checks
-    needs: [reuse-pr-checks, static-checks, unit]
+    needs: [reuse-pr-checks, static-checks, unit, node-compat]
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 2
     permissions: {}
     steps:
+      # `node-compat` is aggregated here rather than added to the ruleset: the ruleset holds the one
+      # `Checks` context, and a matrix check name would drift with every Node version bump. It runs on
+      # the reuse path too, so its result is required on both paths (joshuafolkken/kit#4545).
       - name: Require both halves of the verification gate
         env:
           REUSE_RESULT: ${{ needs.reuse-pr-checks.outputs.reuse }}
           STATIC_RESULT: ${{ needs.static-checks.result }}
           UNIT_RESULT: ${{ needs.unit.result }}
+          NODE_RESULT: ${{ needs.node-compat.result }}
         run: |
           echo "Reuse PR Checks: ${REUSE_RESULT}"
           echo "Static Checks: ${STATIC_RESULT}"
           echo "Unit Tests: ${UNIT_RESULT}"
+          echo "Node builds: ${NODE_RESULT}"
+          if [ "${NODE_RESULT}" != 'success' ]; then
+            echo "::error::the Node build matrix did not pass"
+            exit 1
+          fi
           if [ "${STATIC_RESULT}" = 'success' ] && [ "${UNIT_RESULT}" = 'success' ]; then
             exit 0
           fi
@@ -476,12 +680,52 @@ jobs:
 
       - name: Upload PR Checks evidence
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pr-checks-${{ github.event.pull_request.number }}
           path: pr-checks-evidence
           retention-days: 1
 
+  # The pre-commit secretlint scan skips when its binary is missing and never runs on a commit made
+  # with `--no-verify`, so this job scans the pull request's changes again where neither applies
+  # (joshuafolkken/kit#4657). It needs no other job and none needs it, so it stays off the critical
+  # path, and its own `Secret Scan` context is what makes a finding block the merge. Only the files
+  # the pull request adds or changes are read: the merge commit's first parent is the base, which is
+  # why the checkout fetches two commits. secretlint comes from the same store cache every other job
+  # installs from, and `JOSH_SECRETLINT_REQUIRE` turns the hook's missing-binary skip into a failure.
+  # `shell: bash` adds `pipefail`, so a diff that fails cannot hand `xargs` an empty list and pass.
+  secret-scan:
+    name: Secret Scan
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+
+      - name: Setup Node.js
+        uses: ./.github/actions/setup-node
+        with:
+          registry-url: 'https://npm.pkg.github.com'
+
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Scan the changed files for secrets
+        id: scan
+        shell: bash
+        env:
+          JOSH_SECRETLINT_REQUIRE: '1'
+        run: git diff -z --name-only --diff-filter=d HEAD^1 HEAD | xargs -0 -r pnpm josh secretlint-scan
+
   security:
     name: Security Audit
     runs-on: ubuntu-latest
@@ -491,6 +735,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run security audit
         uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
@@ -508,6 +754,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # The same rule `scripts/test/test-e2e-guard.ts` applies locally, so a suite that runs under
       # `pnpm josh test:e2e` is a suite CI runs too. Every `*.e2e.{ts,js}` outside `node_modules`
@@ -561,6 +809,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -601,7 +851,7 @@ jobs:
       # marked red on the run and a missing report is never silent. This job is skipped while kit
       # ships no E2E specs; the guard is here so adding one cannot quietly turn the gap live.
       - name: Upload test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         continue-on-error: true
         with:

package/.github/workflows/dependabot-auto-merge.yml

@@ -4,9 +4,10 @@ on: pull_request
 
 # One run per pull request, superseded ones cancelled. `ci.yml` groups its pull-request runs the
 # same way but no longer its pushes: since joshuafolkken/kit#1481 it appends the commit sha on a
-# `push` event, which this workflow — triggered by `pull_request` alone — has no use for. kit's own
-# copy has no withdrawal for a stale run to arm behind (joshuafolkken/kit#842 is about the
-# distributed copy), so here the group only keeps a force-pushed bump from paying for two runs.
+# `push` event, which this workflow — triggered by `pull_request` alone — has no use for. A stale run
+# cannot arm behind the withdrawal below: its `--match-head-commit` is refused once the branch moved
+# (joshuafolkken/kit#842 is about the distributed copy), so here the group only keeps a
+# force-pushed bump from paying for two runs.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -51,13 +52,71 @@ jobs:
       # npm bumps never auto-merge, at any semver level: kit publishes lint plugins as runtime
       # dependencies, so a patch release can change rule behavior for every consumer while kit's own
       # CI only proves that kit still builds. Major bumps never auto-merge in either ecosystem.
+      #
+      # Only the `github-actions` group merges: `.github/dependabot.yml` puts the actions the publish
+      # jobs run with publish credentials, and those of the `pack` job that builds the tarball they
+      # publish, in a group of their own, because a hijacked release of one would publish with valid
+      # provenance, so a person reviews it (joshuafolkken/kit#4633, joshuafolkken/kit#4654). An
+      # ungrouped pull request does not merge either, so a bump that escapes both groups is reviewed.
+      #
+      # `--match-head-commit` refuses to arm when the branch moved after the event this run was
+      # triggered for, so a commit pushed before the arming does not merge on the bump's metadata. A
+      # push after the arming is the withdrawal step's (joshuafolkken/kit#4654).
       - name: Enable auto-merge for github-actions patch and minor updates
         if: >-
           github.actor == 'dependabot[bot]'
           && steps.metadata.outputs.package-ecosystem == 'github_actions'
+          && steps.metadata.outputs.dependency-group == 'github-actions'
           && (steps.metadata.outputs.update-type == 'version-update:semver-patch'
           || steps.metadata.outputs.update-type == 'version-update:semver-minor')
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           GH_TOKEN: ${{ github.token }}
-        run: gh pr merge --auto --merge "$PR_URL"
+        run: gh pr merge --auto --merge --match-head-commit "$HEAD_SHA" "$PR_URL"
+
+      # The arming only binds the head it was made on: GitHub keeps auto-merge on through a later push,
+      # so a commit a collaborator pushes to the branch would merge on the bump's metadata. A push by
+      # anyone but Dependabot therefore withdraws the arming this workflow made (joshuafolkken/kit#4691).
+      # Only that one: an auto-merge a maintainer enabled by hand — before their push or after it — is
+      # their decision, and the step reads who enabled it to leave it alone.
+      #
+      # `--disable-auto` is an error on a pull request with nothing armed, so the state is read first;
+      # a read that fails falls through to the withdrawal rather than past it, and a withdrawal that
+      # still fails after its retries leaves the run red. GraphQL names the token's identity
+      # `github-actions`; the REST spelling is accepted too.
+      - name: Withdraw this workflow's auto-merge after a push by anyone but Dependabot
+        id: withdraw
+        if: github.actor != 'dependabot[bot]'
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          # A variable so the unit test that runs this script can set the delay to zero.
+          RETRY_ATTEMPTS: '3'
+          RETRY_BACKOFF_SECONDS: '5'
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          enabler="$(gh pr view "$PR_URL" --json autoMergeRequest \
+            --jq '.autoMergeRequest.enabledBy.login // ""')" || enabler=unknown
+
+          case "$enabler" in
+            '')
+              echo 'Auto-merge is not enabled — nothing to withdraw.'
+              exit 0
+              ;;
+            github-actions | 'github-actions[bot]' | unknown) ;;
+            *)
+              echo "Auto-merge was enabled by $enabler — leaving their decision as it is."
+              exit 0
+              ;;
+          esac
+
+          attempt=1
+
+          until gh pr merge --disable-auto "$PR_URL"; do
+            if [ "$attempt" -ge "$RETRY_ATTEMPTS" ]; then
+              exit 1
+            fi
+
+            sleep "$((attempt * RETRY_BACKOFF_SECONDS))"
+            attempt=$((attempt + 1))
+          done

package/.github/workflows/production.yml

@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Configure Git
         run: |
@@ -35,7 +36,14 @@ jobs:
           # resolves to that branch, not the released tag. Use the tag carried in the
           # dispatch payload (set by auto-tag.yml) as the merge source instead.
           REF_NAME: ${{ inputs.tag || github.event.client_payload.tag }}
+          GH_TOKEN: ${{ github.token }}
         run: |
+          # The checkout keeps no credentials, so the token reaches git for this step only, through
+          # the environment rather than .git/config (joshuafolkken/kit#4651).
+          BASIC=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          echo "::add-mask::$BASIC"
+          export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.https://github.com/.extraheader GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $BASIC"
+
           if [ -z "$REF_NAME" ]; then
             echo "::error::new-tag-created dispatch carried no tag payload; aborting." >&2
             exit 1