@joshuafolkken/kit 1.929.0 → 1.953.0

package/scripts/version/release-age.ts

@@ -19,12 +19,18 @@ const NPMRC_PATH = '.npmrc'
 const release_times_schema = z.record(z.string(), z.string())
 const MS_PER_MINUTE = 60_000
 
+// The window `.npmrc` content declares, or nothing when it does not declare one — an explicit
+// `minimum-release-age=0` stays 0 rather than collapsing into "not declared".
+function parse_declared_minimum_release_age(npmrc_content: string): number | undefined {
+	const raw = MINIMUM_RELEASE_AGE_RE.exec(npmrc_content)?.[1]
+
+	return raw === undefined ? undefined : Number(raw)
+}
+
 // The quarantine window in minutes from `.npmrc`; a missing or malformed entry means no
 // quarantine, matching pnpm's own default for the setting.
 function parse_minimum_release_age(npmrc_content: string): number {
-	const raw = MINIMUM_RELEASE_AGE_RE.exec(npmrc_content)?.[1]
-
-	return raw === undefined ? NO_QUARANTINE_MINUTES : Number(raw)
+	return parse_declared_minimum_release_age(npmrc_content) ?? NO_QUARANTINE_MINUTES
 }
 
 // Stable releases only, on the requested major, published at or before the cutoff. The
@@ -82,9 +88,7 @@ function select_aged_version(
 // `minimum-release-age=0` opt-out stop the walk instead of falling through to an ancestor's policy.
 function read_declared_minimum_release_age(npmrc_path: string): number | undefined {
 	try {
-		const raw = MINIMUM_RELEASE_AGE_RE.exec(readFileSync(npmrc_path, 'utf8'))?.[1]
-
-		return raw === undefined ? undefined : Number(raw)
+		return parse_declared_minimum_release_age(readFileSync(npmrc_path, 'utf8'))
 	} catch {
 		return undefined
 	}
@@ -138,6 +142,7 @@ function read_nearest_minimum_release_age(start: string, boundary?: string): num
 const release_age = {
 	release_times_schema,
 	parse_minimum_release_age,
+	parse_declared_minimum_release_age,
 	read_minimum_release_age,
 	read_nearest_minimum_release_age,
 	select_aged_version,

package/templates/workflows/ci.yml

@@ -4,9 +4,13 @@ on:
   push:
     branches: [main]
 
+  # No `labeled` / `unlabeled`: a label added right after the pull request opens started a second
+  # run on the same commit, the concurrency block below cancelled one of the two, and a cancelled
+  # run left in the newer check suite blocked the merge (joshuafolkken/kit#2712). The one check that
+  # reads labels runs in `pr-classification.yml` instead.
   pull_request:
     branches: [main]
-    types: [opened, synchronize, reopened, labeled, unlabeled]
+    types: [opened, synchronize, reopened]
 
 # A push run is grouped by the commit it carries, so a later push to the default branch never
 # cancels an earlier one. Without the sha every such push shares one group — `github.ref` is
@@ -25,6 +29,12 @@ concurrency:
 # list (e.g. `chromium firefox webkit`) instead of editing this file, which josh sync overwrites.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
+  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
+  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
+  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
+  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
+  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
+  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
 
 jobs:
   playwright-image:
@@ -179,7 +189,11 @@ jobs:
             ${{ runner.os }}-cspell-cache-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+        run: |
+          installer="$RUNNER_TEMP/install-safe-chain.sh"
+          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+          sh "$installer" --ci
 
       - name: Install dependencies
         env:
@@ -221,10 +235,6 @@ jobs:
       - name: Run unit tests
         run: pnpm josh test:unit
 
-      - name: Check release classification
-        if: github.event_name == 'pull_request'
-        run: pnpm josh pr:classification
-
       - name: Check bundle size
         run: pnpm size-limit
 
@@ -405,7 +415,11 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
+        run: |
+          installer="$RUNNER_TEMP/install-safe-chain.sh"
+          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+          sh "$installer" --ci
 
       - name: Install dependencies
         env:

package/tsconfig/base.json

@@ -1,7 +1,10 @@
 {
 	"compilerOptions": {
 		"strict": true,
-		// tsx uses bundler-like resolution; "bundler" is the correct pairing for module:ESNext
+		// tsx uses bundler-like resolution; "bundler" is the correct pairing for module:ESNext.
+		// `module` is stated rather than inherited: TypeScript 5.x defaults it to a value "bundler"
+		// rejects (TS5095), so a consumer pinned below 6 failed its first check (#2725)
+		"module": "ESNext",
 		"moduleResolution": "bundler",
 		"esModuleInterop": true,
 		"forceConsistentCasingInFileNames": true,