bits-to-dead-trees 2.31.0 → 2.32.0

package/.github/dependabot.yml

@@ -4,8 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-
-  - package-ecosystem: "docker"
-    directory: "/"
-    schedule:
-      interval: "weekly"
+    cooldown:
+      default-days: 7

package/.github/workflows/build-docker-image-of-release.yml

@@ -10,35 +10,57 @@ on:
         required: true
         type: string
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   build:
+    name: Build and push Docker image
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      packages: write
-      pull-requests: write
+      contents: write # Required to commit README updates and push the PR branch.
+      packages: write # Required to publish the image to GitHub Container Registry.
+      pull-requests: write # Required to open or update the README pull request.
     steps:
       - name: Set tag name
-        run: echo "TAG_NAME=${{ inputs.ref_name || github.ref_name }}" >> $GITHUB_ENV
+        env:
+          INPUT_REF_NAME: ${{ inputs.ref_name }}
+          RELEASE_REF_NAME: ${{ github.ref_name }}
+        run: |
+          tag_name="${INPUT_REF_NAME:-${RELEASE_REF_NAME}}"
+          if [ -z "${tag_name}" ]; then
+            echo "Unable to determine tag name" >&2
+            exit 1
+          fi
+
+          if [[ "${tag_name}" == *$'\n'* ]] || [[ "${tag_name}" == *$'\r'* ]]; then
+            echo "Tag name must not contain newlines" >&2
+            exit 1
+          fi
+
+          echo "TAG_NAME=${tag_name}" >> "${GITHUB_ENV}"
+
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ env.TAG_NAME }}
+          persist-credentials: false
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build and push builder image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
         with:
           file: Dockerfile
           push: true
@@ -49,14 +71,31 @@ jobs:
 
       - name: Update version in README
         run: |
-          sed -i 's|image: ghcr.io/rmehner/bits-to-dead-trees:v.*|image: ghcr.io/rmehner/bits-to-dead-trees:${{ env.TAG_NAME }}|' README.md
+          sed -i "s|image: ghcr.io/rmehner/bits-to-dead-trees:v.*|image: ghcr.io/rmehner/bits-to-dead-trees:${TAG_NAME}|" README.md
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
-        with:
-          sign-commits: true
-          commit-message: "🤖 Update version of docker image in README to ${{ env.TAG_NAME }}"
-          title: "🤖 Update version in README after release"
-          base: main
-          body: |
-            Updates the referenced docker image version in the README to ${{ env.TAG_NAME }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ env.TAG_NAME }}
+        run: |
+          if [ -z "$(git status --porcelain README.md)" ]; then
+            exit 0
+          fi
+
+          branch_tag="${TAG_NAME//[^A-Za-z0-9._-]/-}"
+          branch_name="update-docker-image-${branch_tag}"
+          title="🤖 Update version in README after release"
+          body="Updates the referenced docker image version in the README to ${TAG_NAME}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "${branch_name}"
+          git add README.md
+          git commit -m "🤖 Update version of docker image in README to ${TAG_NAME}"
+          git push --force-with-lease "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${branch_name}"
+
+          if gh pr view "${branch_name}" --json number --jq .number >/dev/null 2>&1; then
+            gh pr edit "${branch_name}" --title "${title}" --body "${body}"
+          else
+            gh pr create --base main --head "${branch_name}" --title "${title}" --body "${body}"
+          fi

package/.github/workflows/check-json-schema.yml

@@ -2,19 +2,26 @@ name: Check JSON schema
 
 on: push
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   check-json-schema:
+    name: Check JSON schema
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required to commit schema updates back to the current branch.
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -26,6 +33,15 @@ jobs:
         run: npm run update-schemas
 
       - name: Commit schema changes
-        uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "🤖 Update schema to match Playwright version"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add .
+          git commit -m "🤖 Update schema to match Playwright version"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"

package/.github/workflows/ci.yml

@@ -2,19 +2,25 @@ name: CI
 
 on: push
 
+permissions:
+  contents: read # Required to check out repository contents.
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   ci:
+    name: CI
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm

package/.github/workflows/keep-versions-in-sync.yml

@@ -6,29 +6,55 @@ on:
     branches:
       - "depfu/update/npm/playwright-core-**"
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   sync-node-version:
+    name: Keep versions in sync
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # Required to commit version sync updates back to the current branch.
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.head_ref }}
+          persist-credentials: false
 
       - name: Sync .node-version with the one that Playwright is using
         run: .github/bin/sync-node-version-from-playwright
 
-      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "🤖 Update .node-version after playwright update"
+      - name: Commit .node-version changes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add .
+          git commit -m "🤖 Update .node-version after playwright update"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"
 
       - name: Sync Playwright version in dockerfile with the one from package.json
         run: .github/bin/sync-playwright-version-to-dockerfile
 
-      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "🤖 Update playwright-core in Dockerfile after depfu update"
+      - name: Commit Dockerfile changes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add .
+          git commit -m "🤖 Update playwright-core in Dockerfile after depfu update"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"

package/.github/workflows/release.yml

@@ -5,27 +5,33 @@ on:
     branches:
       - main
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+permissions: {}
 
-permissions:
-  id-token: write # Required for OIDC
-  contents: write
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Required for npm provenance/OIDC during release publishing.
+      contents: write # Required for Changesets to create releases and version commits.
+      pull-requests: write # Required for Changesets to create release pull requests.
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
+          registry-url: https://registry.npmjs.org
           cache: npm
 
       - name: Install Dependencies
@@ -33,10 +39,9 @@ jobs:
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           publish: npm run release
           title: Release new version 🚀
         env:
           GITHUB_TOKEN: ${{ secrets.PERSONAL_GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/run-prettier-on-prettier-updates.yml

@@ -5,19 +5,27 @@ on:
     branches:
       - "depfu/update/npm/prettier-**"
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   run-prettier:
+    name: Run Prettier
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # Required to commit formatting updates back to the current branch.
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.head_ref }}
+          persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -29,6 +37,15 @@ jobs:
         run: npm run format
 
       - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "🤖 Ran prettier after prettier update"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add .
+          git commit -m "🤖 Ran prettier after prettier update"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"

package/.github/workflows/zizmor.yml

@@ -0,0 +1,36 @@
+name: Zizmor
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**.yml"
+
+  pull_request:
+    paths:
+      - ".github/**.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          advanced-security: false
+          annotations: true
+          persona: "pedantic"

package/.node-version

@@ -1 +1 @@
-24.15.0
+24.16.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # bits-to-dead-trees
 
+## 2.32.0
+
+### Minor Changes
+
+- [#669](https://github.com/rmehner/bits-to-dead-trees/pull/669) [`f22459a`](https://github.com/rmehner/bits-to-dead-trees/commit/f22459a9674c81ed9748a2c9d18ddb3b6f18a3cb) Thanks [@depfu](https://github.com/apps/depfu)! - Upgrade to Playwright 1.61.0
+
+## 2.31.1
+
+### Patch Changes
+
+- [#654](https://github.com/rmehner/bits-to-dead-trees/pull/654) [`759a948`](https://github.com/rmehner/bits-to-dead-trees/commit/759a948c4e4980d2c6967e518f90646dc5dab59f) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update docker to use playwright 1.60.0 as well
+
 ## 2.31.0
 
 ### Minor Changes

package/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/playwright:v1.58.2
+FROM mcr.microsoft.com/playwright:v1.61.0
 
 ENV NODE_ENV=production
 ENV PORT=8000

package/README.md

@@ -57,7 +57,7 @@ If you want to use it internally with docker-compose, this should give you a goo
 ```yml
 services:
   pdf:
-    image: ghcr.io/rmehner/bits-to-dead-trees:v2.30.1
+    image: ghcr.io/rmehner/bits-to-dead-trees:v2.31.1
     ports:
       - 8000:8000
 ```

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "bits-to-dead-trees",
   "author": "Robin Mehner <robin@coding-robin.de>",
-  "version": "2.31.0",
+  "version": "2.32.0",
   "description": "Turn HTML into PDF files",
-  "repository": "github:rmehner/bits-to-dead-trees",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rmehner/bits-to-dead-trees.git"
+  },
   "license": "Apache-2.0",
   "keywords": [
     "html",
@@ -31,23 +34,23 @@
   },
   "dependencies": {
     "fastify": "^5.8.5",
-    "playwright-core": "^1.60.0"
+    "playwright-core": "^1.61.0"
   },
   "devDependencies": {
-    "@changesets/changelog-github": "^0.6.0",
+    "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
-    "@eslint/js": "^9.39.4",
+    "@eslint/js": "^10.0.1",
     "@tsconfig/node24": "^24.0.4",
     "@types/lodash": "^4.17.24",
     "@types/node": "24.12.0",
-    "eslint": "^9.39.4",
+    "eslint": "^10.4.1",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-n": "^17.24.0",
+    "eslint-plugin-n": "^18.1.0",
     "eslint-plugin-promise": "^7.3.0",
     "globals": "^17.6.0",
     "pino-pretty": "^13.1.3",
-    "prettier": "^3.8.3",
+    "prettier": "^3.8.4",
     "typescript-json-schema": "^0.67.4",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.8"
   }
 }