From c8558f1c2e3232a119aed69ca53e6923b232094c Mon Sep 17 00:00:00 2001 From: Vladimir Date: Wed, 21 Oct 2026 08:26:33 +0200 Subject: [PATCH] chore: address code scanning alerts (#11671) --- .github/actionlint.yaml | 6 ++ .github/renovate.json5 | 4 +- .github/workflows/approve-contributor.yml | 2 + .github/workflows/ci.yml | 20 +++--- .github/workflows/ecosystem-ci-trigger.yml | 4 +- .github/workflows/issue-close-require.yml | 8 +-- .github/workflows/issue-labeled.yml | 28 ++------ .github/workflows/knip.yml | 2 +- .github/workflows/publish.yml | 2 +- .npmrc | 1 + AGENTS.md | 2 +- docs/.vitepress/config.ts | 9 --- pnpm-workspace.yaml | 79 ++++++++++++++++++++++ 13 files changed, 112 insertions(+), 55 deletions(-) create mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 000000000..a96fc1dbb --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,6 @@ +paths: + .github/workflows/**/*.yml: + ignore: + # actionlint does not support the self-repository syntax yet: https://github.com/rhysd/actionlint/issues/711 + - 'specifying action "\$/[^"]+" in invalid format because ref is missing' + - 'reusable workflow call "\$/[^"]+" at "uses" is not following the format' diff --git a/.github/renovate.json5 b/.github/renovate.json5 index f2e658451..5e8293635 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -3,9 +3,9 @@ extends: ['config:recommended', 'schedule:weekly', 'group:allNonMajor'], labels: ['dependencies'], rangeStrategy: 'bump', - // Align with pnpm's `minimumReleaseAge` default (1440 minutes) so Renovate does + // Align with `minimumReleaseAge` in pnpm-workspace.yaml (10080 minutes) so Renovate does // not propose versions that pnpm's supply-chain check would reject as too new. - minimumReleaseAge: '1 day', + minimumReleaseAge: '7 days', packageRules: [ { groupName: 'Oxc packages', diff --git a/.github/workflows/approve-contributor.yml b/.github/workflows/approve-contributor.yml index 855e2935e..8ad36762d 100644 --- a/.github/workflows/approve-contributor.yml +++ b/.github/workflows/approve-contributor.yml @@ -9,6 +9,8 @@ name: Approve Contributor # Do not interpolate the comment into `run` steps or scripts. on: + # zizmor: ignore[dangerous-triggers] + # The script checks the permission of the commenter, see the SECURITY note above. issue_comment: types: [created] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bf61760d6..e9ca7d1a8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,7 +39,7 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-and-cache + - uses: $/.github/actions/setup-and-cache - name: Install run: pnpm i --filter '!docs' @@ -187,14 +187,14 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-and-cache + - uses: $/.github/actions/setup-and-cache with: node-version: ${{ matrix.node_version }} - name: Install run: pnpm i --filter '!docs' - - uses: ./.github/actions/setup-playwright + - uses: $/.github/actions/setup-playwright with: browsers: chromium @@ -268,14 +268,14 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-and-cache + - uses: $/.github/actions/setup-and-cache with: node-version: 24 - name: Install run: pnpm i --filter '!docs' - - uses: ./.github/actions/setup-playwright + - uses: $/.github/actions/setup-playwright with: browsers: all @@ -319,14 +319,14 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-and-cache + - uses: $/.github/actions/setup-and-cache with: node-version: 24 - name: Install run: pnpm i --filter '!docs' - - uses: ./.github/actions/setup-playwright + - uses: $/.github/actions/setup-playwright with: browsers: all @@ -370,7 +370,7 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-and-cache + - uses: $/.github/actions/setup-and-cache with: node-version: 24 @@ -382,7 +382,7 @@ jobs: # ubuntu runners have no default git identity; set one for this commit git add . && git -c user.email=ci@vitest.dev -c user.name=vitest-ci commit -m "ci" && pnpm i --prefer-offline --no-frozen-lockfile --filter '!docs' - - uses: ./.github/actions/setup-playwright + - uses: $/.github/actions/setup-playwright with: browsers: all @@ -412,7 +412,7 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-and-cache + - uses: $/.github/actions/setup-and-cache - name: Install run: pnpm i --filter '!docs' diff --git a/.github/workflows/ecosystem-ci-trigger.yml b/.github/workflows/ecosystem-ci-trigger.yml index a84994ffd..af076cf79 100644 --- a/.github/workflows/ecosystem-ci-trigger.yml +++ b/.github/workflows/ecosystem-ci-trigger.yml @@ -1,6 +1,8 @@ name: ecosystem-ci trigger on: + # zizmor: ignore[dangerous-triggers] + # The first step fails unless the commenter has triage access, the comment is used only as data. issue_comment: types: [created] @@ -75,7 +77,7 @@ jobs: - id: generate-token uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: - app-id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }} + client-id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }} private-key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }} repositories: | vitest diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml index cd0c64967..0366a4ccf 100644 --- a/.github/workflows/issue-close-require.yml +++ b/.github/workflows/issue-close-require.yml @@ -12,22 +12,18 @@ jobs: runs-on: ubuntu-slim name: Close Marked Issues and PRs permissions: - contents: read # to check out the repo for local actions issues: write # to close issues pull-requests: write # to close pull requests steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - name: needs reproduction - uses: ./.github/actions/issues-helper + uses: $/.github/actions/issues-helper with: actions: close-issues token: ${{ secrets.GITHUB_TOKEN }} labels: needs reproduction inactive-day: 3 - name: maybe automated - uses: ./.github/actions/issues-helper + uses: $/.github/actions/issues-helper with: actions: close-issues token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/issue-labeled.yml b/.github/workflows/issue-labeled.yml index 1b095bb97..2986a185c 100644 --- a/.github/workflows/issue-labeled.yml +++ b/.github/workflows/issue-labeled.yml @@ -22,15 +22,10 @@ jobs: if: github.repository == 'vitest-dev/vitest' && github.event.label.name == 'needs reproduction' name: Minimal Reproduction Label permissions: - contents: read # to check out the repo for local actions issues: write # adding a label steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - ref: main - name: needs reproduction - uses: ./.github/actions/issues-helper + uses: $/.github/actions/issues-helper with: actions: create-comment token: ${{ secrets.GITHUB_TOKEN }} @@ -43,15 +38,10 @@ jobs: if: github.repository == 'vitest-dev/vitest' && github.event.label.name == 'approved' && github.event_name == 'issues' && github.event.issue.state == 'open' name: Approved Label permissions: - contents: read # to check out the repo for local actions issues: write # sending a comment steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - ref: main - name: approved - uses: ./.github/actions/issues-helper + uses: $/.github/actions/issues-helper with: actions: create-comment token: ${{ secrets.GITHUB_TOKEN }} @@ -66,15 +56,10 @@ jobs: if: github.repository == 'vitest-dev/vitest' && github.event.label.name == 'maybe automated' && github.event_name == 'issues' name: Comment on Bot Issue permissions: - contents: read # to check out the repo for local actions issues: write # sending a comment steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - ref: main - name: maybe automated - uses: ./.github/actions/issues-helper + uses: $/.github/actions/issues-helper with: actions: create-comment token: ${{ secrets.GITHUB_TOKEN }} @@ -96,14 +81,9 @@ jobs: if: github.repository == 'vitest-dev/vitest' && github.event.label.name == 'maybe automated' && github.event_name == 'pull_request_target' name: Comment on Bot PR permissions: - contents: read # to check out the repo for local actions pull-requests: write # sending a comment steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - ref: main - - uses: ./.github/actions/send-ai-bot-comment + - uses: $/.github/actions/send-ai-bot-comment with: token: ${{ secrets.GITHUB_TOKEN }} pr-number: ${{ github.event.pull_request.number }} diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml index 90b52a281..0e4d5cfe9 100644 --- a/.github/workflows/knip.yml +++ b/.github/workflows/knip.yml @@ -24,7 +24,7 @@ jobs: with: persist-credentials: false - - uses: ./.github/actions/setup-and-cache + - uses: $/.github/actions/setup-and-cache - name: Install run: pnpm install --frozen-lockfile diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 658f9f6ba..6c63dc8cc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -137,7 +137,7 @@ jobs: name: Promote stable documentation permissions: contents: read - uses: ./.github/workflows/promote-docs.yml + uses: $/.github/workflows/promote-docs.yml with: target: ${{ github.sha }} # the values come from the release-bot environment of the called job, diff --git a/.npmrc b/.npmrc index 77b004cab..1fc1b33a2 100644 --- a/.npmrc +++ b/.npmrc @@ -1,3 +1,4 @@ provenance=true registry=https://registry.npmjs.org/ VITEST_MODULE_DIRECTORIES=/node_modules/,/packages/ +min-release-age=7 diff --git a/AGENTS.md b/AGENTS.md index d3ee88b78..5c4fcc580 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -226,7 +226,7 @@ Other blocking CI jobs: - The workspace develops against the latest supported Vite major, but `vitest` supports the full peer range and CI runs a dedicated job against the previous major (`pnpm override-vite7` reproduces it locally). Do not rely on newest-Vite-only APIs without a fallback. - Deps listed under `patchedDependencies` (`acorn`, `cac`, `@sinonjs/fake-timers`, `rrweb-snapshot`) are version-locked. Bumping one requires regenerating the patch with `pnpm patch` and updating the version-keyed entry in `pnpm-workspace.yaml`. - Dependency build scripts run only for packages listed under `allowBuilds` in `pnpm-workspace.yaml`; a new dep with a postinstall step installs unbuilt unless added there. -- pnpm enforces a 24h `minimumReleaseAge`: installing a version published less than a day ago either resolves to an older version or appends the pick to `minimumReleaseAgeExclude` in `pnpm-workspace.yaml`. Both outcomes are expected; commit the yaml change instead of reverting it. +- pnpm enforces a 7-day `minimumReleaseAge` and checks every lockfile entry against it, also with `--frozen-lockfile`. A range resolves to the newest version that is old enough. To use a newer version, add its exact `name@version` to `minimumReleaseAgeExclude` in `pnpm-workspace.yaml`; `pnpm install` removes the entry when the version leaves the lockfile. Commit that yaml change instead of reverting it. ## Browser Testing diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts index c5021809e..8b8518c8a 100644 --- a/docs/.vitepress/config.ts +++ b/docs/.vitepress/config.ts @@ -144,15 +144,6 @@ export default ({ mode }: { mode: string }) => { search: { provider: 'local', - /* provider: 'algolia', - options: { - appId: 'ZTF29HGJ69', - apiKey: '9c3ced6fed60d2670bb36ab7e8bed8bc', - indexName: 'vitest', - // searchParameters: { - // facetFilters: ['tags:en'], - // }, - }, */ }, // banner: { diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ee5403bd7..02a2ce32c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,8 +1,10 @@ +blockExoticSubdeps: true catalogMode: prefer catalogPrune: true ignoreWorkspaceCycles: true ignoreWorkspaceRootCheck: true +minimumReleaseAge: 10080 minimumReleaseAgeExcludePrune: true shellEmulator: true strictPeerDependencies: false @@ -116,7 +118,84 @@ allowBuilds: vue-demi: true workerd: true minimumReleaseAgeExclude: + - '@asamuzakjp/dom-selector@10.0.4' + - '@playwright/test@1.64.1' + - '@rolldown/binding-android-arm-eabi@1.2.14' + - '@rolldown/binding-android-arm64@1.2.14' + - '@rolldown/binding-darwin-arm64@1.2.14' + - '@rolldown/binding-darwin-x64@1.2.14' + - '@rolldown/binding-freebsd-x64@1.2.14' + - '@rolldown/binding-linux-arm-gnueabihf@1.2.14' + - '@rolldown/binding-linux-arm64-gnu@1.2.14' + - '@rolldown/binding-linux-arm64-musl@1.2.14' + - '@rolldown/binding-linux-ppc64-gnu@1.2.14' + - '@rolldown/binding-linux-s390x-gnu@1.2.14' + - '@rolldown/binding-linux-x64-gnu@1.2.14' + - '@rolldown/binding-linux-x64-musl@1.2.14' + - '@rolldown/binding-openharmony-arm64@1.2.14' + - '@rolldown/binding-win32-arm64-msvc@1.2.14' + - '@rolldown/binding-win32-x64-msvc@1.2.14' + - '@rollup/rollup-android-arm-eabi@4.64.9' + - '@rollup/rollup-android-arm64@4.64.9' + - '@rollup/rollup-darwin-arm64@4.64.9' + - '@rollup/rollup-darwin-x64@4.64.9' + - '@rollup/rollup-freebsd-arm64@4.64.9' + - '@rollup/rollup-freebsd-x64@4.64.9' + - '@rollup/rollup-linux-arm-gnueabihf@4.64.9' + - '@rollup/rollup-linux-arm-musleabihf@4.64.9' + - '@rollup/rollup-linux-arm64-gnu@4.64.9' + - '@rollup/rollup-linux-arm64-musl@4.64.9' + - '@rollup/rollup-linux-loong64-gnu@4.64.9' + - '@rollup/rollup-linux-loong64-musl@4.64.9' + - '@rollup/rollup-linux-ppc64-gnu@4.64.9' + - '@rollup/rollup-linux-ppc64-musl@4.64.9' + - '@rollup/rollup-linux-riscv64-gnu@4.64.9' + - '@rollup/rollup-linux-riscv64-musl@4.64.9' + - '@rollup/rollup-linux-s390x-gnu@4.64.9' + - '@rollup/rollup-linux-x64-gnu@4.64.9' + - '@rollup/rollup-linux-x64-musl@4.64.9' + - '@rollup/rollup-openbsd-x64@4.64.9' + - '@rollup/rollup-openharmony-arm64@4.64.9' + - '@rollup/rollup-win32-arm64-msvc@4.64.9' + - '@rollup/rollup-win32-ia32-msvc@4.64.9' + - '@rollup/rollup-win32-x64-gnu@4.64.9' + - '@rollup/rollup-win32-x64-msvc@4.64.9' - '@vitest/istanbul-lib-coverage@2.0.0' - '@vitest/istanbul-lib-instrument@2.0.0' - '@vitest/istanbul-lib-report@2.0.0' - '@vitest/istanbul-lib-source-maps@2.0.0' + - devframe@1.2.5 + - h3@2.0.3 + - jsdom@30.1.3 + - miniflare@5.20261012.1-beta + - playwright-core@1.64.1 + - playwright@1.64.1 + - react-dom@19.3.1 + - react-is@19.3.1 + - react@19.3.1 + - rolldown@1.2.14 + - rollup@4.64.9 + - sass-embedded-all-unknown@1.105.2 + - sass-embedded-android-arm64@1.105.2 + - sass-embedded-android-arm@1.105.2 + - sass-embedded-android-riscv64@1.105.2 + - sass-embedded-android-x64@1.105.2 + - sass-embedded-darwin-arm64@1.105.2 + - sass-embedded-darwin-x64@1.105.2 + - sass-embedded-linux-arm64@1.105.2 + - sass-embedded-linux-arm@1.105.2 + - sass-embedded-linux-musl-arm64@1.105.2 + - sass-embedded-linux-musl-arm@1.105.2 + - sass-embedded-linux-musl-riscv64@1.105.2 + - sass-embedded-linux-musl-x64@1.105.2 + - sass-embedded-linux-riscv64@1.105.2 + - sass-embedded-linux-x64@1.105.2 + - sass-embedded-unknown-all@1.105.2 + - sass-embedded-win32-arm64@1.105.2 + - sass-embedded-win32-x64@1.105.2 + - sass-embedded@1.105.2 + - sass@1.105.2 + - temporal-polyfill@1.0.6 + - undici@8.12.2 + - vitepress-plugin-group-icons@1.8.1 + - wrangler@4.151.1 -- 2.54.0