From 4f0d6fd79fa6e4ea1d421061c3f47a36cd45b5f1 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 15:20:38 +0100 Subject: [PATCH 1/6] chore: remove changesets leftovers Remove the changesets versioning workflow (changesets/action without a publish input, which only added a Release check to every commit on main), the generated .changeset/README.md and the root CHANGELOG.md stub. changeset publish stays the publish command. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .changeset/README.md | 8 ------- .github/workflows/version.yml | 45 ----------------------------------- CHANGELOG.md | 3 --- 3 files changed, 56 deletions(-) delete mode 100644 .changeset/README.md delete mode 100644 .github/workflows/version.yml delete mode 100644 CHANGELOG.md diff --git a/.changeset/README.md b/.changeset/README.md deleted file mode 100644 index e5b6d8d6..00000000 --- a/.changeset/README.md +++ /dev/null @@ -1,8 +0,0 @@ -# Changesets - -Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works -with multi-package repos, or single-package repos to help you version and publish your code. You can -find the full documentation for it [in our repository](https://github.com/changesets/changesets) - -We have a quick list of common questions to get you started engaging with this project in -[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md) diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml deleted file mode 100644 index e003108a..00000000 --- a/.github/workflows/version.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Versioning packages - -on: - push: - branches: - - main - -concurrency: ${{ github.workflow }}-${{ github.ref }} - -jobs: - release: - name: Release - runs-on: ubuntu-latest - steps: - - name: Checkout Repo - uses: actions/checkout@v3 - - - name: Setup Node.js 20.x - uses: actions/setup-node@v3 - with: - node-version: 20.x - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} - - - name: Install Dependencies - run: npm i - - - name: Unset Git Hooks - run: git config --unset core.hooksPath - - - name: Create Release Pull Request - uses: changesets/action@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index 5c79a3c3..00000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,3 +0,0 @@ -# Changelog - -All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines. From aab203e57f3b2bd262ea8dc1d650a7db0dbc7ea8 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 15:34:07 +0100 Subject: [PATCH 2/6] fix: add a .dockerignore for the docs image The builder stage of the docs image copies the whole build context. Send only what the build needs (allow list: workspaces, build scripts, root manifests), so that local .env* files and other local files never reach the image, and drop dependencies and build output within. Closes #463 Co-Authored-By: Claude Opus 5.5 --- .dockerignore | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 00000000..17e2b9a9 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,23 @@ +# Only send what the docs image build needs to the build context (allow +# list): the workspaces, the build scripts and the root manifests read by +# `turbo prune`. Everything else, such as `.env*` files with secrets, never +# reaches the image +* +!apps/ +!packages/ +!scripts/ +!package.json +!package-lock.json +!turbo.json + +# Exclude local files within the included paths: environment files (except +# examples), dependencies and build output (rebuilt in the image) +**/.env* +!**/.env.example +**/node_modules +**/.next +**/.turbo +**/.vercel +**/coverage +**/dist +**/out From cfeb90e369e3683ca86012a1cd05f888737039ba Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 15:35:11 +0100 Subject: [PATCH 3/6] ci: pin actions and fix caches Pin every action to a full commit SHA on its current major version (checkout v7, setup-node v7, cache v6, semantic PR title v6, ssh-agent v0.10, push action v1.3.0 instead of master), with Dependabot keeping the pins up to date. Replace the node_modules caches, whose key hashed a file that doesn't exist and which used ::set-output, by the npm cache of setup-node in CI; releases use no dependency cache. Drop the force-with-lease input of the push action, which doesn't exist (the input is force_with_lease) and so never had an effect. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 11 +++++++ .github/workflows/pr_evaluation.yml | 42 ++++++-------------------- .github/workflows/publish.yml | 47 +++++++++++++---------------- 3 files changed, 41 insertions(+), 59 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..7ffb1898 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + # Actions in the workflows are pinned to commit SHAs; this keeps the pins + # (and their version comments) up to date, in one grouped pull request + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + groups: + github-actions: + patterns: ["*"] diff --git a/.github/workflows/pr_evaluation.yml b/.github/workflows/pr_evaluation.yml index de5cef4c..2121f48c 100644 --- a/.github/workflows/pr_evaluation.yml +++ b/.github/workflows/pr_evaluation.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event.action != 'edited' || github.event.changes.title != null }} steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -46,7 +46,7 @@ jobs: runs-on: ubuntu-latest needs: semantic_pr steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: List files with merge conflict markers run: git --no-pager grep "<<<<<<<" ":(exclude).github/" || true - name: Fail or succeed job if any files with merge conflict markers have been checked in @@ -61,27 +61,15 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - name: Use Node.js 20.x - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} + cache: npm - name: Install dependencies run: npm install @@ -99,31 +87,19 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node-version }} - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} + cache: npm - name: Cache Playwright id: playwright-cache - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cache/ms-playwright diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d311d89f..53116636 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -13,27 +13,17 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - name: Use Node.js 20.x - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} + # No dependency cache in releases (cache poisoning); `package.json` + # sets `packageManager`, which would turn on npm caching by default + package-manager-cache: false - name: Install dependencies run: npm install @@ -47,12 +37,12 @@ jobs: # steps: # - name: Check out code - # uses: actions/checkout@v3 + # uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # with: # fetch-depth: 2 # - name: Use Node.js 20.x - # uses: actions/setup-node@v3 + # uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 # with: # node-version: 20.x @@ -62,7 +52,7 @@ jobs: # echo "::set-output name=version::$(node -v)" # - name: Get node_modules cache - # uses: actions/cache@v4 + # uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # id: node_modules # with: # path: | @@ -89,7 +79,7 @@ jobs: needs: - linters steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set env run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV - name: Remove 'v' from RELEASE_VERSION @@ -99,12 +89,12 @@ jobs: echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV shell: bash - name: Install SSH Client - uses: webfactory/ssh-agent@v0.7.0 + uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.DEPLOY_KEY }} - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main @@ -114,9 +104,12 @@ jobs: git config --global user.email "github-actions[bot]@users.noreply.github.com" - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x + # No dependency cache in releases (cache poisoning); `package.json` + # sets `packageManager`, which would turn on npm caching by default + package-manager-cache: false - name: Install dependencies run: npm ci @@ -183,9 +176,8 @@ jobs: git commit -m "bump: v$RELEASE_VERSION" - name: Push changes - uses: ad-m/github-push-action@master + uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0 with: - force-with-lease: true ssh: true branch: main @@ -195,7 +187,7 @@ jobs: needs: bump-monorepo steps: - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main @@ -210,9 +202,12 @@ jobs: shell: bash - name: Setup Node.js 20.x - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x + # No dependency cache in releases (cache poisoning); `package.json` + # sets `packageManager`, which would turn on npm caching by default + package-manager-cache: false - name: Login to npm run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc From 51263de249a3a671ee4d5ebda774779f1ee32ae5 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 16:15:46 +0100 Subject: [PATCH 4/6] ci: prefix Dependabot titles, tidy comments Give Dependabot pull requests a ci: prefix, so that their titles pass the PR title check. Keep the commented-out release tests job as it was and state the release cache comment once. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 3 +++ .github/workflows/publish.yml | 12 +++++------- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7ffb1898..44066b76 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,9 @@ updates: # (and their version comments) up to date, in one grouped pull request - package-ecosystem: github-actions directory: / + # Pull request titles must be Conventional Commits (PR title check) + commit-message: + prefix: ci schedule: interval: monthly groups: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 53116636..b695d5b6 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -37,12 +37,12 @@ jobs: # steps: # - name: Check out code - # uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # uses: actions/checkout@v3 # with: # fetch-depth: 2 # - name: Use Node.js 20.x - # uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + # uses: actions/setup-node@v3 # with: # node-version: 20.x @@ -52,7 +52,7 @@ jobs: # echo "::set-output name=version::$(node -v)" # - name: Get node_modules cache - # uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + # uses: actions/cache@v4 # id: node_modules # with: # path: | @@ -107,8 +107,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - # No dependency cache in releases (cache poisoning); `package.json` - # sets `packageManager`, which would turn on npm caching by default + # No dependency cache in releases, see above package-manager-cache: false - name: Install dependencies @@ -205,8 +204,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - # No dependency cache in releases (cache poisoning); `package.json` - # sets `packageManager`, which would turn on npm caching by default + # No dependency cache in releases, see above package-manager-cache: false - name: Login to npm From 78891fef9618ee99dc49bfe75bc8d232464a5875 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 16:56:02 +0100 Subject: [PATCH 5/6] ci: run tests on Ubuntu 24.04 ubuntu-latest now is Ubuntu 26.04, on which Playwright 1.56 can't install its browsers, so every test job fails (unrelated to the other changes). Pin the test job to ubuntu-24.04 until Playwright is upgraded. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr_evaluation.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr_evaluation.yml b/.github/workflows/pr_evaluation.yml index 2121f48c..ac026971 100644 --- a/.github/workflows/pr_evaluation.yml +++ b/.github/workflows/pr_evaluation.yml @@ -79,7 +79,9 @@ jobs: tests: name: Test checks - runs-on: ubuntu-latest + # Playwright 1.56 can't install its browsers on Ubuntu 26.04, which + # `ubuntu-latest` now is; move on when Playwright is upgraded + runs-on: ubuntu-24.04 needs: semantic_pr strategy: matrix: From b989ff05dc82097c4d36ada9bf0f37cba48ae7c6 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 17:27:03 +0100 Subject: [PATCH 6/6] build: move CI and Docker to Node.js 22 and 24 Node.js 18 and 20 are end of life. Test on 22 and 24, lint and release on 24 (npm 11, needed for trusted publishing), build the docs image on node:24-alpine and update the development prerequisites in the README. engines and packageManager stay as they are. Closes #466 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr_evaluation.yml | 6 +++--- .github/workflows/publish.yml | 10 +++++----- Dockerfile | 2 +- README.md | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/pr_evaluation.yml b/.github/workflows/pr_evaluation.yml index ac026971..58938361 100644 --- a/.github/workflows/pr_evaluation.yml +++ b/.github/workflows/pr_evaluation.yml @@ -65,10 +65,10 @@ jobs: with: fetch-depth: 2 - - name: Use Node.js 20.x + - name: Use Node.js 24.x uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: 20.x + node-version: 24.x cache: npm - name: Install dependencies @@ -85,7 +85,7 @@ jobs: needs: semantic_pr strategy: matrix: - node-version: [18.x, 20.x] + node-version: [22.x, 24.x] steps: - name: Check out code diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b695d5b6..0f745e89 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -17,10 +17,10 @@ jobs: with: fetch-depth: 2 - - name: Use Node.js 20.x + - name: Use Node.js 24.x uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: 20.x + node-version: 24.x # No dependency cache in releases (cache poisoning); `package.json` # sets `packageManager`, which would turn on npm caching by default package-manager-cache: false @@ -106,7 +106,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: 20.x + node-version: 24.x # No dependency cache in releases, see above package-manager-cache: false @@ -200,10 +200,10 @@ jobs: echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV shell: bash - - name: Setup Node.js 20.x + - name: Setup Node.js 24.x uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: 20.x + node-version: 24.x # No dependency cache in releases, see above package-manager-cache: false diff --git a/Dockerfile b/Dockerfile index f572bbe7..4f317859 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Use an official Node.js runtime as the base image -FROM node:20-alpine AS base +FROM node:24-alpine AS base FROM base AS builder RUN apk update diff --git a/README.md b/README.md index eca1028a..d7d658d9 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ For comprehensive guides, API references, and examples, visit our documentation: ### Prerequisites -- Node.js (v18 or higher) +- Node.js 22 or later (CI tests 22 and 24) - npm or yarn ### Development Setup