From 81137bdd40e726f1e72ef17ab7fd2482afed1c25 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 11:14:59 +0200 Subject: [PATCH 01/15] chore: harden GH workflows Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 44 ++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..7439413c --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,44 @@ +# Analyzes all GitHub Actions workflows for security issues using zizmor. +# docs: https://docs.zizmor.sh/ +name: Zizmor + +on: + push: + branches: ['master', 'main'] + pull_request: + branches: ['**'] + workflow_dispatch: + schedule: + - cron: '0 0 * * 6' + +permissions: {} + +concurrency: + group: '${{ github.workflow }}-${{ github.ref }}' + cancel-in-progress: true + +jobs: + zizmor: + name: Zizmor + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Checkout + # see https://github.com/actions/checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Run zizmor 🌈 + # see https://github.com/zizmorcore/zizmor-action + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + # advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than + # uploading a SARIF report to GitHub's Security tab. + # Uploading SARIF requires `security-events: write` and GitHub Advanced Security (GHAS), + # both of which are unnecessary here and would violate the least-privilege policy. + # The two modes are mutually exclusive: advanced-security must be false for + # annotations to take effect. + advanced-security: false + annotations: true From 0a136b18eb820217728e0154e705503a3a38f64a Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 11:25:30 +0200 Subject: [PATCH 02/15] release Signed-off-by: Jan Kowalleck --- .github/workflows/release.yml | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7e1f30b7..088f9ef4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -159,14 +159,24 @@ jobs: name: ${{ env.PACKED_ARTIFACT }} path: ${{ env.ASSETS_DIR }} - name: Create Release - id: release - # see https://github.com/softprops/action-gh-release - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: ${{ needs.bump.outputs.version }} - name: ${{ needs.bump.outputs.version_plain }} - prerelease: ${{ github.event.inputs.prerelease }} - files: '${{ env.ASSETS_DIR }}/*' - target_commitish: ${{ github.head_ref || github.ref_name }} + TAG_NAME: ${{ needs.bump.outputs.version }} + RELEASE_NAME: ${{ needs.bump.outputs.version_plain }} + PRERELEASE: ${{ github.event.inputs.prerelease }} + TARGET_COMMITISH: ${{ github.head_ref || github.ref_name }} + shell: bash + run: | + set -euo pipefail + + # Optional flag + prerelease_flag="" + if [[ "${PRERELEASE}" == "true" ]]; then + prerelease_flag="--prerelease" + fi + + gh release create "${TAG_NAME}" \ + "${ASSETS_DIR}"/* \ + --title "${RELEASE_NAME}" \ + --target "${TARGET_COMMITISH}" \ + ${prerelease_flag} From a69bca647b2787649fc4fb8bf3c34878196d46b9 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 11:30:14 +0200 Subject: [PATCH 03/15] zizmor Signed-off-by: Jan Kowalleck --- .github/dependabot.yml | 4 ++++ .github/workflows/nodejs.yml | 12 +++++++++++- .github/workflows/release.yml | 3 +++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 29ba437b..1a3a5f52 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 allow: - dependency-type: 'all' versioning-strategy: 'auto' @@ -107,6 +109,8 @@ updates: schedule: interval: 'weekly' day: 'saturday' + cooldown: + default-days: 7 labels: [ 'dependencies' ] commit-message: prefix: 'chore' ## prefix maximum string length of 15 diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index 6b33162a..7ebd7c15 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -34,6 +34,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -60,6 +62,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -104,6 +108,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -149,6 +155,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js ${{ matrix.node-version }} # see https://github.com/actions/setup-node uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 @@ -178,7 +186,7 @@ jobs: working-directory: .. # prevent evaluation of package.json - name: install project shell: bash - run: | + run: | # zizmor: ignore[adhoc-packages] set -ex dev_requirements='c8 jest jest-junit imurmurhash fast-glob' npm i --ignore-scripts --omit=peer --omit=dev --only=prod --production --loglevel=silly @@ -238,6 +246,8 @@ jobs: - name: Checkout # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 088f9ef4..108474a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,6 +52,8 @@ jobs: - name: Checkout code # see https://github.com/actions/checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Configure Git # needed for push back of changes run: | @@ -99,6 +101,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: ref: ${{ needs.bump.outputs.version }} + persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 From 3417bf4e83ed8c1d6df7d6b8f5daac0a0476d748 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 11:38:23 +0200 Subject: [PATCH 04/15] docs Signed-off-by: Jan Kowalleck --- .github/workflows/nodejs.yml | 38 +++++++++++++++++------------------ .github/workflows/release.yml | 12 +++++------ 2 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index 7ebd7c15..4acf2f42 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -33,12 +33,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -48,7 +48,7 @@ jobs: run: npm run build-dev - name: artifact build result # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: dist path: dist @@ -61,12 +61,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -88,12 +88,12 @@ jobs: - name: Annotate Code if: ${{ failure() || success() }} # see https://github.com/DerLev/eslint-annotations - uses: DerLev/eslint-annotations@a79ea65c1b45a649c48bcc6efc0103b6fd2e4c5f # v2 + uses: DerLev/eslint-annotations@a79ea65c1b45a649c48bcc6efc0103b6fd2e4c5f # v2.1.0 with: eslint-report: ${{ env.REPORTS_DIR }}/eslint.json - name: artifact eslint result # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 if: ${{ failure() }} with: name: ${{ env.STANDARD_REPORTS_ARTIFACT }} @@ -107,12 +107,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -154,12 +154,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Node.js ${{ matrix.node-version }} # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ matrix.node-version }} package-manager-cache: false @@ -196,7 +196,7 @@ jobs: npm i --ignore-scripts --loglevel=silly --no-save $dev_requirements - name: fetch build artifact # see https://github.com/actions/download-artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: dist path: dist @@ -205,7 +205,7 @@ jobs: - name: artifact npm errors if: ${{ failure() }} # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: 'npm-errors_${{ matrix.os }}_node${{ matrix.node-version }}' path: '/home/runner/.npm/_logs/*.log' @@ -225,7 +225,7 @@ jobs: - name: artifact test reports if: ${{ ! cancelled() }} # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: '${{ env.TESTS_REPORTS_ARTIFACT }}_${{ matrix.os }}_node${{ matrix.node-version }}' path: ${{ env.REPORTS_DIR }} @@ -245,18 +245,18 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false - name: fetch build artifact # see https://github.com/actions/download-artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: dist path: dist @@ -276,7 +276,7 @@ jobs: steps: - name: fetch test artifacts # see https://github.com/actions/download-artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: '${{ env.TESTS_REPORTS_ARTIFACT }}_*' merge-multiple: true @@ -287,7 +287,7 @@ jobs: ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets if: ${{ env.CODACY_PROJECT_TOKEN != '' }} # see https://github.com/codacy/codacy-coverage-reporter-action - uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1 + uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1.3.0 with: project-token: ${{ env.CODACY_PROJECT_TOKEN }} coverage-reports: ${{ env.REPORTS_DIR }}/coverage/*/* diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 108474a8..8e0752b1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,7 +51,7 @@ jobs: steps: - name: Checkout code # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Configure Git @@ -62,7 +62,7 @@ jobs: git config --local user.name "${GITHUB_ACTOR}" - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -98,13 +98,13 @@ jobs: steps: - name: Checkout code # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ needs.bump.outputs.version }} persist-credentials: false - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -137,7 +137,7 @@ jobs: npm pack --pack-destination "$PACKED_DIR" - name: artifact release result # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: ${{ env.PACKED_ARTIFACT }} path: ${{ env.PACKED_DIR }}/ @@ -157,7 +157,7 @@ jobs: steps: - name: fetch release result # see https://github.com/actions/download-artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: ${{ env.PACKED_ARTIFACT }} path: ${{ env.ASSETS_DIR }} From 0a89f23e659bc0faacc41f144c70d5909d884a9c Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 11:42:13 +0200 Subject: [PATCH 05/15] zizmor Signed-off-by: Jan Kowalleck --- .github/workflows/zizmor.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 7439413c..220939f1 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -27,12 +27,12 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Run zizmor 🌈 # see https://github.com/zizmorcore/zizmor-action - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 with: # advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than # uploading a SARIF report to GitHub's Security tab. From d53d91e339d8a6daf8c2cbb26cf9cabaf433df18 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 11:43:31 +0200 Subject: [PATCH 06/15] zizmor Signed-off-by: Jan Kowalleck --- .github/workflows/nodejs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index 4acf2f42..c676abc9 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -186,7 +186,7 @@ jobs: working-directory: .. # prevent evaluation of package.json - name: install project shell: bash - run: | # zizmor: ignore[adhoc-packages] + run: | # zizmor: ignore[adhoc-packages] -- packages are already locked, but we dont want to alter manifest set -ex dev_requirements='c8 jest jest-junit imurmurhash fast-glob' npm i --ignore-scripts --omit=peer --omit=dev --only=prod --production --loglevel=silly From d4cca3579ba1ce48b5078b959f4445a905cc8626 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 11:52:05 +0200 Subject: [PATCH 07/15] fix Signed-off-by: Jan Kowalleck --- .github/workflows/release.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8e0752b1..93453a8e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -82,8 +82,18 @@ jobs: NPMV_NEWVERSION: ${{ github.event.inputs.newversion }} NPMV_MESSAGE: ${{ github.event.inputs.commitMessage }} NPMV_PREID: ${{ github.event.inputs.preid }} - - name: git push back - run: git push --follow-tags + - name: Push commit + annotated tags + shell: bash + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + set -euo pipefail + set +x + echo "::add-mask::$GITHUB_TOKEN" + AUTH_B64="$(printf "x-access-token:%s" "$GITHUB_TOKEN" | base64 | tr -d '\n')" + echo "::add-mask::$AUTH_B64" + git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $AUTH_B64" \ + push --follow-tags "https://github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}" publish-NPMJS: needs: @@ -163,7 +173,7 @@ jobs: path: ${{ env.ASSETS_DIR }} - name: Create Release env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG_NAME: ${{ needs.bump.outputs.version }} RELEASE_NAME: ${{ needs.bump.outputs.version_plain }} PRERELEASE: ${{ github.event.inputs.prerelease }} From f40420a5446617ecaaeefb3d29821c9dfb566c79 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 12:02:16 +0200 Subject: [PATCH 08/15] fix Signed-off-by: Jan Kowalleck --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 93453a8e..6b8b2faa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -93,7 +93,7 @@ jobs: AUTH_B64="$(printf "x-access-token:%s" "$GITHUB_TOKEN" | base64 | tr -d '\n')" echo "::add-mask::$AUTH_B64" git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $AUTH_B64" \ - push --follow-tags "https://github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}" + push --follow-tags "https://github.com/${GITHUB_REPOSITORY}.git" publish-NPMJS: needs: From d58d442c96bb997de97d66c4870824cf2a1042b2 Mon Sep 17 00:00:00 2001 From: jkowalleck Date: Tue, 28 Jul 2026 10:05:06 +0000 Subject: [PATCH 09/15] 5.3.3-rc.1 Signed-off-by: jkowalleck --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 7ed43609..59cd9216 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@cyclonedx/webpack-plugin", - "version": "5.3.3-rc.0", + "version": "5.3.3-rc.1", "description": "Creates CycloneDX Software Bill of Materials (SBoM) from webpack projects", "license": "Apache-2.0", "copyright": "Copyright OWASP Foundation", From f23bf00f713b222d8f680030715d86d3864a4111 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 12:11:16 +0200 Subject: [PATCH 10/15] fix Signed-off-by: Jan Kowalleck --- .github/workflows/release.yml | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6b8b2faa..478ed017 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -174,22 +174,22 @@ jobs: - name: Create Release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - TAG_NAME: ${{ needs.bump.outputs.version }} - RELEASE_NAME: ${{ needs.bump.outputs.version_plain }} + TAG: ${{ needs.bump.outputs.version }} + TITLE: ${{ needs.bump.outputs.version_plain }} + TARGET: ${{ github.head_ref || github.ref_name }} PRERELEASE: ${{ github.event.inputs.prerelease }} - TARGET_COMMITISH: ${{ github.head_ref || github.ref_name }} shell: bash run: | set -euo pipefail - - # Optional flag - prerelease_flag="" - if [[ "${PRERELEASE}" == "true" ]]; then - prerelease_flag="--prerelease" + args=( + "$TAG" + "${ASSETS_DIR}"/* + --repo "${GITHUB_REPOSITORY}" + --title "$TITLE" + --target "$TARGET" + --verify-tag + ) + if [ "$PRERELEASE" = "true" ]; then + args+=(--prerelease) fi - - gh release create "${TAG_NAME}" \ - "${ASSETS_DIR}"/* \ - --title "${RELEASE_NAME}" \ - --target "${TARGET_COMMITISH}" \ - ${prerelease_flag} + gh release create "${args[@]}" From a9b178a9ff80d2045a56a14c4d21e037c85c9d4a Mon Sep 17 00:00:00 2001 From: jkowalleck Date: Tue, 28 Jul 2026 10:15:49 +0000 Subject: [PATCH 11/15] 5.3.3-rc.2 Signed-off-by: jkowalleck --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 59cd9216..c0df418f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@cyclonedx/webpack-plugin", - "version": "5.3.3-rc.1", + "version": "5.3.3-rc.2", "description": "Creates CycloneDX Software Bill of Materials (SBoM) from webpack projects", "license": "Apache-2.0", "copyright": "Copyright OWASP Foundation", From 8b1c774ca5c46fd067e91544821c0c55339ccaeb Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 12:35:41 +0200 Subject: [PATCH 12/15] dings Signed-off-by: Jan Kowalleck --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 59cd9216..c0df418f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@cyclonedx/webpack-plugin", - "version": "5.3.3-rc.1", + "version": "5.3.3-rc.2", "description": "Creates CycloneDX Software Bill of Materials (SBoM) from webpack projects", "license": "Apache-2.0", "copyright": "Copyright OWASP Foundation", From c405cc9b693cacba8b3577d019942354f76391cc Mon Sep 17 00:00:00 2001 From: jkowalleck Date: Tue, 28 Jul 2026 10:43:24 +0000 Subject: [PATCH 13/15] 5.3.3-rc.3 Signed-off-by: jkowalleck --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index c0df418f..bfc375ea 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@cyclonedx/webpack-plugin", - "version": "5.3.3-rc.2", + "version": "5.3.3-rc.3", "description": "Creates CycloneDX Software Bill of Materials (SBoM) from webpack projects", "license": "Apache-2.0", "copyright": "Copyright OWASP Foundation", From f12371fbf3a3f02336fcf8035e1cf319f8acabe6 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 28 Jul 2026 12:49:48 +0200 Subject: [PATCH 14/15] dings Signed-off-by: Jan Kowalleck --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 478ed017..5c342004 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -93,7 +93,7 @@ jobs: AUTH_B64="$(printf "x-access-token:%s" "$GITHUB_TOKEN" | base64 | tr -d '\n')" echo "::add-mask::$AUTH_B64" git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $AUTH_B64" \ - push --follow-tags "https://github.com/${GITHUB_REPOSITORY}.git" + push --follow-tags "https://github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}" publish-NPMJS: needs: From 95db6171ae532352cc0e908fbe3d6707a73a9629 Mon Sep 17 00:00:00 2001 From: jkowalleck Date: Tue, 28 Jul 2026 10:51:10 +0000 Subject: [PATCH 15/15] 5.3.3-rc.4 Signed-off-by: jkowalleck --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index bfc375ea..b16eaf3f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@cyclonedx/webpack-plugin", - "version": "5.3.3-rc.3", + "version": "5.3.3-rc.4", "description": "Creates CycloneDX Software Bill of Materials (SBoM) from webpack projects", "license": "Apache-2.0", "copyright": "Copyright OWASP Foundation",