chore(lint): prettier, eslint, markdownlint, cleanup

.github/workflows/codeql-analysis.yml

@@ -1,56 +1,46 @@
-name: "CodeQL"
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: 'CodeQL'
 
 on:
   push:
-    branches: [main]
+    branches: ['main']
   pull_request:
-    branches: [main]
+    branches: ['main']
   schedule:
-    - cron: "0 0 * * 4"
+    - cron: '30 1 * * 0' # Run at 1:30 AM UTC every Sunday
+  merge_group:
+
+permissions:
+  actions: read
+  contents: read
 
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
-      actions: read
-      contents: read
       security-events: write
 
     strategy:
       fail-fast: false
       matrix:
-        language: ["javascript"]
+        language: ['javascript'] # Add languages used in your actions
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+        uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
         with:
           languages: ${{ matrix.language }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+          queries: security-and-quality
 
-      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-      # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
-
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 https://git.io/JvXDl
-
-      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-      #    and modify them (or add more) to build your code if your project
-      #    uses a compiled language
-
-      #- run: |
-      #   make bootstrap
-      #   make release
+        uses: github/codeql-action/autobuild@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+        uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+        with:
+          category: '/language:${{matrix.language}}'

.github/workflows/pr.yml

@@ -40,13 +40,6 @@ jobs:
         run: yarn install
 
       - name: Yarn Lock Changes
-        # Please use `main` as version before the stable release will be published as `v1`.
-        uses: Simek/yarn-lock-changes@main
+        uses: Simek/yarn-lock-changes@34017425198654c20162a4dfd4f238fbece9636f # v0.12.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          # Optional inputs, can be deleted safely if you are happy with default values.
-          collapsibleThreshold: 25
-          failOnDowngrade: false
-          path: yarn.lock
-          updateComment: true
-          groupByType: false

.github/workflows/publish.yml

@@ -5,15 +5,28 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
+  Linter:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      statuses: write
+      contents: read
+      packages: read
+
+    steps:
+      - name: Run PR Lint
+        # https://github.com/ivuorinen/actions
+        uses: ivuorinen/actions/pr-lint@99f3911475dbb5b8d43d314b24c0882997433868 # 25.6.23
+
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    needs:
+      - Linter
 
     steps:
       - name: Checkout
@@ -25,9 +38,9 @@ jobs:
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           always-auth: true
-          node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-          scope: '@ivuorinen'
+          node-version-file: ".nvmrc"
+          registry-url: "https://registry.npmjs.org"
+          scope: "@ivuorinen"
 
       - name: Cache Node Modules
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
@@ -37,10 +50,13 @@ jobs:
           key: node-modules-${{ hashFiles('**/yarn.lock') }}
 
       - name: Install Dependencies
+        shell: bash
         if: steps.cache.outputs.cache-hit != 'true'
         run: yarn install
 
-      - name: Config Git User
-        run: |
-          git config --global user.name "fiximus"
-          git config --global user.email "189535814+fiximus@users.noreply.github.com"
+      - name: Release
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: yarn run semantic-release

.github/workflows/stale.yml

@@ -1,19 +1,26 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Stale
 
-# yamllint disable-line rule:truthy
 on:
   schedule:
-    - cron: "0 8 * * *"
+    - cron: '0 8 * * *' # Every day at 08:00
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: read
+  statuses: read
+
 jobs:
   stale:
+    name: 🧹 Clean up stale issues and PRs
     runs-on: ubuntu-latest
+
     permissions:
       contents: write # only for delete-branch option
       issues: write
       pull-requests: write
     steps:
-      - uses: ivuorinen/actions/stale@main
+      - uses: ivuorinen/actions/stale@99f3911475dbb5b8d43d314b24c0882997433868 # 25.6.23

.github/workflows/update-browserslist.yaml

@@ -1,47 +0,0 @@
----
-name: Update Browserslist database
-
-on:
-  schedule:
-    # At 02:00 on day-of-month 1 and 15.
-    - cron: '0 2 1,15 * *'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  update-browserslist-database:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js Environment
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          always-auth: true
-          node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-          scope: '@ivuorinen'
-
-      - name: Configure git
-        run: |
-          git config user.name "fiximus"
-          git config user.email "189535814+fiximus@users.noreply.github.com"
-
-      - name: Update Browserslist database and create PR if applies
-        uses: c2corg/browserslist-update-action@a76abb476199caea5399f9e28ff3f16e491ec566 # v2.5.0
-        with:
-          directory: ./packages/browserslist-config/
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ vars.BROWSERSLIST_UPDATE_BRANCH || 'browserslist-update' }}
-          base_branch: ${{ vars.DEFAULT_BRANCH || 'main' }}
-          commit_message: 'chore(deps): update browserslist database'
-          title: 'chore(deps): update browserslist database'
-          body: Auto-generated by [browserslist-update-action](https://github.com/c2corg/browserslist-update-action/)
-          labels: 'maintenance'
-          reviewers: 'ivuorinen'