Skip to content

3月のパッケージアップデート #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ienaga merged 3 commits into from
Mar 1, 2026
Merged

3月のパッケージアップデート #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9870981
Bump ajv in the npm_and_yarn group across 1 directory
dependabot[bot] Feb 22, 2026
70bed8c
Merge pull request #62 from Next2D/dependabot/npm_and_yarn/npm_and_ya…
ienaga Mar 1, 2026
c231d1c
#63 update github actions, update packages
ienaga Mar 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,40 +3,38 @@ name: Lint
on:
push:
branches:
- main
- develop
pull_request:
branches:
- main
- develop
workflow_call:

jobs:
macos-browser-test:
runs-on: macos-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
- run: npm install -g npm@latest
- run: npm install
- run: npm ci
- run: npm run lint

windows-browser-test:
runs-on: windows-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
- run: npm install -g npm@latest
- run: npm install
- run: npm ci
- run: npm run lint
10 changes: 9 additions & 1 deletion .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,23 @@ permissions:
contents: read

jobs:
lint:
uses: ./.github/workflows/lint.yml

Comment on lines +13 to +15
Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow-level permissions grant id-token: write, and the new reusable-workflow job lint inherits that permission. If the lint workflow doesn’t need OIDC, set explicit job-level permissions for lint (e.g., contents: read) and move id-token: write to only the publish job to follow least-privilege.

Copilot uses AI. Check for mistakes.
publish:
needs: [lint]
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pull-requests: write is granted to the publish job, but none of the steps in this job appear to interact with PRs. Please drop this permission unless it’s required, to reduce the impact of a compromised workflow run.

Suggested change
pull-requests: write

Copilot uses AI. Check for mistakes.
id-token: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
- run: npm install -g npm@latest
- run: npm install
- run: npm ci
Comment on lines +13 to +30
Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR title indicates a package update, but this change also modifies CI/release workflows (adding a lint gate, changing install strategy, and updating permissions). Consider updating the PR title/description to reflect the workflow changes, or split workflow changes into a separate PR for clearer review and rollback.

Copilot uses AI. Check for mistakes.
- run: npm run release
- run: npm publish
Loading