diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 3849263..8aff4e4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,12 +3,6 @@ name: Publish on: release: types: [released] - workflow_dispatch: - inputs: - version: - description: 'Version to use for this test run (no commit/push/tag/publish will actually happen)' - required: false - default: '0.0.0-test' jobs: build-and-test: @@ -60,11 +54,9 @@ jobs: - name: Bump version and add changelog env: - INITIAL_TAG: ${{ github.event.release.tag_name || inputs.version }} - # TEMPORARY DRY-RUN OVERRIDE - forces test mode even for real releases. - # Original: ${{ github.event_name == 'workflow_dispatch' }} - # Revert this commit before running a real release. - IS_TEST_RUN: 'true' + # Passed via env, never interpolated into the script: a git tag name may legally contain + # ; $ ` & | ( ), so inlining it in the script would let a crafted release tag run commands. + INITIAL_TAG: ${{ github.event.release.tag_name }} run: | tag="${INITIAL_TAG//[v]/}" echo "$tag" @@ -77,15 +69,9 @@ jobs: auto-changelog git add . git commit -m "dump new version $tag" - if [ "$IS_TEST_RUN" = "true" ]; then - echo "Test run: skipping git push" - else - git push - fi + git push - name: Move tag - # TEMPORARY DRY-RUN OVERRIDE - original: github.event_name == 'release' - if: false env: TAG_NAME: ${{ github.event.release.tag_name }} run: | @@ -304,23 +290,12 @@ jobs: run: yarn build - name: Publish package - env: - # TEMPORARY DRY-RUN OVERRIDE - original: ${{ github.event_name == 'workflow_dispatch' }} - IS_TEST_RUN: 'true' - run: | - if [ "$IS_TEST_RUN" = "true" ]; then - npx --yes npm@^11 publish --access public --dry-run - else - npx --yes npm@^11 publish --access public - fi + run: npx --yes npm@^11 publish --access public # No NODE_AUTH_TOKEN needed - OIDC handles authentication upload-release-assets: needs: [pack-tarballs, pack-macos, pack-deb, pack-windows] - # TEMPORARY DRY-RUN OVERRIDE - original: github.event_name == 'release' - # Skipping this also skips update-homebrew, which depends on it. - if: false runs-on: ubuntu-latest permissions: contents: write diff --git a/yarn.lock b/yarn.lock index 1bdf6c3..384b4d0 100644 --- a/yarn.lock +++ b/yarn.lock @@ -14,9 +14,9 @@ tslib "^2.6.2" "@aws-sdk/client-cloudfront@^3.1079.0": - version "3.1084.0" - resolved "https://registry.npmjs.org/@aws-sdk/client-cloudfront/-/client-cloudfront-3.1084.0.tgz#2827ce636a2b0294792afb59601667b1b0fb71d0" - integrity sha512-hNfxs7xVQm1XHzwiifrHYhfd0ZLUT46CRHM14G1g1q/eZcv0bgU7HrD5QUFoDJj2qAMJ5SIeAtOtTmZ0D90ivA== + version "3.1085.0" + resolved "https://registry.npmjs.org/@aws-sdk/client-cloudfront/-/client-cloudfront-3.1085.0.tgz#8fb4174963ff1f7858fb087a8bad0923d55ec985" + integrity sha512-fIGLTXHGFFrlhACzwKjPI/fCPzugTyblU1LV7B0n0BK/1+4udVMdE1OofEbKNlKuy8f1CyeOUaIRmEjcS3bTaA== dependencies: "@aws-sdk/core" "^3.975.1" "@aws-sdk/credential-provider-node" "^3.972.66" @@ -28,9 +28,9 @@ tslib "^2.6.2" "@aws-sdk/client-s3@^3.1079.0": - version "3.1084.0" - resolved "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1084.0.tgz#c0665e0b8d8ec53b68261c32df313c9e1ec97ce9" - integrity sha512-W8KZlbU3vL4N0rZnXqryH5Ft3fkBnGypaorZmFxBoZRMGkwtvRBGiSnNXu1/1a/j/qZNwwt6LLNBWQQysB/pRg== + version "3.1085.0" + resolved "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1085.0.tgz#3c96126af344af9398d620e5334b40fb9a181505" + integrity sha512-O0xe8sR50AYkwxlvRRsV0qytEO2dtXQTQ1CF3YBBdE5xtVkbu27H0vGa1mjQi1/+fbYM80AWEIPai5jZmXyubw== dependencies: "@aws-sdk/checksums" "^3.1000.16" "@aws-sdk/core" "^3.975.1" @@ -1240,54 +1240,54 @@ dependencies: "@sinonjs/commons" "^3.0.0" -"@smithy/core@^3.29.2": - version "3.29.2" - resolved "https://registry.npmjs.org/@smithy/core/-/core-3.29.2.tgz#8bc4fde0c6c2670b940fb47f6ee6d67006c7e55e" - integrity sha512-DXUk6yU0C1Q1tYvJh1VCtl8QOBcSoZpKwjTPkxT6A4MUQYHvgeKGByL8mrEdxnvhdf9nq5GyzmRb5n/vPgu3Lw== +"@smithy/core@^3.29.2", "@smithy/core@^3.29.3": + version "3.29.3" + resolved "https://registry.npmjs.org/@smithy/core/-/core-3.29.3.tgz#d255cc12f19d612872f5255b7f415f6cb96ec30f" + integrity sha512-L+Ys6ecjk5vwPMAKHBpPKlJ3DkqwNcnfEISXBZIsVvWG/XKXfsAP8mwIYlTeLcd2ElHdesPI8OuOmJSFAPhm6A== dependencies: - "@smithy/types" "^4.16.0" + "@smithy/types" "^4.16.1" tslib "^2.6.2" "@smithy/credential-provider-imds@^4.4.7": - version "4.4.7" - resolved "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.4.7.tgz#e83c7bc5e9ad905f8b4d254ae147805b159544ea" - integrity sha512-UEMLOoA0Fl4uYBxh6l0uN0H6EJe/A89OGeDNTteQeXpJ20BcpfIr4wlCY9pel1jEAUHAxaYwuqrYlrKdXE1GKQ== + version "4.4.8" + resolved "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.4.8.tgz#e44c654f18498a5154b169a7ca1065d37fe01216" + integrity sha512-q9J7JTiXrAhB8sDp4px97uEPT7CwKH61Co78grdNQvU8QZAdiuaSRhP0tUVf2ogy36RZTrlMU1rBmDEH+cnkiA== dependencies: - "@smithy/core" "^3.29.2" - "@smithy/types" "^4.16.0" + "@smithy/core" "^3.29.3" + "@smithy/types" "^4.16.1" tslib "^2.6.2" "@smithy/fetch-http-handler@^5.6.4": - version "5.6.4" - resolved "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.6.4.tgz#272de150e23dfdb88d6d5c4f5960bd288ab657b1" - integrity sha512-psnst7NZWdAEvJvyW8YZEE7xNVMyLrQFfHtyrVFrxNyy+dKWkQ+rqC6oI5ZhxThpUy9RSfEshgm34zqbOxzsRw== + version "5.6.5" + resolved "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.6.5.tgz#b3a5b574c265384fdd77f4e9fa61cb7f035d3fe9" + integrity sha512-SuqeisTyPoiIPtIYru/sGxGyXzmZ+8nnFOhC+qRPglt06Ebd1yH//CDltZB2J/3WBNVhwfUaZ0EtHB3cm2X32g== dependencies: - "@smithy/core" "^3.29.2" - "@smithy/types" "^4.16.0" + "@smithy/core" "^3.29.3" + "@smithy/types" "^4.16.1" tslib "^2.6.2" "@smithy/node-http-handler@^4.9.4": - version "4.9.4" - resolved "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.9.4.tgz#5b80455ac7ab50f6c9f8c6bac8324e468c95ff84" - integrity sha512-BNTop/fSOptmoVk8g+efwHCofFh37g70OWGAFES1TeAAJja1K5aAI8rTE26ETSc5k8IQuWY2kAIoPla01NgYrA== + version "4.9.5" + resolved "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.9.5.tgz#7c8af721b0b16ffd4f4b51d7a1da34042810891c" + integrity sha512-bNqdxTQTxmLbomSmlkZFz8L6B/feQ2HHzw4L2zY7Ecp2XffYAZq2uzdWDdxJHJFbEvqd+SRuluJso0P8+xPdbw== dependencies: - "@smithy/core" "^3.29.2" - "@smithy/types" "^4.16.0" + "@smithy/core" "^3.29.3" + "@smithy/types" "^4.16.1" tslib "^2.6.2" "@smithy/signature-v4@^5.6.3": - version "5.6.3" - resolved "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.6.3.tgz#02cb9e57f36b3ac8597a84f1a152ec957aafc311" - integrity sha512-8qVKKzqh7naF27ePmx0SkUfnGP/wBI9dyaeAmhHvopnbIlItUAmB/e6PkPCU3rRb2v9BY8D4EZXSoydSibatvw== + version "5.6.4" + resolved "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.6.4.tgz#7b7372234609735972a98d4e820332da3e55309f" + integrity sha512-B89bpf2t/y/wia6LZ+4JfHXYQT9PnVftsH05rgJKKIStS7r/4XSs9HOjtPoLtgcA6HCW9jVqX5DBbq7E0PAkiQ== dependencies: - "@smithy/core" "^3.29.2" - "@smithy/types" "^4.16.0" + "@smithy/core" "^3.29.3" + "@smithy/types" "^4.16.1" tslib "^2.6.2" -"@smithy/types@^4.16.0": - version "4.16.0" - resolved "https://registry.npmjs.org/@smithy/types/-/types-4.16.0.tgz#17ad6fe399d25593e29a351b6a9ad25612fa6b45" - integrity sha512-aVUabzlBBmY0PfvVgLKQSOGFIL5/7R54JE3uD9a5Ay/jSED61SkuAcCYENNXJzYUvJ1NPrWO0P+rAXHCkbBUKw== +"@smithy/types@^4.16.0", "@smithy/types@^4.16.1": + version "4.16.1" + resolved "https://registry.npmjs.org/@smithy/types/-/types-4.16.1.tgz#19e199c234829a51c085caf63f0bb17bb80187e4" + integrity sha512-0JFs3V2y2M9tKW5na/qxe69Zv+uxLMO7QBbhxF/FHu/Gp2NFZAAL9tWl9PU02xxo07pb3G9FTyjNc6D5uZrJIg== dependencies: tslib "^2.6.2" @@ -1590,9 +1590,9 @@ balanced-match@^4.0.2: integrity sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA== baseline-browser-mapping@^2.10.42: - version "2.10.42" - resolved "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz#195dcc76baa269a497f0b07decace169fee9ac58" - integrity sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q== + version "2.10.43" + resolved "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.43.tgz#7b5d11590ce5acdbe4859443e3c940e81ce8c02d" + integrity sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ== bowser@^2.11.0: version "2.14.1" @@ -1629,14 +1629,14 @@ braces@^3.0.3: fill-range "^7.1.1" browserslist@^4.24.0: - version "4.28.5" - resolved "https://registry.npmjs.org/browserslist/-/browserslist-4.28.5.tgz#438b7d38c0d4b47740bbb36778d5bdca01b37838" - integrity sha512-Cu2E6QejHWzuDMTkuwgpABFgDfZrXLQq5V13YOACZx4mFAG4IwGTbTfHPMr4WtxlHoXSM8FIuRwYYCz5XiabaQ== + version "4.28.6" + resolved "https://registry.npmjs.org/browserslist/-/browserslist-4.28.6.tgz#7cf83afcd69c55fde6fb2dcc5039ff0f4ba42610" + integrity sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw== dependencies: baseline-browser-mapping "^2.10.42" - caniuse-lite "^1.0.30001800" - electron-to-chromium "^1.5.387" - node-releases "^2.0.50" + caniuse-lite "^1.0.30001803" + electron-to-chromium "^1.5.389" + node-releases "^2.0.51" update-browserslist-db "^1.2.3" bs-logger@^0.2.6: @@ -1699,10 +1699,10 @@ camelcase@^6.2.0: resolved "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz#5685b95eb209ac9c0c177467778c9c84df58ba9a" integrity sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA== -caniuse-lite@^1.0.30001800: - version "1.0.30001803" - resolved "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001803.tgz#b2a5d696e042bc8304dcd4942c39fe330fbbcb24" - integrity sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg== +caniuse-lite@^1.0.30001803: + version "1.0.30001805" + resolved "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001805.tgz#78d5d5968a69b7ff81af87a96d7ddc7ea6670b1e" + integrity sha512-52noaS3DubycKSXaU30TwPGIp+POyQSUVa5jBEq3vkRkY0kjyb3LQgvhU6WGyCcyXqVLWO0Cw0Q6BSdD0kUfVA== capital-case@^1.0.4: version "1.0.4" @@ -1930,7 +1930,7 @@ ejs@^3.1.10: dependencies: jake "^10.8.5" -electron-to-chromium@^1.5.387: +electron-to-chromium@^1.5.389: version "1.5.389" resolved "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.389.tgz#538be9ebec78026d4daba6be321ab854dfac2a8f" integrity sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg== @@ -3042,7 +3042,7 @@ node-int64@^0.4.0: resolved "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz#87a9065cdb355d3182d8f94ce11188b825c68a3b" integrity sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw== -node-releases@^2.0.50: +node-releases@^2.0.51: version "2.0.51" resolved "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz#cdc08433577f5b32ad01694481726e22eeb54aef" integrity sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==