CVE dependencies and github actions

.github/dependabot.yml

@@ -0,0 +1,21 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"
+    cooldown:
+      default-days: 7
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"      
+    commit-message:
+      prefix: fix
+      prefix-development: chore
+      include: scope

.github/workflows/_publish.yml_disable

@@ -0,0 +1,28 @@
+# disabling until we get 2FA working in github
+name: publish
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  tests:
+    uses: ./.github/workflows/tests.yml
+  publish-npm:
+    needs: [tests]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Publish to npm
+        run: | # npm 11.15.1 for OIDC support
+          npm install -g npm@11
+          npm ci
+          npm publish

.github/workflows/commitlint.yml

@@ -0,0 +1,40 @@
+name: commitlint
+
+on:
+  workflow_call:
+  push:
+  pull_request:
+    branches: ["master"]
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - name: Install required dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y sudo
+          sudo apt install -y git curl
+
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
+        with:
+          node-version: 20
+      - name: node setup
+        run: npm i
+      - name: Print versions
+        run: |
+          git --version
+          node --version
+          npm --version
+          npx commitlint --version
+
+      - name: Validate current commit (last commit) with commitlint
+        if: github.event_name == 'push'
+        run: npx commitlint --last --verbose
+
+      - name: Validate PR commits with commitlint
+        if: github.event_name == 'pull_request'
+        run: npx commitlint --from ${{ github.event.pull_request.head.sha }}~${{ github.event.pull_request.commits }} --to ${{ github.event.pull_request.head.sha }} --verbose

.github/workflows/release.yml

@@ -0,0 +1,37 @@
+name: release
+
+on:
+  push:
+    branches: ["master"]
+    tags-ignore: ['**']
+
+jobs:
+  tests:
+    uses: ./.github/workflows/tests.yml
+  tag-release:
+    runs-on: ubuntu-latest
+    needs: [tests]
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with: # important, must be defined on checkout to kick publish (defining in setup/node doesn't work)
+          token: ${{ secrets.GH_TOKEN }}
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
+        with:
+          node-version: '20.x'
+          cache: "npm"
+
+      - name: tag release
+        run: |
+          # ignore if commit message is chore(release): ...
+          if [[ $(git log -1 --pretty=%B) =~ ^chore\(release\):.* ]]; then
+            echo "Commit message starts with 'chore(release):', skipping release"
+            exit 0
+          fi
+          git config --local user.email "creadbot@github.com"
+          git config --local user.name "creadbot_github"
+          set -v
+          npm ci
+          npx commit-and-tag-version
+          git push
+          git push --tags

.github/workflows/tests.yml

@@ -0,0 +1,24 @@
+name: tests
+
+on:
+  workflow_call:
+  pull_request:
+    branches: ["master"]
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        node-version: ['20.x', '22.x', '24.x']
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: "npm"
+      - run: npm ci
+      - run: npm run lint
+      - run: npm audit --omit dev
+      - run: npm test

.gitignore

@@ -34,3 +34,5 @@ node_modules
 test/fixtures/tmp
 test/fixtures/out
 .nyc_output
+
+# package-lock.json # OIDC

commitlint.config.js

@@ -0,0 +1,6 @@
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'body-max-line-length': [2, 'always', 200],
+  },
+};

eslint.config.js

@@ -0,0 +1,10 @@
+const gulpConfig = require('eslint-config-gulp');
+
+module.exports = [
+  {
+    files: ["test/fixtures/*.js"],
+    rules: {
+      "no-unused-vars": "off",
+    },
+  },
+];