This is an automated email from the ASF dual-hosted git repository.
erisu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cordova-coho.git
The following commit(s) were added to refs/heads/master by this push:
new 58e4bed chore: action workflow updates & add dependabot (#353)
58e4bed is described below
commit 58e4bed2bc60cade4e4a774b8581751e947dac87
Author: エリス <[email protected]>
AuthorDate: Thu Aug 27 17:54:29 2026 +0900
chore: action workflow updates & add dependabot (#353)
* chore(dependabot): add configurations
* chore(workflow): release-audit
* chore: rename .ratignore -> .rat-excludes
* chore: add missing license headers & fix rat excludes
* chore(workflow): update actions
* chore(workflow): update test job permissions & matrix
* chore(workflow): add codeql job
* chore(workflow): removed licence_checker.yml config
---
.gitattributes | 17 +++++++++++
.github/dependabot.yml | 52 +++++++++++++++++++++++++++++++++
.github/workflows/ci.yml | 54 ++++++++++++++++++++++++++---------
.github/workflows/nightly.yml | 7 +++--
.github/workflows/release-audit.yml | 57 +++++++++++++++++++++++++++++++++++++
.gitignore | 17 +++++++++++
.npmrc | 18 +++++++++++-
.rat-excludes | 19 +++++++++++++
.ratignore | 8 ------
docs/vote-checklist.md | 21 ++++++++++++++
10 files changed, 246 insertions(+), 24 deletions(-)
diff --git a/.gitattributes b/.gitattributes
index f63e59a..bf43cf8 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
* text eol=lf
# source code
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..609ac46
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,52 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+version: 2
+
+updates:
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ cooldown:
+ default-days: 5
+ schedule:
+ interval: "weekly" # Every Monday
+ groups:
+ gh-actions-patch-minor:
+ patterns:
+ - "*"
+ update-types:
+ - "patch"
+ - "minor"
+
+ - package-ecosystem: "npm"
+ directory: "/"
+ cooldown:
+ default-days: 5
+ semver-major-days: 14
+ schedule:
+ interval: "weekly" # Every Monday
+ groups:
+ npm-patch:
+ patterns:
+ - "*"
+ update-types:
+ - "patch"
+ npm-minor:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d68893..ef7ec9f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,31 +25,61 @@ on:
branches:
- '*'
-permissions:
- contents: read
- security-events: write
-
jobs:
+ codeql:
+ name: CodeQL Analysis
+
+ runs-on: ubuntu-latest
+
+ permissions:
+ contents: read
+ security-events: write
+
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
+ fetch-depth: 1
+
+ - uses:
github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+ with:
+ languages: javascript
+ queries: security-and-quality
+ config: |
+ paths-ignore:
+ - .nyc_output
+ - apache-rat-0.12
+ - coverage
+ - node_modules
+
+ - uses:
github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+
test:
name: NodeJS ${{ matrix.node-version }} on ${{ matrix.os }}
runs-on: ${{ matrix.os }}
+ permissions:
+ contents: read
+
strategy:
matrix:
- node-version: [20.x, 22.x, 24.x]
- os: [ubuntu-latest, windows-latest, macos-15]
+ node-version: [20.x, 22.x, 24.x, 26.x]
+ os: [ubuntu-latest, windows-latest, macos-26]
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
+ fetch-depth: 1
- name: Use Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v4
+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 #
v7.0.0
with:
node-version: ${{ matrix.node-version }}
- name: set up JDK
- uses: actions/setup-java@v4
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 #
v5.7.0
with:
distribution: 'temurin'
java-version: '17'
@@ -62,13 +92,11 @@ jobs:
- name: npm install and test
run: |
- npm i
- npm t
+ npm cit
env:
CI: true
- # v4.6.0
- - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
+ - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
# v7.0.0
if: success()
with:
name: ${{ runner.os }} node.js ${{ matrix.node-version }}
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index b67edff..d3cc0fb 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -44,9 +44,12 @@ jobs:
npm_config_loglevel: verbose
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
+ fetch-depth: 1
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 #
v7.0.0
with:
node-version: 22.x
registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/release-audit.yml
b/.github/workflows/release-audit.yml
new file mode 100644
index 0000000..f50edfc
--- /dev/null
+++ b/.github/workflows/release-audit.yml
@@ -0,0 +1,57 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Release Auditing
+
+on:
+ push:
+ branches-ignore:
+ - 'dependabot/**'
+ pull_request:
+ branches:
+ - '*'
+
+permissions:
+ contents: read
+
+jobs:
+ test:
+ name: Audit Licenses
+ runs-on: ubuntu-latest
+ steps:
+ # Checkout project
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
+ fetch-depth: 1
+
+ # Check license headers
+ - uses: erisu/apache-rat-action@30c94d10ed21e6f6fd5590dc5c158f58cae7a0dd
# v3.0.0
+
+ # Setup environment with node
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 #
v7.0.0
+ with:
+ node-version: 24
+
+ # Install node packages
+ - name: npm install packages
+ run: npm ci
+
+ # Check node package licenses
+ - uses:
erisu/license-checker-action@04511f4c052b5773f11e1c65b42cda88235c62ae # v2.1.0
+ with:
+ include-asf-category-a: true
diff --git a/.gitignore b/.gitignore
index ec46aed..f0f87a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
*.swp
.DS_Store
node_modules/
diff --git a/.npmrc b/.npmrc
index 24358ae..7cff323 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,2 +1,18 @@
-registry=https://registry.npmjs.org
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+registry=https://registry.npmjs.org
diff --git a/.rat-excludes b/.rat-excludes
new file mode 100644
index 0000000..d4a31cd
--- /dev/null
+++ b/.rat-excludes
@@ -0,0 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# yes, not .gitignore
+gitignore
diff --git a/.ratignore b/.ratignore
deleted file mode 100644
index 0239058..0000000
--- a/.ratignore
+++ /dev/null
@@ -1,8 +0,0 @@
-# yes, not .gitignore
-gitignore
-
-knownIssues.json
-validLicenses.json
-jasmine.json
-appveyor.yml
-apache-rat-0.12
diff --git a/docs/vote-checklist.md b/docs/vote-checklist.md
index a0dff85..0b9fad2 100644
--- a/docs/vote-checklist.md
+++ b/docs/vote-checklist.md
@@ -1,3 +1,24 @@
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+-->
+
# Checklist for relase voting
Here is a short checklist when voting for a release. Please follow the
[release voting guide](./release-voting.md) first.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
