chore(ci): overhaul

.github/actions/prepare/action.yml

@@ -6,14 +6,21 @@ inputs:
     description: 'Node.js version'
     required: false
     default: '24'
+  build:
+    description: 'Build the project'
+    required: false
+    default: 'true'
 
 runs:
   steps:
-    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
     - name: Install dependencies
-      uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1.12.1
-      with:
-        install-command: npm ci --foreground-scripts
+      run: npm ci
+      shell: bash
+    - if: ${{ inputs.build == 'true' }}
+      name: Build
+      run: npm run build
+      shell: bash
   using: composite

.github/actions/publish/action.yml

@@ -4,24 +4,25 @@ description: Publish to npm
 inputs:
   token:
     description: 'npm token'
-    required: true
+    required: false
+    default: ''
 
 runs:
   steps:
     # see https://github.com/google-github-actions/release-please-action#automating-publication-to-npm
     # see https://docs.npmjs.com/generating-provenance-statements
     - name: Checkout Repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Setup Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: 24.18.0
-        registry-url: https://registry.npmjs.org
-    - name: Install & Build
-      uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1.12.1
+        persist-credentials: false
+    - uses: ./.github/actions/prepare
     - name: Publish to npm
       env:
-        NODE_AUTH_TOKEN: ${{ inputs.token }}
-      run: npm publish --provenance --access public --registry https://registry.npmjs.org
+        INPUT_TOKEN: ${{ inputs.token }}
+      run: |
+        if [ -n "$INPUT_TOKEN" ]; then
+          export NODE_AUTH_TOKEN="${INPUT_TOKEN}"
+        fi
+        npm publish --provenance --access public --registry https://registry.npmjs.org
       shell: bash
   using: composite

.github/workflows/commitlint.yml

@@ -1,19 +1,29 @@
 name: Validate Commit Messages
+
 on: [pull_request]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   commitlint:
+    name: Run commitlint
     env:
       FORCE_COLOR: '1'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
+        with:
+          build: false
       - name: Run commitlint
-        uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
+        uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
         env:
           NODE_PATH: ${{ github.workspace }}/node_modules

.github/workflows/docs.yml

@@ -18,28 +18,21 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: 'pages'
   cancel-in-progress: false
 
 jobs:
   build:
+    name: Build Docs
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '24.18.0'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          persist-credentials: false
+      - uses: ./.github/actions/prepare
 
       - name: Setup Pages
         id: pages
@@ -54,6 +47,10 @@ jobs:
           path: ./docs
 
   deploy:
+    name: Deploy Docs
+    permissions:
+      pages: write
+      id-token: write
     needs: build
     runs-on: ubuntu-latest
     environment:

.github/workflows/lint.yml

@@ -1,3 +1,15 @@
+name: Lint
+
+on:
+  push:
+    paths-ignore:
+      - '.husky/**'
+      - '**/CHANGELOG.md'
+  pull_request:
+    paths-ignore:
+      - '.husky/**'
+      - '**/CHANGELOG.md'
+
 permissions:
   contents: read
 
@@ -7,14 +19,33 @@ concurrency:
 
 jobs:
   lint:
+    name: Run linters
     env:
       FORCE_COLOR: '1'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
-      - run: npm run lint
-
-name: Lint
-
-on: [push, pull_request]
+      - parallel:
+          - name: ESLint
+            run: npm run lint:eslint
+          - name: markdownlint
+            run: npm run lint:markdown
+          - name: cspell
+            run: npm run lint:spelling
+          - name: Type check
+            run: npm run lint:types
+          - name: Format check
+            run: npm run lint:prettier
+          - name: Knip
+            run: npm run lint:knip
+          - name: Engine check
+            run: npm run lint:engines
+          - name: Run zizmor
+            uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+            with:
+              persona: pedantic
+              advanced-security: 'false'
+              annotations: 'true'

.github/workflows/nodejs.yml

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
         with:
           node-version: ${{ matrix.node-version }}

.github/workflows/pr-assign-author.yml

@@ -1,14 +1,21 @@
 name: Auto-assign PR to author
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, reopened]
+    branches: [main]
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   assign-author:
+    name: Run toshimaru/auto-author-assign action
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: toshimaru/auto-author-assign@3e19bfc990cb1cf0589dce95e9f75289bb1e22de # v3.0.3
+      - uses: toshimaru/auto-author-assign@a78a94b219445cece8ccf0d45fec60af449f212a # v3.1.0

.github/workflows/pr-assign-labels.yml

@@ -4,13 +4,19 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
-permissions:
-  contents: read
-  pull-requests: write
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+permissions: {}
 
 jobs:
   assign-labels:
+    name: Assign labels from commits
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Assign labels based on conventional commits
         uses: mauroalderete/action-assign-labels@671a4ca2da0f900464c58b8b5540a1e07133e915 # v1.5.1

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: release-please
+name: Release
 
 concurrency:
   group: ${{ github.workflow }}
@@ -7,23 +7,23 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
-  id-token: write
+permissions: {}
 
 jobs:
   release-please:
     name: Release Please
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
     steps:
       - name: Create Release
+        if: ${{ github.event_name != 'workflow_dispatch' }}
         id: release
         uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
-      - if: ${{ steps.release.outputs.release_created }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - if: ${{ steps.release.outputs.release_created }}
+      - if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch'  }}
         uses: ./.github/actions/publish
-        with:
-          token: ${{ secrets.NPM_TOKEN }}

.github/zizmor.yml

@@ -0,0 +1,3 @@
+rules:
+  undocumented-permissions:
+    disable: true

cspell.json

@@ -87,7 +87,9 @@
     "flibbertigibbet",
     "kerploppus",
     "mauroalderete",
-    "bargs"
+    "bargs",
+    "zizmor",
+    "zizmorcore"
   ],
   "words": ["bupkis", "deoptimization"]
 }

examples/.github/workflows/benchmarks.yml

@@ -2,26 +2,35 @@
 name: Performance Benchmarks
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   benchmark:
+    name: Run Benchmarks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 18
 
       - run: npm ci
       - run: npm run build
 
-      - name: Run Benchmarks
+      - name: Run Modestbench
         run: |
           modestbench run \
             --reporters json,csv \
             --output ./benchmark-results
 
       - name: Upload Results
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: benchmark-results
           path: ./benchmark-results/