chore: migrate to package.json-based linting package management - #2576
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
|
Many thanks for your review! I think I've addressed the points you raised. In parallel I submitted #2577 to remove https://sourceware.org/ from link testing. It has been flakily failing during my tests, so I'd just want to ignore it for future |
|
I believe this is ready to merge, however I need an approval first. |
Move version definition of npm packages to package.json & package-lock.json: - doctoc - markdown-link-check - prettier Update linting workflows. Enable npm updating through Dependabot. Add scripts and documentation to aid local linting.
4e75067 to
d790558
Compare
nschonni
left a comment
nschonni
left a comment
There was a problem hiding this comment.
Nothing blocking, just a few comments that can be ignored. Should still probably wait till after the Security release before landing
The security release has been delayed once again. In the case of this PR I don't really see any risk. If they haven't managed to get the security release over the line this week, then I would merge anyway. |
|
The security release is requiring manual attention in any case, so I've gone ahead and merged this. |
2 participants
Description
Move version definition of npm packages to
package.json&package-lock.json:Use Node.js 24 (Active LTS).
Update linting workflows to run based on above package definitions:
workflow_dispatch:event triggers are added to make it easier to check linting issue before submitting a PR.Enable weekly npm updating through Dependabot.
Update CONTRIBUTING with prerequisites and linting instructions. Add Table of Contents.
Motivation and Context
The following workflows currently install npm dependencies on the fly. Code scanning alerts notes this as an issue.
latest)By moving the package version selection from GitHub Actions to npm
package.json&package-lock.jsonfiles, versions can be pinned exactly and maintained regularly by Dependabot.Setting Dependabot and npm minimum age to 5 days for updates, reduces the risk of fast supply-chain attacks:
Testing Details
Types of changes
Checklist