Sveltekit 3

.github/workflows/build.yml

@@ -12,39 +12,42 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - name: Install Node.js
-        uses: actions/setup-node@v4
+          persist-credentials: false
+      - name: Install pnpm
+        uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3
         with:
-          node-version: 20
+          version: ^12.15.0
+          runtime: node@lts
+          install: false
       - name: Get version
         id: get_version
         run: echo "version=$(grep "version" Cargo.toml | head -n1 | cut -d '"' -f2)" >> $GITHUB_OUTPUT
       - name: Compare version to NPM
         run: |
           NPM_VERSION=$(npm view create-o7-app version)
-          MY_VERSION=${{ steps.get_version.outputs.version }}
+          MY_VERSION=${VERSION}
           if [ "$NPM_VERSION" == "$MY_VERSION" ]; then
             echo "NPM version is the same as the version in Cargo.toml, exiting"
             exit 1
           fi
-      - name: Install pnpm
-        run: npm i -g pnpm
+        env:
+          VERSION: ${{ steps.get_version.outputs.version }}
 
       - name: Generate changelogs
         run: |
           # Full changelog
-          pnpx git-cliff --tag ${{ steps.get_version.outputs.version }} -o CHANGELOG.md
+          pnpx git-cliff --tag ${VERSION} -o CHANGELOG.md
           # Changelog for the release
-          pnpx git-cliff --tag ${{ steps.get_version.outputs.version }} --unreleased --strip header -o CHANGELOG-release.md
+          pnpx git-cliff --tag ${VERSION} --unreleased --strip header -o CHANGELOG-release.md
+        env:
+          VERSION: ${{ steps.get_version.outputs.version }}
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
-          targets: x86_64-unknown-linux-musl,x86_64-pc-windows-gnu,i686-pc-windows-gnu,x86_64-apple-darwin,aarch64-apple-darwin
+        run: |
+          rustup toolchain install stable --component rustfmt --target x86_64-unknown-linux-musl --target x86_64-pc-windows-gnu --target i686-pc-windows-gnu --target x86_64-apple-darwin --target aarch64-apple-darwin
       # - name: Test
       #   run: cargo test
       - name: Install MinGW
@@ -57,7 +60,7 @@ jobs:
 
       - name: Restore cached OSXCross
         id: restore-osxcross
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: ${{ runner.os }}-osxcross-11.3
           path: osxcross
@@ -72,7 +75,7 @@ jobs:
           UNATTENDED=yes OSX_VERSION_MIN=10.7 ./build.sh
       - name: Cache OSXCross
         if: always() && steps.restore-osxcross.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: ${{ runner.os }}-osxcross-11.3
           path: osxcross
@@ -102,25 +105,28 @@ jobs:
           mkdir -p compressed/artifacts
           for file in artifacts/*; do tar -czvf "compressed/$file.tar.gz" "$file"; done
 
-      - name: Commit changelog
+      - name: Commit Changelog
         run: |
           git add CHANGELOG.md
           git config --local user.email "create-o7-app@users.noreply.github.com"
           git config --local user.name "create-o7-app[bot]"
-          git commit -m "ci: Update changelog for ${{ steps.get_version.outputs.version }}"
+          git commit -m "ci: Update changelog for ${VERSION}"
           git push
+        env:
+          VERSION: ${{ steps.get_version.outputs.version }}
 
       - name: Release Binaries
-        uses: softprops/action-gh-release@v2
-        with:
-          body_path: CHANGELOG-release.md
-          tag_name: ${{ steps.get_version.outputs.version }}
-          files: compressed/artifacts/*
+        run: gh release create ${VERSION} compressed/artifacts/* --notes-file CHANGELOG-release.md
+        env:
+          VERSION: ${{ steps.get_version.outputs.version }}
+
       - name: Publish NPM Package
         run: |
           cd pkg
           cp ../README.md .
-          jq '.version = "${{ steps.get_version.outputs.version }}"' package.json > tmp && mv tmp package.json
+          jq '.version = "${VERSION}"' package.json > tmp && mv tmp package.json
           npm config set //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
           echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
           npm publish
+        env:
+          VERSION: ${{ steps.get_version.outputs.version }}

.github/workflows/test.yml

@@ -4,12 +4,14 @@ on:
 
 jobs:
   create-shards:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    permissions: {}
     outputs:
       shards: ${{ steps.shards.outputs.shards }}
       shard-count: ${{ steps.shards.outputs.count }}
     steps:
-      - id: shards
+      - name: Generate shards
+        id: shards
         run: |
           shard_count=6
 
@@ -20,18 +22,22 @@ jobs:
   test:
     runs-on: ubuntu-latest
     needs: create-shards
+    permissions: {}
     strategy:
       fail-fast: false
       matrix:
         shard: ${{ fromJson(needs.create-shards.outputs.shards) }}
         shard-count: ${{ fromJson(needs.create-shards.outputs.shard-count) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: actions/cache@v4
+      - name: Restore Cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        id: cache-cargo
         with:
-          save-always: true
           path: |
             ~/.cargo/bin/
             ~/.cargo/registry/index/
@@ -41,18 +47,32 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
+        run: |
+          rustup toolchain install stable --component rustfmt
 
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
       - name: Install pnpm
-        run: npm i -g pnpm
+        uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3
+        with:
+          version: ^12.15.0
+          runtime: node@lts
+          install: false
+
       - name: Test
         run: cargo test
         env:
           SHARD: ${{ matrix.shard }}
           SHARD_COUNT: ${{ matrix.shard-count }}
+
+      - name: Save Cache
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        if: always() && steps.cache-cargo.outputs.cache-hit != 'true'
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ steps.cache-cargo.outputs.cache-primary-key }}
+
+

.github/workflows/update-deps.yml

@@ -7,10 +7,11 @@ on:
 jobs:
   update:
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Detect open PR
         id: detect_open_pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           result-encoding: string
           script: |
@@ -30,43 +31,49 @@ jobs:
 
             return pullRequests[0]?.head?.ref ?? 'main';
 
-      - id: create_token
-        uses: tibdex/github-app-token@v2
+      - name: Create token
+        id: create_token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         with:
-          app_id: ${{ secrets.APP_ID }}
-          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+          client-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ steps.create_token.outputs.token }}
           ref: ${{ steps.detect_open_pr.outputs.result }}
+          persist-credentials: false
 
-      - name: Install Node.js
-        uses: actions/setup-node@v4
+      - name: Install pnpm
+        uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3
         with:
-          node-version: 20
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
+          version: ^12.15.0
+          runtime: node@lts
+          install: false
+
+
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
+        run: |
+          rustup toolchain install stable --component rustfmt
 
       - name: Do updates
         run: |
           {
             echo 'PR_BODY<<EOF'
-            bun ./.github/workflows/update_deps.mjs ${{ steps.detect_open_pr.outputs.result }}
+            node ./.github/workflows/update_deps.mjs ${PR_BRANCH_NAME}
             echo EOF
           } >> $GITHUB_ENV
+        env:
+          PR_BRANCH_NAME: ${{ steps.detect_open_pr.outputs.result }}
 
       - name: Cargo update
         run: cargo update
 
       - name: Open PR
         if: steps.detect_open_pr.outputs.result == 'main'
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.create_token.outputs.token }}
           commit-message: 'ci: Update dependencies'
@@ -87,11 +94,13 @@ jobs:
           git config --local user.name "create-o7-app[bot]"
           git commit -m "ci: Update dependencies"
 
-          git push origin ${{ steps.detect_open_pr.outputs.result }}
+          git push origin ${PR_BRANCH_NAME}
+        env:
+          PR_BRANCH_NAME: ${{ steps.detect_open_pr.outputs.result }}
 
       - name: Comment on PR
         if: steps.detect_open_pr.outputs.result != 'main'
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.create_token.outputs.token }}
           script: |