From b76ee8c2ef87a22d45b4d7f05a95cdd483c5429a Mon Sep 17 00:00:00 2001 From: Rasmus Viloma Date: Fri, 21 Aug 2026 16:52:47 +0300 Subject: [PATCH 1/2] ci: bump actions/checkout and actions/setup-node to v7 --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3c419f2..fdccb14 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: verify: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # Pinned to the packageManager version, not "latest". bun.lock was # resolved by this version, and a newer bun can dedupe transitive diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1164242..1088360 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: # distinguish, and approving costs one click. environment: npm-publish steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # Pinned to the packageManager version — see the note in ci.yml. - uses: oven-sh/setup-bun@v2 @@ -40,7 +40,7 @@ jobs: # configured — npm detects the OIDC environment and uses trusted # publishing instead. package-manager-cache is off because a restored npm # cache can shadow the CLI upgrade below. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: # Trusted publishing requires Node >= 22.14.0; "22" resolves to the # latest 22.x, which satisfies that floor. From ad8d9b2bbd3b9e9f1220052bafab007886508efa Mon Sep 17 00:00:00 2001 From: Rasmus Viloma Date: Fri, 21 Aug 2026 17:07:29 +0300 Subject: [PATCH 2/2] ci: stop checkout persisting credentials into .git/config --- .github/workflows/ci.yml | 2 ++ .github/workflows/release.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fdccb14..6b2b57e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,6 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false # Pinned to the packageManager version, not "latest". bun.lock was # resolved by this version, and a newer bun can dedupe transitive diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1088360..7adef08 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,6 +29,8 @@ jobs: environment: npm-publish steps: - uses: actions/checkout@v7 + with: + persist-credentials: false # Pinned to the packageManager version — see the note in ci.yml. - uses: oven-sh/setup-bun@v2