You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by er...@apache.org on 2026/08/26 17:10:06 UTC
(cordova-cli) branch master updated: chore: action workflow updates & add dependabot (#710)
This is an automated email from the ASF dual-hosted git repository.
erisu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cordova-cli.git
The following commit(s) were added to refs/heads/master by this push:
new 687f49d chore: action workflow updates & add dependabot (#710)
687f49d is described below
commit 687f49df34f3aebba8bc1d0c4a6fb8e3957a1abf
Author: エリス <er...@users.noreply.github.com>
AuthorDate: Thu Aug 27 02:10:01 2026 +0900
chore: action workflow updates & add dependabot (#710)
* chore(dependabot): add configurations
* chore(workflow): release-audit
* chore: rename .ratignore -> .rat-excludes
* chore(workflow): update actions & split out codeql job
* chore(workflow): update test matrix
---
.ratignore => .github/dependabot.yml | 39 ++++++++++++++++++++---
.github/workflows/ci.yml | 60 +++++++++++++++++++++++-------------
.github/workflows/release-audit.yml | 15 +++++----
.ratignore => .rat-excludes | 0
4 files changed, 83 insertions(+), 31 deletions(-)
diff --git a/.ratignore b/.github/dependabot.yml
similarity index 53%
copy from .ratignore
copy to .github/dependabot.yml
index 0de58dd..609ac46 100644
--- a/.ratignore
+++ b/.github/dependabot.yml
@@ -15,7 +15,38 @@
# specific language governing permissions and limitations
# under the License.
-.git/
-doc/*.txt
-coverage/
-node_modules/
+version: 2
+
+updates:
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ cooldown:
+ default-days: 5
+ schedule:
+ interval: "weekly" # Every Monday
+ groups:
+ gh-actions-patch-minor:
+ patterns:
+ - "*"
+ update-types:
+ - "patch"
+ - "minor"
+
+ - package-ecosystem: "npm"
+ directory: "/"
+ cooldown:
+ default-days: 5
+ semver-major-days: 14
+ schedule:
+ interval: "weekly" # Every Monday
+ groups:
+ npm-patch:
+ patterns:
+ - "*"
+ update-types:
+ - "patch"
+ npm-minor:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1dc63f3..182304e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,24 +25,54 @@ on:
branches:
- '*'
-permissions:
- contents: read
- security-events: write
-
jobs:
+ codeql:
+ name: CodeQL Analysis
+
+ runs-on: ubuntu-latest
+
+ permissions:
+ contents: read
+ security-events: write
+
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ fetch-depth: 1
+
+ - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+ with:
+ languages: javascript
+ queries: security-and-quality
+ config: |
+ paths-ignore:
+ - coverage
+ - node_modules
+
+ - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+
test:
name: NodeJS ${{ matrix.node-version }} on ${{ matrix.os }}
+
runs-on: ${{ matrix.os }}
+
+ permissions:
+ contents: read
+
strategy:
matrix:
- node-version: [20.x, 22.x, 24.x]
- os: [ubuntu-latest, windows-latest, macos-15]
+ node-version: [20.x, 22.x, 24.x, 26.x]
+ os: [ubuntu-latest, windows-latest, macos-26]
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ fetch-depth: 1
- name: Use Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v4
+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ matrix.node-version }}
@@ -51,24 +81,12 @@ jobs:
node --version
npm --version
- - uses: github/codeql-action/init@v3
- with:
- languages: javascript
- queries: security-and-quality
- config: |
- paths-ignore:
- - coverage
- - node_modules
-
- name: npm install and test
run: npm cit
env:
CI: true
- - uses: github/codeql-action/analyze@v3
-
- # v4.6.0
- - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
+ - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
if: success()
with:
name: ${{ runner.os }} node.js ${{ matrix.node-version }}
diff --git a/.github/workflows/release-audit.yml b/.github/workflows/release-audit.yml
index 52798d4..6bceca2 100644
--- a/.github/workflows/release-audit.yml
+++ b/.github/workflows/release-audit.yml
@@ -34,13 +34,16 @@ jobs:
runs-on: ubuntu-latest
steps:
# Checkout project
- - uses: actions/checkout@v6
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ fetch-depth: 1
- # Check license headers (v2.0.0)
- - uses: erisu/apache-rat-action@46fb01ce7d8f76bdcd7ab10e7af46e1ea95ca01c
+ # Check license headers
+ - uses: erisu/apache-rat-action@30c94d10ed21e6f6fd5590dc5c158f58cae7a0dd # v3.0.0
# Setup environment with node
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
@@ -48,8 +51,8 @@ jobs:
- name: npm install packages
run: npm ci
- # Check node package licenses (v2.0.1)
- - uses: erisu/license-checker-action@99cffa11264fe545fd0baa6c13bca5a00ae608f2
+ # Check node package licenses
+ - uses: erisu/license-checker-action@04511f4c052b5773f11e1c65b42cda88235c62ae # v2.1.0
with:
license-config: 'licence_checker.yml'
include-asf-category-a: true
diff --git a/.ratignore b/.rat-excludes
similarity index 100%
rename from .ratignore
rename to .rat-excludes
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org