dependabot[bot]
1b8616ca89
chore(deps)(deps): bump the github-actions-minor group across 1 directory with 8 updates ( #7289 )
...
Bumps the github-actions-minor group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner ) | `2.17.0` | `2.19.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.3.0` | `6.4.0` |
| [actions/cache](https://github.com/actions/cache ) | `5.0.4` | `5.0.5` |
| [KSXGitHub/github-actions-deploy-aur](https://github.com/ksxgithub/github-actions-deploy-aur ) | `4.1.2` | `4.1.3` |
| [signpath/github-action-submit-signing-request](https://github.com/signpath/github-action-submit-signing-request ) | `2.1` | `2.2` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action ) | `1.0.93` | `1.0.101` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.35.1` | `4.35.2` |
| [cloudflare/wrangler-action](https://github.com/cloudflare/wrangler-action ) | `3.14.1` | `3.15.0` |
Updates `step-security/harden-runner` from 2.17.0 to 2.19.0
- [Release notes](https://github.com/step-security/harden-runner/releases )
- [Commits](f808768d15...8d3c67de8ehttps://github.com/actions/setup-node/releases )
- [Commits](53b83947a5...48b55a011bhttps://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](668228422a...27d5ce7f10https://github.com/ksxgithub/github-actions-deploy-aur/releases )
- [Commits](abe8ac26b5...da03e16036https://github.com/signpath/github-action-submit-signing-request/releases )
- [Commits](bc66d86b01...b9d91eadd3https://github.com/anthropics/claude-code-action/releases )
- [Commits](b47fd721da...38ec876110https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](c10b8064de...95e58e9a2chttps://github.com/cloudflare/wrangler-action/releases )
- [Changelog](https://github.com/cloudflare/wrangler-action/blob/main/CHANGELOG.md )
- [Commits](da0e0dfe58...9acf94ace1
2026-04-20 13:41:16 +02:00
Johannes Millan
161da56585
fix(ci): close pull_request_target pwn request vulnerability ( #6879 )
...
Split PR preview into two workflows using the workflow_run pattern:
- pr-preview-build.yml (pull_request): builds without secret access
- pr-preview-deploy.yml (workflow_run): deploys pre-built artifact with secrets
Prevents fork PR authors from executing arbitrary code with access to
CLOUDFLARE_API_TOKEN, UNSPLASH_KEY, and other repository secrets.
2026-03-19 13:11:36 +01:00
dependabot[bot]
f930440fc7
chore(deps)(deps): bump the github-actions-minor group with 5 updates ( #6770 )
...
Bumps the github-actions-minor group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner ) | `2.15.0` | `2.15.1` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.2.0` | `6.3.0` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action ) | `4.8.3` | `4.9.0` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action ) | `1.0.65` | `1.0.70` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.32.4` | `4.32.6` |
Updates `step-security/harden-runner` from 2.15.0 to 2.15.1
- [Release notes](https://github.com/step-security/harden-runner/releases )
- [Commits](a90bcbc653...58077d3c7ehttps://github.com/actions/setup-node/releases )
- [Commits](6044e13b5d...53b83947a5https://github.com/actions/dependency-review-action/releases )
- [Commits](05fe457637...2031cfc080https://github.com/anthropics/claude-code-action/releases )
- [Commits](220272d388...26ec041249https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](89a39a4e59...0d579ffd05
2026-03-09 11:43:10 +01:00
Johannes Millan
5552506180
ci(workflows): use node 22 for npm install jobs
2026-02-25 19:14:11 +01:00
dependabot[bot]
ce6af3a2db
chore(deps)(deps): bump the github-actions-minor group with 5 updates ( #6188 )
...
Bumps the github-actions-minor group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner ) | `2.14.0` | `2.14.1` |
| [actions/setup-java](https://github.com/actions/setup-java ) | `5.1.0` | `5.2.0` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action ) | `1.0.30` | `1.0.34` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.31.10` | `4.31.11` |
| [cloudflare/wrangler-action](https://github.com/cloudflare/wrangler-action ) | `3.12.0` | `3.14.1` |
Updates `step-security/harden-runner` from 2.14.0 to 2.14.1
- [Release notes](https://github.com/step-security/harden-runner/releases )
- [Commits](20cf305ff2...e3f713f2d8https://github.com/actions/setup-java/releases )
- [Commits](f2beeb24e1...be666c2fcdhttps://github.com/anthropics/claude-code-action/releases )
- [Commits](a017b830c0...f64219702dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](cdefb33c0f...19b2f06db2https://github.com/cloudflare/wrangler-action/releases )
- [Changelog](https://github.com/cloudflare/wrangler-action/blob/main/CHANGELOG.md )
- [Commits](e998fe3d9a...da0e0dfe58
2026-01-26 11:05:14 +01:00
dependabot[bot]
165cf9f60a
chore(deps)(deps): bump actions/setup-node from 4.0.3 to 6.2.0 ( #6189 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 4.0.3 to 6.2.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v4.0.3...6044e13b5dc448c55e2357c09f80417699197238 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-26 11:05:06 +01:00
dependabot[bot]
3d928e6ed9
chore(deps)(deps): bump actions/checkout from 4.1.7 to 6.0.2 ( #6190 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.7 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v4.1.7...v6.0.2 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-26 11:04:50 +01:00
Corey Newton
d252984d0f
docs(ci): expand permissions for CI ( #6150 )
...
This should minimize false warnings and allow for merges without
concern. Slight renaming of jobs should also help with review. Exclusion
of new GH Action for docs/wiki/** added too.
2026-01-24 21:13:58 +01:00
Claude
b9cefeb14b
fix(ci): correct cloudflare/wrangler-action SHA to match v3.12.0 tag
...
The previous SHA (122ee5c...) was a pre-release commit. Updated to the
correct SHA (e998fe3...) that corresponds to the v3.12.0 release tag.
2026-01-24 00:04:32 +00:00
Claude
9cefb19629
fix: address code review issues from yesterday's changes
...
- ci: complete SHA pinning for GitHub Actions in pr-preview-deploy.yml
- actions/checkout@v4.1.7
- actions/setup-node@v4.0.3
- cloudflare/wrangler-action@v3.12.0
- style: add High Contrast Mode fallback for sync state icon
- style: fix comment inaccuracy (18px -> 15px)
- refactor(schedule): complete magic number extraction to constants
- Add MONTH_VIEW config to SCHEDULE_CONSTANTS
- Use $schedule-time-column-width SCSS variable
- fix(issue-templates): add error message field to internal error report
- a11y: add aria-label to panels menu button in mobile bottom nav
2026-01-23 23:55:33 +00:00
Johannes Millan
9c83be9261
fix(ci): enable preview deployments for fork PRs with manual approval
...
- Change trigger from pull_request to pull_request_target
- Add environment protection requirement (preview-deployments)
- Explicitly checkout PR head SHA to build fork PR code
- Requires manual approval before deployment to prevent secret exposure
This fixes the issue where fork PRs couldn't deploy previews because
secrets aren't available to pull_request triggers from forks.
2026-01-23 14:31:25 +01:00
Ivan Kalashnikov
60cc73b4c0
chore(workflow): add continue-on-error option to deploy-preview and review jobs
2026-01-23 15:56:15 +07:00
Johannes Millan
70aae24449
fix(sync): defer ImmediateUploadService initialization until data loads
...
Prevents race condition where upload attempts happen before sync config
is loaded from IndexedDB, eliminating 404 errors to default baseUrl
during app startup and E2E tests.
2026-01-22 17:33:17 +01:00
Johannes Millan
a0fdc2efee
fix(ci): pin pr-preview-deploy workflow actions to commit SHAs
...
- Update peter-evans/find-comment to v4.0.0 (pinned SHA)
- Update peter-evans/create-or-update-comment to v5.0.0 (pinned SHA)
Fixes GitHub Actions failure where v4 tag pointed to unavailable commit.
Uses commit SHAs instead of version tags for supply chain security.
2026-01-22 16:57:19 +01:00
Johannes Millan
c07ee10d47
fix(ci): use stable version tags for GitHub Actions
2026-01-22 15:38:55 +01:00
Claude
519e12beb1
feat(ci): add Cloudflare Pages PR preview deployments
...
Add automated preview deployments for pull requests using Cloudflare Pages.
Each PR gets a unique preview URL that updates on every push.
Requires configuring these repository secrets:
- CLOUDFLARE_API_TOKEN
- CLOUDFLARE_ACCOUNT_ID
2026-01-21 23:43:52 +00:00
