build: refresh configs

.github/labeler.yml

@@ -1,29 +1,35 @@
+release:
+- base-branch: 'main'
+
 test:
-  - src/__mocks__/**/*.test.ts
-  - src/__tests__/**/*.test.ts
+- changed-files:
+  - any-glob-to-any-file: ['src/__mocks__/**/*.test.ts', 'src/__tests__/**/*.test.ts']
 
 workflow:
-  - .github/**/*
-  - .gitignore
-  - .npmignore
+- changed-files:
+  - any-glob-to-any-file: ['.github/**/*', '.gitignore', '.npmignore']
 
 project:
-  - package-lock.json
-  - package.json
-  - LICENSE
+- changed-files:
+  - any-glob-to-any-file: ['package-lock.json', 'package.json', 'LICENSE']
 
 source:
-  - any: ['src/**/*', '!src/cli/*', '!src/__mocks__/*', '!src/__tests__/*']
+- changed-files:
+  - any-glob-to-any-file: ['src/**/*', '!src/cli/*', '!src/__mocks__/*', '!src/__tests__/*']
 
 api:
-  - bin/**/*
-  - src/cli/**/*
+- changed-files:
+  - any-glob-to-any-file: ['bin/**/*', 'src/cli/**/*']
 
 docs:
-  - any: ['docs/**/*', '*.md', '.ghinfo']
+- changed-files:
+  - any-glob-to-any-file: ['docs/**/*', '*.md', '.ghinfo']
 
 example:
-  - example/**/*
+- changed-files:
+  - any-glob-to-any-file: ['example/**/*']
+  -
 
 media:
-  - media/**/*
+- changed-files:
+  - any-glob-to-any-file: ['media/**/*']

.github/workflows/build.yml

@@ -14,13 +14,13 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     env:
-      NODE_VERSION: 16
+      NODE_VERSION: latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Setup Node.js v${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ env.NODE_VERSION }}
 
@@ -35,7 +35,7 @@ jobs:
         npm run test
 
     - name: Cache coverage
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: coverage
         key: coverage-${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('src/**/*.*', '**/package-lock.json') }}
@@ -45,13 +45,13 @@ jobs:
     needs: [ test ]
     runs-on: ubuntu-latest
     env:
-      NODE_VERSION: 16
+      NODE_VERSION: latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Use Node.js ${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ env.NODE_VERSION }}
 
@@ -69,21 +69,21 @@ jobs:
     needs: [ build ]
     runs-on: ubuntu-latest
     env:
-      NODE_VERSION: 16
+      NODE_VERSION: latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Cache coverage
       id: cache-coverage
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: coverage
         key: coverage-${{ runner.os }}-${{ env.NODE_VERSION }}-${{ hashFiles('src/**/*.*', '**/package-lock.json') }}
 
     - name: Setup Node.js v${{ env.NODE_VERSION }}
       if: steps.cache-coverage.outputs.cache-hit != 'true'
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ env.NODE_VERSION }}
 
@@ -96,7 +96,7 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Send coverage report
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
       with:
         file: ./coverage/lcov.info
 

.github/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Sync project labels
       uses: micnncim/action-label-syncer@v1
@@ -19,17 +19,20 @@ jobs:
 
   publish:
     name: Publish
+    needs: [ sync ]
     runs-on: ubuntu-latest
-    env:
-      NODE_VERSION: 16
+
+    permissions:
+      id-token: write
+
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
-    - name: Setup Node.js v${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v3
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
       with:
-        node-version: ${{ env.NODE_VERSION }}
+        node-version: latest
 
     - name: Install Dependencies
       run: npm ci
@@ -45,26 +48,29 @@ jobs:
       run: npm run build
 
     - name: Publish package
-      uses: JS-DevTools/npm-publish@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      uses: JS-DevTools/npm-publish@v3
       with:
         token: ${{ secrets.NPM_TOKEN }}
         access: "public"
+        provenance: true
 
   release:
     name: Create Release
+    needs: [ publish ]
     runs-on: ubuntu-latest
-    env:
-      NODE_VERSION: 16
+
+    permissions:
+      contents: write
+      id-token: write
+
     steps:
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
-    - name: Use Node.js ${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v3
+    - name: Use Node.js
+      uses: actions/setup-node@v4
       with:
-        node-version: ${{ env.NODE_VERSION }}
+        node-version: latest
 
     - name: Get package version
       run: node -p -e '`PACKAGE_VERSION=${require("./package.json").version}`' >> $GITHUB_ENV

.github/workflows/scan.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: 2
 

.github/workflows/sync.yml

@@ -8,8 +8,13 @@ jobs:
   labels:
     name: Pull Request Labeler
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
     steps:
-    - uses: actions/labeler@v4
+    - uses: actions/labeler@v5
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: '.github/labeler.yml'