ci: harden GitHub Actions pins and migrate changesets/action to v2 - #210
Merged
Merged
Conversation
…emver Dependabot PR #205 bumped changesets/action across a major (v1 to v2.1.0) but left the invalid v1 inputs in place and mislabeled the SHA as "# v1", so merging it as-is would have silently broken the release pipeline. This supersedes #205 with the correct migration. changesets/action v2 renamed the inputs this repo uses: commit becomes commit-message, title becomes pr-title, and the GITHUB_TOKEN env var is no longer accepted and must be passed via the github-token input. Behavior is otherwise unchanged for our setup: without a publish-script input the action stays in version-PR-only mode, and create-github-releases / push-git-tags both default to false, so tagging and publishing remain owned solely by the separate publish job. Also bumps chromaui/action to v18.4.0 (the other half of #205, safe minor). Separately, tighten every SHA-pinned action comment from major-only (# v7) to full semver (# v7.0.1) across all workflows and the composite setup action. The coarse comments are what let the v1-to-v2 jump hide behind a stale "# v1" label; full-version comments make a future cross-major Dependabot bump visible in the diff instead of silent.
npm audit flagged a high-severity ReDoS/DoS advisory in brace-expansion pulled in transitively by dev/build tooling (eslint, storybook, remark, npm internals). Production dependency tree is unaffected (npm audit --omit=dev reports zero), so nothing changes for adopters. Lockfile-only change via npm audit fix (no --force): rewrites nested brace-expansion copies to patched versions across ten dependency paths. package.json is untouched; no direct dependency versions change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Supersedes Dependabot #205, which bumped changesets/action across a major (v1 to v2.1.0) while leaving the invalid v1 inputs in place and mislabeling the SHA as "# v1" -- merging it as-is would have silently broken the release pipeline. This applies the correct v2 migration, tightens every SHA-pinned action comment to full semver so a future cross-major bump can't hide behind a stale label, and patches a transitive brace-expansion advisory. No effect on published CSS or the package.
Supersedes #205 (close unmerged once this lands). Related: #207 (cssnano) handled as a follow-on.
Type of change
How to review
Three independent, low-risk changes -- review each on its own:
Before requesting review
npm run lint,npm run format, andnpm testpass locallyRender-affecting and package-shipping sections: N/A. No changeset needed -- workflow YAML and dev-only lockfile changes don't ship in the package.
Notes for reviewers
Why manual instead of merging #205: Dependabot's SHA-pin comment rewriting keeps the granularity of the existing comment, so a major-only "# v1" comment survived a cross-major SHA bump -- the diff read as no-change while actually jumping to v2. Tightening all comments to full semver (task b) is the durable fix so this can't recur silently on future bumps.
Follow-on: #207 (cssnano 8.0.6) fails check:css-hash by design -- output-affecting Dependabot bumps can't self-update the CSS baseline and need a manual hash regen plus a Chromatic run. Handled in a separate branch.