Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Release Package
name: Release Package (Next.js)

on:
push:
Expand All @@ -9,42 +9,42 @@

jobs:
release:
name: Release
name: Release Package (Next.js)
runs-on: ubuntu-latest
env:
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_TEAM: ${{ vars.TURBO_TEAM }}

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Enable Corepack
run: npm i -g corepack@latest && corepack enable

- name: Setup Node.js v22 LTS
uses: actions/setup-node@v4
with:
node-version: 22
cache: "pnpm"
registry-url: https://registry.npmjs.org

- name: Cache Turborepo build setup
uses: actions/cache@v4
with:
path: .turbo
key: ${{ runner.os }}-turbo-${{ github.sha }}
restore-keys: |
${{ runner.os }}-turbo-

- name: Install dependencies
run: pnpm install

- name: Build package
run: pnpm build --filter=@simpleanalytics/next

- name: Publish package
shell: bash
run: pnpm publish --filter=@simpleanalytics/next --access public --no-git-checks
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Original file line number Diff line number Diff line change
@@ -1,39 +1,40 @@
name: Publish Preview Package
name: Publish Preview Package (Next.js)
on: [push, pull_request]

jobs:
build:
name: Publish Preview Package (Next.js)
runs-on: ubuntu-latest
env:
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_TEAM: ${{ vars.TURBO_TEAM }}

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Enable Corepack
run: npm i -g corepack@latest && corepack enable

- name: Setup Node.js v22 LTS
uses: actions/setup-node@v4
with:
node-version: 22
cache: "pnpm"

- name: Cache Turborepo build setup
uses: actions/cache@v4
with:
path: .turbo
key: ${{ runner.os }}-turbo-${{ github.sha }}
restore-keys: |
${{ runner.os }}-turbo-

- name: Install dependencies
run: pnpm install

- name: Build package
run: pnpm build --filter=@simpleanalytics/next

- name: Publish package
run: pnpx pkg-pr-new publish './packages/analytics'
- name: Publish Next preview package
run: pnpx pkg-pr-new publish './packages/analytics'

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 21 days ago

To fix the problem, add a permissions: block either at the workflow root (to affect all jobs) or to the specific job that requires it (in this case, the build job). The permissions should follow the principle of least privilege. Since the workflow appears to build and publish a package via a third-party tool and does not (in the shown steps) directly create pull requests, modify issues, or push to repo contents, it’s likely that only contents: read is needed. However, if the publishing tool requires broader GitHub permissions (e.g., contents: write or packages: write), those should be added, ideally after testing. For now, insert the minimal block for safety.

Insert the following block just below the workflow name: and before on: (affecting all jobs), or inside the job as shown in the background—here we will add it at the workflow root for clarity.

Suggested changeset 1
.github/workflows/publish-preview-next.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/publish-preview-next.yaml b/.github/workflows/publish-preview-next.yaml
--- a/.github/workflows/publish-preview-next.yaml
+++ b/.github/workflows/publish-preview-next.yaml
@@ -1,4 +1,6 @@
 name: Publish Preview Package (Next.js)
+permissions:
+  contents: read
 on: [push, pull_request]
 
 jobs:
EOF
@@ -1,4 +1,6 @@
name: Publish Preview Package (Next.js)
permissions:
contents: read
on: [push, pull_request]

jobs:
Copilot is powered by AI and may make mistakes. Always verify output.
40 changes: 40 additions & 0 deletions .github/workflows/publish-preview-react.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name: Publish Preview Package (React.js)
on: [push, pull_request]

jobs:
build:
name: Publish Preview Package (React.js)
runs-on: ubuntu-latest
env:
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_TEAM: ${{ vars.TURBO_TEAM }}

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Enable Corepack
run: npm i -g corepack@latest && corepack enable

- name: Setup Node.js v22 LTS
uses: actions/setup-node@v4
with:
node-version: 22
cache: "pnpm"

- name: Cache Turborepo build setup
uses: actions/cache@v4
with:
path: .turbo
key: ${{ runner.os }}-turbo-${{ github.sha }}
restore-keys: |
${{ runner.os }}-turbo-

- name: Install dependencies
run: pnpm install

- name: Build package
run: pnpm build --filter=@simpleanalytics/react

- name: Publish React preview package
run: pnpx pkg-pr-new publish './packages/react'
Comment on lines +6 to +40

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 21 days ago

To resolve this issue, add an explicit permissions block to the workflow (just below the name or at the root, above on:) or specifically to the build job. Since the current workflow steps do not appear to require write access to repository contents or pull requests, the minimal safe permissions setting is contents: read. This restricts the automatic GITHUB_TOKEN to read-only access, significantly reducing risk. The edit should be made to the beginning of the .github/workflows/publish-preview-react.yaml file, either immediately after name: or within the build job definition.


Suggested changeset 1
.github/workflows/publish-preview-react.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/publish-preview-react.yaml b/.github/workflows/publish-preview-react.yaml
--- a/.github/workflows/publish-preview-react.yaml
+++ b/.github/workflows/publish-preview-react.yaml
@@ -1,4 +1,6 @@
 name: Publish Preview Package (React.js)
+permissions:
+  contents: read
 on: [push, pull_request]
 
 jobs:
EOF
@@ -1,4 +1,6 @@
name: Publish Preview Package (React.js)
permissions:
contents: read
on: [push, pull_request]

jobs:
Copilot is powered by AI and may make mistakes. Always verify output.
50 changes: 50 additions & 0 deletions .github/workflows/publish-react.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Release Package (React.js)

on:
push:
branches:
- main

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
release:
name: Release Package (React.js)
runs-on: ubuntu-latest
env:
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_TEAM: ${{ vars.TURBO_TEAM }}

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Enable Corepack
run: npm i -g corepack@latest && corepack enable

- name: Setup Node.js v22 LTS
uses: actions/setup-node@v4
with:
node-version: 22
cache: "pnpm"
registry-url: https://registry.npmjs.org

- name: Cache Turborepo build setup
uses: actions/cache@v4
with:
path: .turbo
key: ${{ runner.os }}-turbo-${{ github.sha }}
restore-keys: |
${{ runner.os }}-turbo-

- name: Install dependencies
run: pnpm install

- name: Build package
run: pnpm build --filter=@simpleanalytics/react

- name: Publish package
shell: bash
run: pnpm publish --filter=@simpleanalytics/react --access public --no-git-checks
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
Comment on lines +12 to +50

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 21 days ago

To fix the problem, you should add an explicit permissions block to the workflow, restricting the default token scope to the minimal required privileges. For this workflow, only read access to repository contents is necessary, since all publishing is handled with separate npm authentication and there are no steps that require write access to the repo, issues, or PRs. The best place to add this is right after the workflow name and on fields, before jobs, to apply it globally unless a job overrides it.

  • Edit .github/workflows/publish-react.yaml.
  • Insert the following lines:
    permissions:
      contents: read
    just after the on: section, before jobs:.
Suggested changeset 1
.github/workflows/publish-react.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/publish-react.yaml b/.github/workflows/publish-react.yaml
--- a/.github/workflows/publish-react.yaml
+++ b/.github/workflows/publish-react.yaml
@@ -7,6 +7,9 @@
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release Package (React.js)
EOF
@@ -7,6 +7,9 @@

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
contents: read

jobs:
release:
name: Release Package (React.js)
Copilot is powered by AI and may make mistakes. Always verify output.
73 changes: 73 additions & 0 deletions examples/reactjs/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
# React + TypeScript + Vite

This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.

Currently, two official plugins are available:

- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh

## React Compiler

The React Compiler is currently not compatible with SWC. See [this issue](https://github.com/vitejs/vite-plugin-react/issues/428) for tracking the progress.

## Expanding the ESLint configuration

If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:

```js
export default defineConfig([
globalIgnores(["dist"]),
{
files: ["**/*.{ts,tsx}"],
extends: [
// Other configs...

// Remove tseslint.configs.recommended and replace with this
tseslint.configs.recommendedTypeChecked,
// Alternatively, use this for stricter rules
tseslint.configs.strictTypeChecked,
// Optionally, add this for stylistic rules
tseslint.configs.stylisticTypeChecked,

// Other configs...
],
languageOptions: {
parserOptions: {
project: ["./tsconfig.node.json", "./tsconfig.app.json"],
tsconfigRootDir: import.meta.dirname,
},
// other options...
},
},
]);
```

You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:

```js
// eslint.config.js
import reactX from "eslint-plugin-react-x";
import reactDom from "eslint-plugin-react-dom";

export default defineConfig([
globalIgnores(["dist"]),
{
files: ["**/*.{ts,tsx}"],
extends: [
// Other configs...
// Enable lint rules for React
reactX.configs["recommended-typescript"],
// Enable lint rules for React DOM
reactDom.configs.recommended,
],
languageOptions: {
parserOptions: {
project: ["./tsconfig.node.json", "./tsconfig.app.json"],
tsconfigRootDir: import.meta.dirname,
},
// other options...
},
},
]);
```
23 changes: 23 additions & 0 deletions examples/reactjs/eslint.config.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
import js from '@eslint/js'
import globals from 'globals'
import reactHooks from 'eslint-plugin-react-hooks'
import reactRefresh from 'eslint-plugin-react-refresh'
import tseslint from 'typescript-eslint'
import { defineConfig, globalIgnores } from 'eslint/config'

export default defineConfig([
globalIgnores(['dist']),
{
files: ['**/*.{ts,tsx}'],
extends: [
js.configs.recommended,
tseslint.configs.recommended,
reactHooks.configs['recommended-latest'],
reactRefresh.configs.vite,
],
languageOptions: {
ecmaVersion: 2020,
globals: globals.browser,
},
},
])
13 changes: 13 additions & 0 deletions examples/reactjs/index.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<link rel="icon" type="image/svg+xml" href="/vite.svg" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>reactjs</title>
</head>
<body>
<div id="root"></div>
<script type="module" src="/src/main.tsx"></script>
</body>
</html>
31 changes: 31 additions & 0 deletions examples/reactjs/package.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
{
"name": "reactjs",
"private": true,
"version": "0.0.0",
"type": "module",
"scripts": {
"dev": "vite",
"build": "tsc -b && vite build",
"lint": "eslint .",
"preview": "vite preview"
},
"dependencies": {
"@simpleanalytics/react": "workspace:*",
"react": "^19.1.1",
"react-dom": "^19.1.1"
},
"devDependencies": {
"@eslint/js": "^9.36.0",
"@types/node": "^24.6.0",
"@types/react": "^19.1.16",
"@types/react-dom": "^19.1.9",
"@vitejs/plugin-react-swc": "^4.1.0",
"eslint": "^9.36.0",
"eslint-plugin-react-hooks": "^5.2.0",
"eslint-plugin-react-refresh": "^0.4.22",
"globals": "^16.4.0",
"typescript": "~5.9.3",
"typescript-eslint": "^8.45.0",
"vite": "^7.1.7"
}
}
1 change: 1 addition & 0 deletions examples/reactjs/public/vite.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
42 changes: 42 additions & 0 deletions examples/reactjs/src/App.css
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
#root {
max-width: 1280px;
margin: 0 auto;
padding: 2rem;
text-align: center;
}

.logo {
height: 6em;
padding: 1.5em;
will-change: filter;
transition: filter 300ms;
}
.logo:hover {
filter: drop-shadow(0 0 2em #646cffaa);
}
.logo.react:hover {
filter: drop-shadow(0 0 2em #61dafbaa);
}

@keyframes logo-spin {
from {
transform: rotate(0deg);
}
to {
transform: rotate(360deg);
}
}

@media (prefers-reduced-motion: no-preference) {
a:nth-of-type(2) .logo {
animation: logo-spin infinite 20s linear;
}
}

.card {
padding: 2em;
}

.read-the-docs {
color: #888;
}
37 changes: 37 additions & 0 deletions examples/reactjs/src/App.tsx
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
import { useState } from "react";
import { SimpleAnalytics } from "@simpleanalytics/react";
import reactLogo from "./assets/react.svg";
import viteLogo from "/vite.svg";
import "./App.css";

function App() {
const [count, setCount] = useState(0);

return (
<>
<div>
<SimpleAnalytics />
<a href="https://vite.dev" target="_blank">
<img src={viteLogo} className="logo" alt="Vite logo" />
</a>
<a href="https://react.dev" target="_blank">
<img src={reactLogo} className="logo react" alt="React logo" />
</a>
</div>
<h1>Vite + React</h1>
<div className="card">
<button onClick={() => setCount((count) => count + 1)}>
count is {count}
</button>
<p>
Edit <code>src/App.tsx</code> and save to test HMR
</p>
</div>
<p className="read-the-docs">
Click on the Vite and React logos to learn more
</p>
</>
);
}

export default App;
1 change: 1 addition & 0 deletions examples/reactjs/src/assets/react.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Loading