mirror of
https://github.com/iosonntag/obsidian-plugin-treefocus.git
synced 2026-07-22 08:40:29 +00:00
fix: refresh pnpm lockfile to v9.0 and modernize toolchain
The Obsidian community plugin scan flagged the pnpm lockfile as out of date. The committed lockfile was lockfileVersion 6.1 (pnpm 8), which a modern pnpm rejects (ERR_PNPM_LOCKFILE_BREAKING_CHANGE) - the plugin was removed from the community list on 2026-05-12. Regenerate the lockfile to 9.0 and modernize the toolchain so it stays valid: - pnpm 11 (packageManager) + lockfile regenerated to 9.0 - update all dependencies to latest (esbuild 0.28, typescript 6, husky 9, semantic-release 25, commitlint 21, @types/node 22) - pin obsidian (^1.13.0) instead of floating "latest" - tsconfig: bundler resolution + src/* paths (replaces deprecated baseUrl), explicit types: [node] - pnpm-workspace.yaml allowBuilds for esbuild (pnpm 11 build-script gate) - husky 9 hook format - CI: Node 22, pnpm 11, all actions pinned by commit SHA, Trivy supply-chain gate (fails on HIGH/CRITICAL vulns or leaked secrets), frozen-lockfile install, least-privilege permissions - remove dead eslint config Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
iOSonntag
parent
48aa81556d
commit
87970d1aaf
8 changed files with 2475 additions and 3021 deletions
|
|
@ -1,3 +0,0 @@
|
|||
node_modules/
|
||||
|
||||
main.js
|
||||
24
.eslintrc
24
.eslintrc
|
|
@ -1,24 +0,0 @@
|
|||
{
|
||||
"root": true,
|
||||
"parser": "@typescript-eslint/parser",
|
||||
"env": { "node": true },
|
||||
"plugins": [
|
||||
"@typescript-eslint"
|
||||
],
|
||||
"extends": [
|
||||
"eslint:recommended",
|
||||
"plugin:@typescript-eslint/eslint-recommended",
|
||||
"plugin:@typescript-eslint/recommended"
|
||||
],
|
||||
"parserOptions": {
|
||||
"sourceType": "module"
|
||||
},
|
||||
"rules": {
|
||||
"no-unused-vars": "off",
|
||||
"no-underscore-dangle": "off",
|
||||
"@typescript-eslint/no-unused-vars": ["error", { "args": "none" }],
|
||||
"@typescript-eslint/ban-ts-comment": "off",
|
||||
"no-prototype-builtins": "off",
|
||||
"@typescript-eslint/no-empty-function": "off"
|
||||
}
|
||||
}
|
||||
51
.github/workflows/release.yml
vendored
51
.github/workflows/release.yml
vendored
|
|
@ -5,51 +5,66 @@ on:
|
|||
branches:
|
||||
- master
|
||||
|
||||
# Least-privilege token; the release steps below need to push tags & create releases.
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Checkout
|
||||
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
|
||||
- name: Use Node.js
|
||||
uses: actions/setup-node@v3
|
||||
# Supply-chain gate: block the deploy on HIGH/CRITICAL vulnerabilities,
|
||||
# leaked secrets, or misconfigurations before anything is built or released.
|
||||
- name: Trivy security scan
|
||||
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
||||
with:
|
||||
node-version: "18.x"
|
||||
|
||||
- uses: pnpm/action-setup@v2
|
||||
scan-type: fs
|
||||
scan-ref: .
|
||||
scanners: vuln,secret,misconfig
|
||||
severity: HIGH,CRITICAL
|
||||
ignore-unfixed: true
|
||||
exit-code: "1"
|
||||
env:
|
||||
# Also scan the build/CI dependency tree, not just runtime deps.
|
||||
TRIVY_INCLUDE_DEV_DEPS: "true"
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
version: 8
|
||||
node-version: "22"
|
||||
cache: pnpm
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
pnpm install
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Create new version & CHANGELOG.md
|
||||
id: chkVersion
|
||||
run: npm run semantic-release
|
||||
run: pnpm run semantic-release
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
|
||||
- name: Print next version
|
||||
run: |
|
||||
echo ${{ steps.chkVersion.outputs.NEXT_RELEASE_VERSION }}
|
||||
echo ${{ steps.chkVersion.outputs.NEXT_RELEASE_NOTES }}
|
||||
echo "The next version is ${{ steps.chkVersion.outputs.NEXT_RELEASE_VERSION && steps.chkVersion.outputs.NEXT_RELEASE_VERSION || 'N/A' }}" >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
|
||||
- name: Update version files and create tag
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
|
||||
pnpm run version
|
||||
git add .
|
||||
|
||||
|
||||
- name: Build plugin
|
||||
run: |
|
||||
pnpm run build
|
||||
run: pnpm run build
|
||||
|
||||
- name: Create release
|
||||
env:
|
||||
|
|
@ -60,7 +75,7 @@ jobs:
|
|||
gh release create "$VERSION" \
|
||||
--title="Release v$VERSION" \
|
||||
main.js manifest.json styles.css
|
||||
|
||||
|
||||
- name: Push Tag and staged Files
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
|
@ -71,4 +86,4 @@ jobs:
|
|||
git config user.email github-actions@github.com
|
||||
git commit -am "chore(release): v${{ steps.chkVersion.outputs.NEXT_RELEASE_VERSION }} [skip ci] ${{ steps.chkVersion.outputs.NEXT_RELEASE_NOTES }}"
|
||||
git tag -a $VERSION -m "$VERSION"
|
||||
git push --follow-tags
|
||||
git push --follow-tags
|
||||
|
|
|
|||
|
|
@ -1,3 +1 @@
|
|||
#!/usr/bin/env sh
|
||||
. "$(dirname -- "$0")/_/husky.sh"
|
||||
npm run commitlint ${1}
|
||||
pnpm run commitlint ${1}
|
||||
|
|
|
|||
27
package.json
27
package.json
|
|
@ -9,7 +9,7 @@
|
|||
"build": "tsc -noEmit -skipLibCheck && node esbuild.config.mjs production",
|
||||
"semantic-release": "semantic-release",
|
||||
"version": "node version-bump.mjs && git add manifest.json versions.json",
|
||||
"prepare": "husky install",
|
||||
"prepare": "husky",
|
||||
"commitlint": "commitlint --edit"
|
||||
},
|
||||
"keywords": [],
|
||||
|
|
@ -21,21 +21,20 @@
|
|||
"license": "MIT",
|
||||
"devDependencies": {
|
||||
"@semantic-release/changelog": "^6.0.3",
|
||||
"@semantic-release/exec": "^6.0.3",
|
||||
"@semantic-release/exec": "^7.1.0",
|
||||
"@semantic-release/git": "^10.0.1",
|
||||
"@types/node": "^16.11.6",
|
||||
"@typescript-eslint/eslint-plugin": "5.29.0",
|
||||
"@typescript-eslint/parser": "5.29.0",
|
||||
"builtin-modules": "3.3.0",
|
||||
"commitlint": "^17.7.1",
|
||||
"esbuild": "0.17.3",
|
||||
"husky": "^8.0.3",
|
||||
"obsidian": "latest",
|
||||
"semantic-release": "^22.0.4",
|
||||
"tslib": "2.4.0",
|
||||
"typescript": "4.7.4"
|
||||
"@types/node": "^22",
|
||||
"builtin-modules": "5.2.0",
|
||||
"commitlint": "^21.0.2",
|
||||
"esbuild": "0.28.0",
|
||||
"husky": "^9.1.7",
|
||||
"obsidian": "^1.13.0",
|
||||
"semantic-release": "^25.0.3",
|
||||
"tslib": "2.8.1",
|
||||
"typescript": "6.0.3"
|
||||
},
|
||||
"dependencies": {
|
||||
"deepmerge": "^4.3.1"
|
||||
}
|
||||
},
|
||||
"packageManager": "pnpm@11.1.2"
|
||||
}
|
||||
|
|
|
|||
5378
pnpm-lock.yaml
5378
pnpm-lock.yaml
File diff suppressed because it is too large
Load diff
2
pnpm-workspace.yaml
Normal file
2
pnpm-workspace.yaml
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
allowBuilds:
|
||||
esbuild: true
|
||||
|
|
@ -1,13 +1,16 @@
|
|||
{
|
||||
"compilerOptions": {
|
||||
"baseUrl": ".",
|
||||
"inlineSourceMap": true,
|
||||
"inlineSources": true,
|
||||
"module": "ESNext",
|
||||
"target": "ES6",
|
||||
"allowJs": true,
|
||||
"noImplicitAny": true,
|
||||
"moduleResolution": "node",
|
||||
"moduleResolution": "bundler",
|
||||
"paths": {
|
||||
"src/*": ["./src/*"]
|
||||
},
|
||||
"types": ["node"],
|
||||
"esModuleInterop": true,
|
||||
"importHelpers": true,
|
||||
"strict": true,
|
||||
|
|
|
|||
Loading…
Reference in a new issue