[2.4.0 stack 10/18] Tooling: jscpd, knip and Stryker gates, SHA-pinned actions, supply-chain scans, API Extractor, badges and docs cover

.commitlintrc.json

@@ -0,0 +1,3 @@
+{
+	"extends": ["@commitlint/config-conventional"]
+}

.github/actions/setup/action.yml

@@ -11,13 +11,13 @@ runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
         node-version-file: ${{ inputs.node-version == '' && '.nvmrc' || '' }}
 
     - name: Setup Vite+
-      uses: voidzero-dev/setup-vp@v1.19.0
+      uses: voidzero-dev/setup-vp@49c3e4e92c52e7f8392712a9267bbe71c5ab30e5 # v1.19.0
       with:
         cache: true
         node-manager: false

.github/workflows/build.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -32,7 +32,7 @@ jobs:
         run: vp run build
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist
           path: dist
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout head
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -56,7 +56,7 @@ jobs:
 
       - name: Checkout base
         if: ${{ github.event_name == 'pull_request' }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: base
           ref: ${{ github.event.pull_request.base.sha }}
@@ -91,9 +91,9 @@ jobs:
               echo
               echo "No base measurement available (the base branch has no \`scripts/tree-shaking.ts\`, or an incompatible version). Showing head sizes only."
               echo
-              echo '```'
+              printf '%s\n' "\`\`\`"
               node scripts/tree-shaking.ts
-              echo '```'
+              printf '%s\n' "\`\`\`"
             } > tree-shaking.md
           fi
 
@@ -106,15 +106,15 @@ jobs:
           sed -i '1i<!-- tree-shaking-report -->' tree-shaking.md
           if [ "${{ steps.compare.outcome }}" = "failure" ]; then
             if [ "${{ contains(github.event.pull_request.labels.*.name, 'tree-shaking: accepted') }}" = "true" ]; then
-              printf '\n> Regression accepted through the `tree-shaking: accepted` label.\n' >> tree-shaking.md
+              printf '\n> Regression accepted through the "tree-shaking: accepted" label.\n' >> tree-shaking.md
             else
-              printf '\n> To accept an intentional size increase, add the `tree-shaking: accepted` label to this pull request.\n' >> tree-shaking.md
+              printf '\n> To accept an intentional size increase, add the "tree-shaking: accepted" label to this pull request.\n' >> tree-shaking.md
             fi
           fi
 
       - name: Find existing comment
         if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
         id: find-comment
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -123,7 +123,7 @@ jobs:
 
       - name: Post or update comment
         if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
@@ -144,7 +144,7 @@ jobs:
           {
             echo "## Tree-shaking report"
             echo
-            echo '```'
+            printf '%s\n' "\`\`\`"
             node scripts/tree-shaking.ts
-            echo '```'
+            printf '%s\n' "\`\`\`"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/check.yml

@@ -21,8 +21,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup
@@ -31,6 +32,25 @@ jobs:
       - name: Run checks
         run: vp check
 
+      - name: Check commit messages
+        if: ${{ github.event_name == 'pull_request' }}
+        run: npx commitlint --from "${{ github.event.pull_request.base.sha }}" --to HEAD --verbose
+
+      - name: Check the package has no runtime dependencies
+        run: npm run check:dependencies
+
+      - name: Check the lockfile
+        run: npm run check:lockfile
+
+      - name: Check for duplicated code
+        run: npm run check:duplication
+
+      - name: Check for unused files, exports and dependencies
+        run: npm run check:unused
+
+      - name: Check the public API report is up to date
+        run: npm run build && npx api-extractor run --verbose
+
       - name: Check llms.txt/llms-full.txt are up to date
         run: npm run build:llms && git diff --exit-code -- docs/llms.txt docs/llms-full.txt
 

.github/workflows/datasets.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -39,7 +39,7 @@ jobs:
 
       - name: Open pull request
         if: steps.diff.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           commit-message: "chore(data): update IBGE/CONCLA datasets"
           branch: chore/update-datasets

.github/workflows/links.yml

@@ -0,0 +1,29 @@
+name: Links
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - "**/*.md"
+      - "src/**/*.ts"
+
+permissions:
+  contents: read
+
+jobs:
+  links:
+    name: Check links
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run lychee
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+        with:
+          args: --no-progress --accept 200..299,403,429 --timeout 45 --retry-wait-time 5 --max-retries 2 --root-dir docs --exclude-path node_modules --exclude-path dist --exclude-path CHANGELOG.md --exclude-path docs/llms.txt --exclude-path docs/llms-full.txt --exclude-path docs/_navbar.md --exclude-path docs/_sidebar.md --exclude-path docs/_coverpage.md --exclude-path docs/pt-br/_navbar.md --exclude-path docs/pt-br/_sidebar.md --exclude-path docs/pt-br/_coverpage.md '**/*.md' 'src/**/*.ts'
+          fail: true

.github/workflows/live-tests.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/mutation.yml

@@ -0,0 +1,40 @@
+name: Mutation tests
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  mutation:
+    name: Stryker
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Mutation test every file
+        run: npm run test:mutation
+
+      - name: Upload the mutation report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mutation-report
+          path: reports/mutation
+          if-no-files-found: ignore

.github/workflows/security.yml

@@ -0,0 +1,50 @@
+name: Security
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  workflows:
+    name: Lint GitHub Actions workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run actionlint
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          min-severity: low
+
+  dependencies:
+    name: Scan dependencies with OSV
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run OSV-Scanner
+        uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
+        with:
+          scan-args: |
+            --lockfile=package-lock.json

.github/workflows/tests.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -46,7 +46,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: matrix.node-version == 24
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/lcov.info
@@ -60,12 +60,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
       - name: Run tests
         run: bun test src
@@ -77,12 +77,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
         with:
           deno-version: v2.x
 
@@ -99,7 +99,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -116,7 +116,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.gitignore

@@ -6,3 +6,5 @@ node_modules
 .rts2_cache_umd
 dist
 coverage
+.stryker-tmp
+reports

.jscpd.json

@@ -0,0 +1,12 @@
+{
+	"$schema": "https://raw.githubusercontent.com/kucherenko/jscpd/master/packages/jscpd/schema.json",
+	"threshold": 0,
+	"minLines": 5,
+	"minTokens": 50,
+	"format": ["typescript"],
+	"path": ["src", "scripts"],
+	"ignore": ["**/_internals/constants/**", "**/node_modules/**"],
+	"gitignore": true,
+	"reporters": ["console"],
+	"absolute": false
+}

.lycheeignore

@@ -0,0 +1,10 @@
+%7B
+linkedin\.com
+github\.com/saculbr
+matalmeida\.me
+engenhandosoftware\.com\.br
+rfoel\.com
+planalto\.gov\.br
+confaz\.fazenda\.gov\.br
+bcb\.gov\.br
+alerj\.rj\.gov\.br