Merge remote-tracking branch 'origin/master' into ui-updates

.github/ISSUE_TEMPLATE/3-language-feature.md

@@ -0,0 +1,9 @@
+---
+name: Language specific issue
+about: Report a language-specific issue or feature request
+title: '[REPLACE ME WITH YOUR REQUESTED LANGUAGE]: '
+labels: 'area/linguistics'
+assignees: ''
+
+---
+

.github/ISSUE_TEMPLATE/4-tech-debt.md

@@ -0,0 +1,10 @@
+---
+name: Tech Debt
+about: Track any tech debt or dev improvements
+title: ''
+labels: area/tech-debt
+assignees: ''
+
+---
+
+

.github/actionlint-matcher.json

@@ -0,0 +1,17 @@
+{
+    "problemMatcher": [
+        {
+            "owner": "actionlint",
+            "pattern": [
+                {
+                    "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+                    "file": 1,
+                    "line": 2,
+                    "column": 3,
+                    "message": 4,
+                    "code": 5
+                }
+            ]
+        }
+    ]
+}

.github/actions/setup/action.yml

@@ -0,0 +1,25 @@
+name: Setup
+description: Setup the workspace for the CI
+runs:
+  using: "composite"
+  steps:
+    - name: Setup node
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: "package.json"
+
+    - name: Restore dependencies
+      id: restore-dependencies
+      uses: actions/cache@v4
+      with:
+        path: node_modules
+        key: js-depend-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
+
+    - name: Install dependencies
+      if: steps.restore-dependencies.outputs.cache-hit != 'true'
+      shell: bash
+      run: npm ci
+
+    - name: Build third-party libraries
+      shell: bash
+      run: npm run build:libs

.github/dependabot.yml

@@ -31,7 +31,7 @@ updates:
       # These dependencies should be updated manually:
       - dependency-name: "vitest"
         # Benchmarking is an experimental feature in vitest:
-        # https://github.com/themoeway/yomitan/pull/583#issuecomment-1925047371
+        # https://github.com/yomidevs/yomitan/pull/583#issuecomment-1925047371
       - dependency-name: "@vitest/coverage-v8"
         # Pinned to stay on the same version as vitest
       - dependency-name: "@types/node"

.github/release.yml

@@ -6,7 +6,7 @@ changelog:
     - title: Breaking Changes
       labels:
         - kind/breaking-change
-    - title: Enhancement
+    - title: Enhancements
       labels:
         - kind/enhancement
     - title: Bug Fixes

.github/workflows/actionlint.yml

@@ -0,0 +1,14 @@
+name: Lint GitHub Actions workflows
+on: [push, pull_request]
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check workflow files
+        run: |
+            echo "::add-matcher::.github/actionlint-matcher.json"
+            bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/v1.7.4/scripts/download-actionlint.bash)
+            ./actionlint -color
+        shell: bash

.github/workflows/auto-approve-run.yml

@@ -14,7 +14,7 @@ jobs:
     if: github.actor == 'djahandarie'
     steps:
       - name: Download workflow artifact
-        uses: dawidd6/action-download-artifact@e7466d1a7587ed14867642c2ca74b5bcc1e19a2d # v3.0.0
+        uses: dawidd6/action-download-artifact@80620a5d27ce0ae443b965134db88467fc607b43 # v7
         with:
             github_token: ${{ secrets.GITHUB_TOKEN }}
             workflow: auto-approve.yml

.github/workflows/auto-approve.yml

@@ -9,9 +9,9 @@ jobs:
         shell: bash
         env:
           PR_NUM: ${{ github.event.number }}
-        run: echo $PR_NUM > pr_num.txt
+        run: echo "$PR_NUM" > pr_num.txt
       - name: Upload the PR number
         uses: actions/upload-artifact@v4
         with:
           name: pr_num
-          path: ./pr_num.txt
+          path: ./pr_num.txt

.github/workflows/broken-links.yml

@@ -20,8 +20,8 @@ jobs:
       - name: Install dependencies
         run: npm ci
       - name: Build Legal
-        run: npm run license-report
-      - uses: lycheeverse/lychee-action@c053181aa0c3d17606addfe97a9075a32723548a
+        run: npm run license-report:html
+      - uses: lycheeverse/lychee-action@v2.1.0
         with:
           fail: true
           jobSummary: false

.github/workflows/ci.yml

@@ -10,58 +10,71 @@ on:
   merge_group:
 
 jobs:
-  test:
+  tests:
+    name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - name: JavaScript
+            test: test:js
+          - name: TypeScript (main)
+            test: test:ts:main
+          - name: TypeScript (dev)
+            test: test:ts:dev
+          - name: TypeScript (test)
+            test: test:ts:test
+          - name: TypeScript (bench)
+            test: test:ts:bench
+          - name: CSS
+            test: test:css
+          - name: HTML
+            test: test:html
+          - name: Markdown
+            test: test:md
+          - name: JSON
+            test: test:json
+          - name: Unit Tests
+            test: test:unit
+          - name: Unit Tests (options)
+            test: test:unit:options
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
 
-      - name: Setup node
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: "package.json"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build Libs
-        run: npm run build-libs
-
-      - name: Lint JS
-        run: npm run test-lint-js
-        env:
-          CI: true
-
-      - name: Validate JS Types
-        run: npm run test-ts
-        env:
-          CI: true
-
-      - name: Lint CSS
-        run: npm run test-lint-css
-        env:
-          CI: true
-
-      - name: Lint HTML
-        run: npm run test-lint-html
-        env:
-          CI: true
+      - name: Run ${{ matrix.name }} tests
+        run: npm run ${{ matrix.test }}
 
-      - name: Tests
-        run: npm run test-code
-        env:
-          CI: true
+  test-build:
+    name: Test Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
 
       - name: Build Legal
-        run: npm run license-report
+        run: npm run license-report:html
 
       - name: Build
         run: npm run build
 
       - name: Validate manifest.json of the extension
-        uses: cardinalby/schema-validator-action@76c68bfc941bd2dc82859f2528984999d1df36a4 # v3.1.0
+        uses: cardinalby/schema-validator-action@2166123eb256fa40baef7e22ab1379708425efc7 # v3.1.1
         with:
           file: ext/manifest.json
           schema: "https://json.schemastore.org/chrome-manifest.json"
           fixSchemas: true
+
+  bench:
+    name: Benchmarks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup
+
+      - name: Run Benchmarks
+        uses: CodSpeedHQ/action@513a19673a831f139e8717bf45ead67e47f00044 # v3.2
+        with:
+          token: ${{ secrets.CODSPEED_TOKEN }}
+          run: npm run bench

.github/workflows/codeql.yml

@@ -10,7 +10,8 @@
 # supported CodeQL languages.
 #
 name: "CodeQL"
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ "master" ]
@@ -50,7 +51,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v3.27.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -64,7 +65,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v3.27.5
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -77,6 +78,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v3.27.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/create-prerelease-on-tag.yml

@@ -22,11 +22,12 @@ jobs:
         with:
           node-version-file: "package.json"
 
+      # intentially do not use cache to keep the build more comprehensible and sandboxed
       - name: Install dependencies
         run: npm ci
 
       - name: Build Legal
-        run: npm run license-report
+        run: npm run license-report:html
 
       - name: Build
         run: npm run-script build -- --all --version ${{ github.ref_name }}
@@ -36,25 +37,26 @@ jobs:
         id: hash
         run: |
           cd builds
-          echo "hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT"
+          echo "hashes=$(sha256sum -- * | base64 -w0)" >> "$GITHUB_OUTPUT"
 
       - name: Release
         id: release
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # pin@v0.1.15
+        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # pin@v2
         with:
           generate_release_notes: true
           prerelease: true
           files: builds/*
 
       - name: Dispatch publish-chrome-development
-        uses: aurelien-baudet/workflow-dispatch@93e95b157d791ae7f42aef8f8a0d3d723eba1c31 # pin@v2
+        uses: aurelien-baudet/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7 # pin@v2
         with:
           workflow: publish-chrome-development
           token: ${{ secrets.GITHUB_TOKEN }}
           wait-for-completion: false
+          inputs: '{ "upload_url": "${{ steps.release.outputs.upload_url }}" }'
 
       - name: Dispatch publish-firefox-development
-        uses: aurelien-baudet/workflow-dispatch@93e95b157d791ae7f42aef8f8a0d3d723eba1c31 # pin@v2
+        uses: aurelien-baudet/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7 # pin@v2
         with:
           workflow: publish-firefox-development
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -67,7 +69,7 @@ jobs:
       actions: read # To read the workflow path.
       id-token: write # To sign the provenance.
       contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
     with:
       base64-subjects: "${{ needs.build.outputs.hashes }}"
       upload-assets: true

.github/workflows/delay.yml

@@ -31,14 +31,13 @@ jobs:
       actions: write
     steps:
       - name: Start the next attempt
-        uses: aurelien-baudet/workflow-dispatch@93e95b157d791ae7f42aef8f8a0d3d723eba1c31 # pin@v2
+        uses: aurelien-baudet/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7 # pin@v2
         with:
           workflow: ${{ github.event.inputs.workflow }}
           token: ${{ secrets.GITHUB_TOKEN }}
           wait-for-completion: false
           inputs: |
             {
               "attemptNumber": "${{ github.event.inputs.attemptNumber }}",
-              "maxAttempts": "${{ github.event.inputs.maxAttempts }}",
-              "environment": "${{ github.event.inputs.environment }}"
+              "maxAttempts": "${{ github.event.inputs.maxAttempts }}"
             }