refactor: merge

Author: mfranzke

.config/.lintstagedrc.json

@@ -1,5 +1,7 @@
 {
-	"*.md": "markdownlint -c .markdown-lint.yml",
-	"*.{css,scss}": "stylelint --fix",
+	"*.md": "markdownlint -c .markdown-lint.yml --fix",
+	".stylelintrc.*": "stylelint --validate --allow-empty-input",
+	"stylelint.config.*": "stylelint --validate --allow-empty-input",
+	"*.{css,scss}": "stylelint --fix --allow-empty-input",
 	"*.{js,ts,tsx,jsx,mjs,cjs}": "xo --fix"
 }

.github/actions/download-tar-artifact/action.yml

@@ -12,7 +12,7 @@ runs:
   using: "composite"
   steps:
     - name: ⬇ Download build
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: ${{ inputs.name }}
 

.github/actions/extract-branch/action.yml

@@ -9,7 +9,7 @@ runs:
   using: "composite"
   steps:
     - name: ⏬ Get branch name
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       id: get-branch-name
       with:
         result-encoding: string

.github/actions/npm-cache/action.yml

@@ -8,15 +8,15 @@ runs:
       # https://github.com/actions/setup-node
       uses: actions/setup-node@v4
       with:
-        node-version: 20
+        node-version-file: ".nvmrc"
 
     - name: Display node and npm version
       shell: bash
       run: |
         node --version
         npm --version
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       id: "npm-cache" # use this to check for `cache-hit` ==> if: steps.npm-cache.outputs.cache-hit != 'true'
       with:
         path: "./node_modules"

.github/actions/upload-tar-artifact/action.yml

@@ -16,7 +16,7 @@ runs:
       shell: bash
 
     - name: ⬆ Upload build
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.name }}

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
       timezone: "Europe/Berlin"
     pull-request-branch-name:
       separator: "-"
+    cooldown:
+      default-days: 3
 
   # Daily: Check minor and patch updates
   - package-ecosystem: "npm"
@@ -22,7 +24,17 @@ updates:
       separator: "-"
     # https://github.com/dependabot/dependabot-core/issues/5226#issuecomment-1179434437
     versioning-strategy: increase
+    cooldown:
+      default-days: 3
     groups:
+      patch-dependencies:
+        update-types:
+          - "patch"
+        patterns:
+          - "*"
       commitlint:
         patterns:
           - "@commitlint*"
+      babel:
+        patterns:
+          - "@babel*"

.github/scripts/publish-npm.sh

@@ -35,12 +35,11 @@ do
     echo "🔑 Authenticated with GITHUB"
   elif [[ $REGISTRY == 'NPM' ]]; then
     npm config set @db-ui:registry https://registry.npmjs.org/
-    npm set //registry.npmjs.org/:_authToken "$NPM_TOKEN"
     echo "🔑 Authenticated with NPM"
   else
     echo "Could not authenticate with $REGISTRY"
     exit 1
   fi
   # https://docs.npmjs.com/generating-provenance-statements#example-github-actions-workflow
-  npm publish --tag "$TAG" db-ui-core-"$VALID_SEMVER_VERSION".tgz --provenance
+  npm publish --tag "$TAG" db-ui-core-"$VALID_SEMVER_VERSION".tgz
 done

.github/workflows/00-init.yml

@@ -12,7 +12,7 @@ jobs:
         uses: styfle/cancel-workflow-action@0.12.1
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🔄 Init Cache Default
         uses: ./.github/actions/npm-cache

.github/workflows/00-scan-secrets.yml

@@ -8,21 +8,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ⬇ Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: ↔ Extract branch name
         uses: ./.github/actions/extract-branch
         id: extract_branch
 
+      # https://github.com/marketplace/actions/trufflehog-oss#advanced-usage-scan-entire-branch
       - name: 🐷 TruffleHog OSS
         uses: trufflesecurity/trufflehog@main
         if: ${{ github.event.pull_request != null }} # only scan on pull-requests
         with:
-          path: ./
-          base: ${{ steps.extract_branch.outputs.branch-name }}
-          head: HEAD
+          # Setting base to an empty string scans the entire branch, per TruffleHog OSS advanced usage:
+          # https://github.com/marketplace/actions/trufflehog-oss#advanced-usage-scan-entire-branch
+          base: ""
+          head: ${{ github.ref_name }}
+          extra_args: --results=verified,unknown
 
       - name: 💀 Killing me softly
         uses: ./.github/actions/cancel-workflow

.github/workflows/01-build.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🔄 Init Cache
         uses: ./.github/actions/npm-cache