feat(vue-plugin): add security/markdown-it-unsanitized-html rule #175
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| releases_created: ${{ steps.release.outputs.releases_created }} | |
| steps: | |
| - name: Release Please | |
| id: release | |
| uses: googleapis/release-please-action@v5 | |
| with: | |
| token: ${{ secrets.RELEASE_PAT }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| publish: | |
| needs: release-please | |
| if: ${{ needs.release-please.outputs.releases_created == 'true' || github.event_name == 'workflow_dispatch' }} | |
| runs-on: ubuntu-latest | |
| environment: npm | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: '.nvmrc' | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build | |
| run: pnpm run build | |
| - name: Pack tarballs (rewrites workspace:^ to real versions) | |
| run: | | |
| rm -rf .release && mkdir -p .release | |
| # npm set is derived from disk (every package with private !== true) so it | |
| # can never drift from the package list again — a hardcoded list here is | |
| # exactly why the eslint plugins were version-bumped but never published. | |
| for dir in $(node -e "const f=require('node:fs');for(const p of f.readdirSync('packages')){const j='packages/'+p+'/package.json';if(f.existsSync(j)&&JSON.parse(f.readFileSync(j,'utf8')).private!==true)console.log('packages/'+p)}"); do | |
| (cd "$dir" && pnpm pack --pack-destination "$GITHUB_WORKSPACE/.release") | |
| done | |
| - name: Publish to npm with provenance | |
| run: | | |
| failed="" | |
| for tgz in .release/*.tgz; do | |
| name=$(tar -xzOf "$tgz" package/package.json | grep '"name"' | head -1 | sed -E 's/.*"name" *: *"([^"]+)".*/\1/') | |
| version=$(tar -xzOf "$tgz" package/package.json | grep '"version"' | head -1 | sed -E 's/.*"version" *: *"([^"]+)".*/\1/') | |
| if [[ "$version" == *-* ]]; then | |
| tag="${version#*-}" | |
| tag="${tag%%.*}" | |
| else | |
| tag="latest" | |
| fi | |
| if npm view "$name@$version" version >/dev/null 2>&1; then | |
| echo "Skipping $name@$version (already published)" | |
| continue | |
| fi | |
| echo "Publishing $name@$version under dist-tag: $tag" | |
| if ! npm publish "$tgz" --provenance --access public --ignore-scripts --tag "$tag"; then | |
| echo "::error::npm publish failed for $name@$version" | |
| failed="$failed $name@$version" | |
| fi | |
| done | |
| if [[ -n "$failed" ]]; then | |
| echo "::error::npm publish failed for:$failed" | |
| exit 1 | |
| fi | |
| - name: Sync JSR versions | |
| run: node scripts/bump-jsr-version.ts | |
| - name: Publish to JSR | |
| run: | | |
| failed="" | |
| # JSR set is every package that ships a jsr.json. This lets npm-only | |
| # packages (e.g. doctor-language-server, whose vscode-* deps are | |
| # npm-only) opt out simply by not having a jsr.json — no hardcoded list. | |
| for dir in $(node -e "const f=require('node:fs');for(const p of f.readdirSync('packages')){if(f.existsSync('packages/'+p+'/jsr.json'))console.log('packages/'+p)}"); do | |
| name=$(node -p "require('./$dir/package.json').name") | |
| version=$(node -p "require('./$dir/package.json').version") | |
| if curl -fsS "https://jsr.io/$name/$version/package.json" >/dev/null 2>&1; then | |
| echo "Skipping $name@$version on JSR (already published)" | |
| continue | |
| fi | |
| if ! (cd "$dir" && pnpm dlx jsr publish --allow-dirty --allow-slow-types); then | |
| echo "::error::jsr publish failed for $name@$version" | |
| failed="$failed $name@$version" | |
| fi | |
| done | |
| if [[ -n "$failed" ]]; then | |
| echo "::error::jsr publish failed for:$failed" | |
| exit 1 | |
| fi |