Merge pull request #174 from uswds/develop

Sync develop branch with main

Author: annepetersen

.browserslistrc

@@ -1,5 +1,4 @@
 # Supported browsers
 > 2%
 last 2 versions
-IE 11
 not dead

.github/workflows/add-to-project.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin v6.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # pin v4.35.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +53,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # pin v4.35.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -67,4 +67,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # pin v4.35.1

.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: Publish Package to npmjs
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # pin v6.3.0
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Update npm version
+        run: npm install -g npm@latest # OIDC requires npm v11.5.1 or later
+      - run: npm ci
+      - name: Check for vulnerabilities
+        run: |
+          # Capture audit result (ignore exit code with || true)
+          AUDIT_RESULT=$(npm audit --json || true)
+          CRITICAL=$(echo $AUDIT_RESULT | jq '.metadata.vulnerabilities.critical // 0')
+          HIGH=$(echo $AUDIT_RESULT | jq '.metadata.vulnerabilities.high // 0')
+          TOTAL=$(echo $AUDIT_RESULT | jq '.metadata.vulnerabilities.total // 0')
+          
+          if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
+            echo "Found $CRITICAL critical and $HIGH high severity vulnerabilities"
+            echo "Please review and fix these vulnerabilities"
+            exit 1
+          fi
+          echo "No critical or high severity vulnerabilities found. Total vulnerabilities: $TOTAL"
+      - name: Pack package
+        run: npm pack
+      - name: Upload pack artifact
+        if: ${{ !env.ACT }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # pin v7.0.0
+        with:
+          name: npm-pack
+          path: "*.tgz"
+      - run: npm publish
+        if: ${{ !env.ACT }}