Merge branch 'wevm:main' into op-stack/add-operator-fee

Author: Kemperino

.changeset/fair-elephants-dream.md

@@ -13,11 +13,16 @@ jobs:
     name: Verify
     uses: ./.github/workflows/verify.yml
     secrets: inherit
+    permissions:
+      contents: read
 
   changesets:
     name: Create version pull request
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write 
 
     steps:
       - name: Clone repository
@@ -67,18 +72,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Publish Prerelease
-        if: steps.changesets.outputs.published != 'true'
-        continue-on-error: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git reset --hard origin/main
-          pnpm clean
-          pnpm changeset version --no-git-tag --snapshot canary
-          pnpm changeset:prepublish
-          pnpm changeset publish --no-git-tag --snapshot canary --tag canary
-
   jsr:
     name: JSR
     needs: verify
@@ -105,4 +98,6 @@ jobs:
     needs: changesets
     uses: ./.github/workflows/deploy-docs.yml
     secrets: inherit
+    permissions:
+      contents: read
     if: needs.changesets.outputs.published == 'true'

.github/workflows/changesets.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout

.github/workflows/deploy-docs.yml

@@ -8,6 +8,8 @@ jobs:
   issue-labeled:
     if: ${{ github.repository_owner == 'wevm' }}
     uses: wevm/actions/.github/workflows/issue-labeled.yml@main
+    permissions:
+      contents: read
     with:
       needs-reproduction-body: |
         Hello @${{ github.event.issue.user.login }}. 

.github/workflows/issue-labeled.yml

@@ -8,6 +8,8 @@ jobs:
   lock-issue:
     if: ${{ github.repository_owner == 'wevm' }}
     uses: wevm/actions/.github/workflows/lock-issue.yml@main
+    permissions:
+      contents: read
     with:
       issue-comment: |
         This issue has been locked since it has been closed for more than 14 days.

.github/workflows/lock-issue.yml

@@ -0,0 +1,24 @@
+name: Prepublish
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          submodules: 'recursive'
+
+      - name: Install dependencies
+        uses: ./.github/actions/install-dependencies
+
+      - name: Prepublish
+        run: |
+          cd src && pnpm version prerelease --preid $(git rev-parse --short=7 HEAD) && cd ..
+          pnpm changeset:prepublish
+          pnpx pkg-pr-new publish --pnpm --compact './src'

.github/workflows/prepublish.yml

@@ -11,11 +11,37 @@ jobs:
     name: Verify
     uses: ./.github/workflows/verify.yml
     secrets: inherit
+    permissions:
+      contents: read
+
+  publish:
+    name: Publish Prerelease
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v4
+        with: 
+          submodules: 'recursive'
+
+      - name: Install dependencies
+        uses: ./.github/actions/install-dependencies
+
+      - name: Publish Prerelease
+        run: |
+          pnpm clean
+          pnpm changeset:prepublish
+          pnpx pkg-pr-new publish --pnpm --compact './src'
 
   size:
     name: Size
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
 
     steps:
       - name: Clone repository

.github/workflows/pull-request.yml

@@ -8,6 +8,8 @@ jobs:
     name: Check
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
 
     steps:
       - name: Clone repository
@@ -18,6 +20,9 @@ jobs:
       - name: Install dependencies
         uses: ./.github/actions/install-dependencies
 
+      - name: Audit dependencies
+        run: pnpm audit
+
       - name: Check repo
         run: pnpm check:repo
 
@@ -29,6 +34,8 @@ jobs:
     needs: check
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
 
     steps:
       - name: Clone repository
@@ -55,10 +62,12 @@ jobs:
     name: Types
     needs: check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 5
     strategy:
       matrix:
-        version: ['5.5.2', '5.6.2', '5.7.2', '5.8.2', 'latest']
+        version: ['5.7.2', '5.8.2', '5.9.2', 'latest']
 
     steps:
       - name: Clone repository
@@ -86,6 +95,8 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
     strategy:
       max-parallel: 3
       matrix:
@@ -130,6 +141,8 @@ jobs:
   test-envs:
     name: Test Environments
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         type: ['bun', 'node-22', 'node-latest', 'next', 'tsc', 'vite']
@@ -176,7 +189,7 @@ jobs:
 
       - name: Install Playwright Browsers
         if: ${{ matrix.runtime == 'next' || matrix.runtime == 'vite' }}
-        run: pnpx playwright@1.49.1 install --with-deps
+        run: pnpx playwright@1.55.1 install --with-deps
 
       - name: Build
         run: pnpm build
@@ -190,6 +203,9 @@ jobs:
   vectors:
     name: Vectors
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
     steps:
       - name: Clone repository
         uses: actions/checkout@v4

.github/workflows/verify.yml

@@ -1,5 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
+/// <reference path="./.next/types/routes.d.ts" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

environments/next/next-env.d.ts

@@ -10,13 +10,13 @@
     "test": "playwright test"
   },
   "dependencies": {
-    "next": "^15",
+    "next": "^15.5.4",
     "react": "^19",
     "react-dom": "^19",
     "viem": "file:../../src/"
   },
   "devDependencies": {
-    "@playwright/test": "1.49.1",
+    "@playwright/test": "1.55.1",
     "@types/node": "^20.8.3",
     "@types/react": "^19",
     "@types/react-dom": "^19",