feat: overhaul (#167)

.gitattributes

@@ -1,4 +1,4 @@
-* text=auto
+* text=auto eol=lf
 
 dist/** -diff linguist-generated=true
 

.github/renovate.json5

@@ -1,6 +1,13 @@
 {
   $schema: 'https://docs.renovatebot.com/renovate-schema.json',
-  extends: ['github>bfra-me/renovate-config#v3.5.2', 'github>bfra-me/renovate-config:internal.json5#v3.5.2'],
+  extends: [
+    'github>bfra-me/renovate-config#v3',
+    'github>bfra-me/renovate-config:internal.json5#v3',
+    'github>sanity-io/renovate-config:semantic-commit-type',
+    'security:openssf-scorecard',
+    'npm:unpublishSafe',
+  ],
+  automergeType: 'pr',
   packageRules: [
     {
       matchPackageNames: ['@types/node', 'node', 'nodejs/node'],
@@ -10,15 +17,26 @@
       matchPackageNames: ['npm'],
       constraintsFiltering: 'strict',
     },
+    {
+      matchDepNames: ['python'],
+      allowedVersions: '<=3.12',
+    },
+    {
+      description: 'Enable SemVer digest pinning of @bfra-me GitHub actions, reusable workflows, and Renovate config presets.',
+      matchDatasources: ['github-tags'],
+      matchPackageNames: ['@bfra.me/**', 'bfra-me/**'],
+      updatePinnedDependencies: false,
+    },
+    {
+      description: 'Enable SemVer digest pinning of @bfra-me GitHub actions, reusable workflows, and Renovate config presets.',
+      matchDatasources: ['github-tags'],
+      matchPackageNames: ['@bfra.me/**', 'bfra-me/**'],
+      matchUpdateTypes: ['major'],
+      updatePinnedDependencies: true,
+    },
   ],
   postUpgradeTasks: {
-    commands: [
-      'npm install -g [email protected]',
-      'pnpm install --frozen-lockfile --ignore-scripts',
-      'git checkout -- .npmrc',
-      'pnpm run build',
-      'pnpm run format',
-    ],
+    commands: ['pnpm bootstrap', 'pnpm fix', 'pnpm build', 'pnpm format'],
     executionMode: 'branch',
   },
 }

.github/settings.yml

@@ -11,8 +11,8 @@ branches:
   - name: main
     protection:
       required_status_checks:
-        strict: false
-        contexts: ['Test', 'Release']
+        strict: true
+        contexts: ['Test', 'Release', 'Renovate / Renovate']
       enforce_admins: true
       required_pull_request_reviews: null
       restrictions: null

.github/workflows/app.yaml

@@ -1,9 +1,14 @@
 ---
 name: GitHub App
+
 'on':
   issues:
     types:
       - opened
+
+permissions:
+  contents: read
+
 jobs:
   issuesOpened:
     name: Issues opened

.github/workflows/ci.yaml → .github/workflows/main.yaml

@@ -1,11 +1,13 @@
 ---
-name: CI
+name: Main
 
 'on':
   push:
-    branches: [main, 'renovate/**']
+    branches: [main]
   pull_request:
-    types: [opened, reopened, synchronize]
+    branches: [main]
+    types: [opened, ready_for_review, reopened, synchronize]
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
@@ -39,11 +41,10 @@ jobs:
     steps:
       - id: get-workflow-access-token
         name: Get Workflow Access Token
-        uses: peter-murray/workflow-application-token-action@baa1ef2638c3d9e5967b7c8b86219f8fc919e1bb # v3.0.1
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
         with:
-          application_id: ${{ secrets.APPLICATION_ID }}
-          application_private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}
-          permissions: 'contents:write, issues:write, pull_requests:write'
+          app-id: ${{ secrets.APPLICATION_ID }}
+          private-key: ${{ secrets.APPLICATION_PRIVATE_KEY }}
       - name: Setup Git user
         run: |
           git config --global user.email '118100583+bfra-me[bot]@users.noreply.github.com'

.github/workflows/renovate.yaml

@@ -11,16 +11,21 @@ name: Renovate
     branches: ['**']
   workflow_dispatch:
     inputs:
-      print_config:
+      print-config:
         description: Log the fully-resolved Renovate config for each repository, plus fully-resolved presets.
         required: false
         type: boolean
         default: false
+  workflow_run:
+    workflows: ['Main']
+    branches: ['main']
+    types: ['completed']
 
 jobs:
   renovate:
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     name: Renovate
     secrets: inherit
-    uses: bfra-me/.github/.github/workflows/renovate.yaml@be966e38a1d29304e727870884a145b416efeb3d # v1.8.1
+    uses: bfra-me/.github/.github/workflows/renovate.yaml@v1
     with:
-      print_config: ${{ inputs.print_config || false }}
+      print_config: ${{ inputs.print-config || false }}

.github/workflows/update-repo-settings.yaml

@@ -13,4 +13,4 @@ jobs:
   update-repo-settings:
     name: Update Repo Settings
     secrets: inherit
-    uses: bfra-me/.github/.github/workflows/update-repo-settings.yaml@be966e38a1d29304e727870884a145b416efeb3d # v1.8.1
+    uses: bfra-me/.github/.github/workflows/update-repo-settings.yaml@v1

.tool-versions

@@ -0,0 +1,3 @@
+node 22.11.0
+pnpm 9.14.2
+python 3.12.7

.vscode/settings.json

@@ -1,6 +1,10 @@
 {
     "cSpell.words": ["bfra", "conventionalcommits", "probot"],
 
+    "eslint.options": {
+        "flags": ["unstable_ts_config"]
+    },
+
     "search.exclude": {
         "**/dist": true,
         "**/node_modules": true

app.js

@@ -1,8 +1,8 @@
 /**
  * @param {import('probot').Probot} app
  */
-module.exports = (app) => {
-  app.on('issues.opened', async (context) => {
-    return context.octokit.issues.createComment(context.issue({body: 'Hello, World!'}));
-  });
-};
+export default app => {
+  app.on('issues.opened', async context => {
+    return context.octokit.issues.createComment(context.issue({body: 'Hello, World!'}))
+  })
+}