Skip to content

PR for v0.1.2 #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ThomasJejkal wants to merge 26 commits into
base: main
Choose a base branch
from
Open

PR for v0.1.2 #293

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
c1eb6e0
chore(deps): update dependency eslint-plugin-storybook to v10.2.0 (#272)
renovate[bot] Jan 26, 2026
c5e225a
chore(deps): update dependency eslint-plugin-storybook to v10.2.3 (#273)
renovate[bot] Feb 2, 2026
cd9a37f
chore(deps): update dependency eslint-plugin-storybook to v10.2.7 (#274)
renovate[bot] Feb 9, 2026
5c61e7a
chore(deps): update dependency eslint-plugin-storybook to v10.2.8 (#275)
renovate[bot] Feb 12, 2026
a7118bd
chore(deps): update dependency eslint-plugin-storybook to v10.2.10 (#…
renovate[bot] Feb 23, 2026
f15a347
chore(deps): update dependency eslint-plugin-storybook to v10.2.13 (#…
renovate[bot] Mar 2, 2026
0bf0d82
chore(deps): update dependency eslint-plugin-storybook to v10.2.16 (#…
renovate[bot] Mar 9, 2026
e793a48
chore(deps): update dependency eslint-plugin-storybook to v10.2.19 (#…
renovate[bot] Mar 16, 2026
536a0b7
chore(deps): update dependency eslint-plugin-storybook to v10.3.1 (#282)
renovate[bot] Mar 23, 2026
450ff4f
chore(deps): update dependency eslint-plugin-storybook to v10.3.3 (#283)
renovate[bot] Mar 30, 2026
b687ceb
chore(deps): update dependency eslint-plugin-storybook to v10.3.4 (#286)
renovate[bot] Apr 6, 2026
44bf76e
chore(deps): update dependency eslint-plugin-storybook to v10.3.5 (#288)
renovate[bot] Apr 13, 2026
7aabe1f
chore(deps): update dependency eslint-plugin-storybook to v10.3.6 (#290)
renovate[bot] May 4, 2026
9727854
fix(deps): update dependency vite to v7.3.2 [security]
renovate[bot] May 12, 2026
b3becd3
chore(deps): update actions/deploy-pages action to v5
renovate[bot] May 12, 2026
4910f45
chore(deps): update actions/upload-pages-artifact action to v5
renovate[bot] May 12, 2026
79cdd59
chore(deps): update github artifact actions
renovate[bot] May 12, 2026
dfda3dd
chore(deps): update dependency puppeteer to v25
renovate[bot] May 18, 2026
92c97ff
chore(deps): update dependency eslint-plugin-storybook to v10.4.0 (#291)
renovate[bot] May 18, 2026
10d3aa0
Merge pull request #292 from kit-data-manager/renovate/major-puppeteer
ThomasJejkal May 18, 2026
45fb2c2
Merge pull request #289 from kit-data-manager/renovate/actions-upload…
ThomasJejkal May 18, 2026
2d2570d
Merge pull request #287 from kit-data-manager/renovate/npm-vite-vulne…
ThomasJejkal May 18, 2026
f9b033f
Merge pull request #284 from kit-data-manager/renovate/actions-deploy…
ThomasJejkal May 18, 2026
549e561
Merge pull request #278 from kit-data-manager/renovate/major-github-a…
ThomasJejkal May 18, 2026
3b91fe9
chore(deps): update all non-major dependencies to v10.4.6 (#294)
renovate[bot] Jun 19, 2026
07fddce
chore(deps): update dependency eslint-plugin-storybook to v10.5.0 (#298)
renovate[bot] Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/deploy-storybook.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,11 @@ jobs:
run: npm run build-storybook
working-directory: packages/stencil-library
- name: Upload Storybook to GitHub Pages
uses: actions/upload-pages-artifact@v4
uses: actions/upload-pages-artifact@v5
with:
path: "packages/stencil-library/storybook-static"

- name: Deploy to GitHub Pages
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@v5
Comment on lines +28 to +33

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin GitHub Actions to immutable commit SHAs instead of mutable tags.

@v5 tags are mutable and violate the repository’s unpinned-actions policy. Pin both actions to full commit SHAs to reduce supply-chain risk.

Suggested change 
-      - name: Upload Storybook to GitHub Pages
-        uses: actions/upload-pages-artifact@v5
+      - name: Upload Storybook to GitHub Pages
+        uses: actions/upload-pages-artifact@<full-length-commit-sha>
         with:
           path: "packages/stencil-library/storybook-static"

       - name: Deploy to GitHub Pages
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@<full-length-commit-sha>
         with:
           token: ${{ github.token }}
🧰 Tools
🪛 zizmor (1.25.2)

[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 33-33: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-storybook.yml around lines 28 - 33, The GitHub
Actions in the deploy-storybook.yml workflow file are using mutable version tags
(`@v5`) which violates the security policy. Replace both the
actions/upload-pages-artifact@v5 and actions/deploy-pages@v5 references with
their respective full commit SHAs to ensure immutable action versions and reduce
supply-chain risk.

Source: Linters/SAST tools

with:
token: ${{ github.token }}
6 changes: 3 additions & 3 deletions .github/workflows/real-npm-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
- run: npx lerna run build
# - run: npx lerna run test
- name: Upload build artifacts
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use SHA-pinned action references for artifact actions.

These uses entries are tag-pinned (@v7, @v8) and fail the unpinned-actions policy. Please pin each to a full commit SHA.

Suggested change 
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@<full-length-commit-sha>

-      - name: Download build artifacts
-        uses: actions/download-artifact@v8
+      - name: Download build artifacts
+        uses: actions/download-artifact@<full-length-commit-sha>

-      - name: Download build artifacts
-        uses: actions/download-artifact@v8
+      - name: Download build artifacts
+        uses: actions/download-artifact@<full-length-commit-sha>

Also applies to: 49-49, 79-79

🧰 Tools
🪛 zizmor (1.25.2)

[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/real-npm-publish.yml at line 30, Replace all tag-pinned
action references with full commit SHA pins in the workflow file. Specifically,
update the `uses: actions/upload-artifact@v7` entry at line 30 and the similar
tag-pinned upload-artifact entries at lines 49 and 79 by replacing the version
tags (like `@v7`, `@v8`) with their corresponding full commit SHA values to comply
with the unpinned-actions policy.

Source: Linters/SAST tools

with:
name: build-output
path: packages/
Expand All @@ -46,7 +46,7 @@ jobs:
cache: 'npm'
registry-url: https://npm.pkg.github.com/
- name: Download build artifacts
uses: actions/download-artifact@v7
uses: actions/download-artifact@v8
with:
name: build-output
path: packages/
Expand Down Expand Up @@ -76,7 +76,7 @@ jobs:
cache: 'npm'
registry-url: https://registry.npmjs.org/
- name: Download build artifacts
uses: actions/download-artifact@v7
uses: actions/download-artifact@v8
with:
name: build-output
path: packages/
Expand Down
Loading