From 79fc531b30c546124b908c9852d70d08c7549f62 Mon Sep 17 00:00:00 2001 From: Jakob Guddas Date: Fri, 7 Aug 2026 11:31:26 +0200 Subject: [PATCH 1/4] ci(security): Pin sha actions (#4678) * cd: pin actions * fix: remove trailing whitespace in release.yml to pass prettier lint Co-authored-by: ericfennis <11825403+ericfennis@users.noreply.github.com> * Format code --------- Co-authored-by: Eric Fennis Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: ericfennis <11825403+ericfennis@users.noreply.github.com> --- .github/workflows/angular.yml | 12 ++++---- .github/workflows/ci.yml | 10 +++---- .../close-issue-with-banned-phrases.yml | 2 +- .github/workflows/close-stale-prs.yml | 2 +- .github/workflows/comment-icon-preview.yml | 6 ++-- .github/workflows/icons.yml | 12 ++++---- .github/workflows/labeler.yml | 4 +-- .github/workflows/lint-code.yml | 6 ++-- .github/workflows/lint-pr-title.yml | 2 +- .github/workflows/linting-icons.yml | 16 +++++----- .github/workflows/lucide-astro.yml | 12 ++++---- .github/workflows/lucide-font.yml | 8 ++--- .github/workflows/lucide-lab.yml | 6 ++-- .github/workflows/lucide-preact.yml | 6 ++-- .github/workflows/lucide-react-native.yml | 12 ++++---- .github/workflows/lucide-react.yml | 12 ++++---- .github/workflows/lucide-shared.yml | 6 ++-- .github/workflows/lucide-solid.yml | 12 ++++---- .github/workflows/lucide-static.yml | 6 ++-- .github/workflows/lucide-svelte-5.yml | 18 +++++------ .github/workflows/lucide-vue.yml | 12 ++++---- .github/workflows/lucide.yml | 12 ++++---- .../workflows/pull-request-icon-preview.yml | 10 +++---- .../pull-request-metadata-suggestions.yml | 6 ++-- .github/workflows/release.yml | 30 ++++++++++--------- .github/workflows/repo-journal.yml | 2 +- .github/workflows/request-review.yml | 4 +-- 27 files changed, 124 insertions(+), 122 deletions(-) diff --git a/.github/workflows/angular.yml b/.github/workflows/angular.yml index 76128e2da..764d077ec 100644 --- a/.github/workflows/angular.yml +++ b/.github/workflows/angular.yml @@ -14,9 +14,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -30,9 +30,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 00f49c320..c410bd739 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,7 +36,7 @@ jobs: outputs: RELEASE_ENVIRONMENT: ${{ steps.environment.outputs.RELEASE_ENVIRONMENT }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Fetch tags run: git fetch --all --tags @@ -65,9 +65,9 @@ jobs: outputs: VERSION: ${{ steps.new-version.outputs.NEW_VERSION }} steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -102,7 +102,7 @@ jobs: echo '${{ steps.change-log.outputs.CHANGE_LOG }}' - name: Create Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ steps.new-version.outputs.NEW_VERSION }} name: Version ${{ steps.new-version.outputs.NEW_VERSION }} diff --git a/.github/workflows/close-issue-with-banned-phrases.yml b/.github/workflows/close-issue-with-banned-phrases.yml index 2fb1dff84..5fb35811d 100644 --- a/.github/workflows/close-issue-with-banned-phrases.yml +++ b/.github/workflows/close-issue-with-banned-phrases.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Load stopwords from JSON & check issue title & body if: contains(github.event.issue.labels.*.name, '🙌 icon request') diff --git a/.github/workflows/close-stale-prs.yml b/.github/workflows/close-stale-prs.yml index 0cdb2f8d1..7704f341c 100644 --- a/.github/workflows/close-stale-prs.yml +++ b/.github/workflows/close-stale-prs.yml @@ -12,7 +12,7 @@ jobs: permissions: pull-requests: write steps: - - uses: actions/stale@v11 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-pr-message: This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 5 days. diff --git a/.github/workflows/comment-icon-preview.yml b/.github/workflows/comment-icon-preview.yml index e3b5e4d04..b9f813e64 100644 --- a/.github/workflows/comment-icon-preview.yml +++ b/.github/workflows/comment-icon-preview.yml @@ -21,7 +21,7 @@ jobs: github.event.workflow_run.conclusion == 'success' steps: - name: 'Download artifact' - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({ @@ -49,7 +49,7 @@ jobs: id: pr-number - name: Find Comment - uses: peter-evans/find-comment@v4 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 id: pr-comment with: issue-number: ${{ steps.pr-number.outputs.number }} @@ -57,7 +57,7 @@ jobs: body-includes: Added or changed icons - name: Create or update comment - uses: peter-evans/create-or-update-comment@v5 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 with: comment-id: ${{ steps.pr-comment.outputs.comment-id }} issue-number: ${{ steps.pr-number.outputs.number }} diff --git a/.github/workflows/icons.yml b/.github/workflows/icons.yml index 4c246a48c..e4d53a6f9 100644 --- a/.github/workflows/icons.yml +++ b/.github/workflows/icons.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -32,9 +32,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 9c84fe711..75de3b3bb 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -12,5 +12,5 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/labeler@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 diff --git a/.github/workflows/lint-code.yml b/.github/workflows/lint-code.yml index 297831c50..edaec6611 100644 --- a/.github/workflows/lint-code.yml +++ b/.github/workflows/lint-code.yml @@ -10,9 +10,9 @@ jobs: lint-code: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml index ea29078b4..ef9abcf61 100644 --- a/.github/workflows/lint-pr-title.yml +++ b/.github/workflows/lint-pr-title.yml @@ -16,7 +16,7 @@ jobs: name: PR Title Lint runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@v6 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/linting-icons.yml b/.github/workflows/linting-icons.yml index 9204411ca..0f69ba490 100644 --- a/.github/workflows/linting-icons.yml +++ b/.github/workflows/linting-icons.yml @@ -19,9 +19,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -31,7 +31,7 @@ jobs: - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 with: files: | icons/* @@ -48,9 +48,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -67,6 +67,6 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check Uniqueness of Aliases run: "! cat <(printf \"%s\\n\" icons/*.json | while read -r name; do basename \"$name\" .json; done) <(jq -cr 'select(.aliases) | .aliases[] | if type==\"string\" then . else .name end' icons/*.json) | sort | uniq -c | grep -ve '^\\s*1 '" diff --git a/.github/workflows/lucide-astro.yml b/.github/workflows/lucide-astro.yml index d76be8ccd..47a1fc8dd 100644 --- a/.github/workflows/lucide-astro.yml +++ b/.github/workflows/lucide-astro.yml @@ -18,9 +18,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: 'package.json' cache: 'pnpm' @@ -34,9 +34,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: 'package.json' cache: 'pnpm' diff --git a/.github/workflows/lucide-font.yml b/.github/workflows/lucide-font.yml index 42e5c2400..7548723cb 100644 --- a/.github/workflows/lucide-font.yml +++ b/.github/workflows/lucide-font.yml @@ -16,9 +16,9 @@ jobs: lucide-font: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -33,7 +33,7 @@ jobs: run: pnpm build:font - name: 'Upload to Artifacts' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: lucide-font path: lucide-font diff --git a/.github/workflows/lucide-lab.yml b/.github/workflows/lucide-lab.yml index 23500346d..323cb3595 100644 --- a/.github/workflows/lucide-lab.yml +++ b/.github/workflows/lucide-lab.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-preact.yml b/.github/workflows/lucide-preact.yml index 26c5796f5..f842c1b47 100644 --- a/.github/workflows/lucide-preact.yml +++ b/.github/workflows/lucide-preact.yml @@ -19,9 +19,9 @@ jobs: lucide-preact: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-react-native.yml b/.github/workflows/lucide-react-native.yml index 1243b5bf6..6f8d83079 100644 --- a/.github/workflows/lucide-react-native.yml +++ b/.github/workflows/lucide-react-native.yml @@ -19,9 +19,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -35,9 +35,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-react.yml b/.github/workflows/lucide-react.yml index 3c5bf64a6..7d00a1ba5 100644 --- a/.github/workflows/lucide-react.yml +++ b/.github/workflows/lucide-react.yml @@ -20,9 +20,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -36,9 +36,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-shared.yml b/.github/workflows/lucide-shared.yml index 581d4a20a..efea0dc77 100644 --- a/.github/workflows/lucide-shared.yml +++ b/.github/workflows/lucide-shared.yml @@ -16,9 +16,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-solid.yml b/.github/workflows/lucide-solid.yml index ec0f09905..d78602a35 100644 --- a/.github/workflows/lucide-solid.yml +++ b/.github/workflows/lucide-solid.yml @@ -19,9 +19,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -35,9 +35,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-static.yml b/.github/workflows/lucide-static.yml index a6c5080d5..fee24bf72 100644 --- a/.github/workflows/lucide-static.yml +++ b/.github/workflows/lucide-static.yml @@ -14,9 +14,9 @@ jobs: lucide-static: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-svelte-5.yml b/.github/workflows/lucide-svelte-5.yml index 8f96e85b6..4f48fcf19 100644 --- a/.github/workflows/lucide-svelte-5.yml +++ b/.github/workflows/lucide-svelte-5.yml @@ -19,9 +19,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -35,9 +35,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -51,9 +51,9 @@ jobs: typecheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-vue.yml b/.github/workflows/lucide-vue.yml index 771b36280..e4e4ee9b6 100644 --- a/.github/workflows/lucide-vue.yml +++ b/.github/workflows/lucide-vue.yml @@ -19,9 +19,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -35,9 +35,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide.yml b/.github/workflows/lucide.yml index cccbb8407..844d2647f 100644 --- a/.github/workflows/lucide.yml +++ b/.github/workflows/lucide.yml @@ -18,9 +18,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -34,9 +34,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/pull-request-icon-preview.yml b/.github/workflows/pull-request-icon-preview.yml index 28c37ed4a..62112e892 100644 --- a/.github/workflows/pull-request-icon-preview.yml +++ b/.github/workflows/pull-request-icon-preview.yml @@ -17,18 +17,18 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: 'package.json' - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 with: files: icons/*.svg - - uses: actions/setup-node@v7.0.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - name: Install svgson for code preview (safer and faster than installing all deps) run: npm install svgson@5.3.1 --force @@ -43,7 +43,7 @@ jobs: env: CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }} - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: pr_number path: pr/ diff --git a/.github/workflows/pull-request-metadata-suggestions.yml b/.github/workflows/pull-request-metadata-suggestions.yml index a94b29e7f..cc1586da7 100644 --- a/.github/workflows/pull-request-metadata-suggestions.yml +++ b/.github/workflows/pull-request-metadata-suggestions.yml @@ -19,11 +19,11 @@ jobs: steps: # We checkout the main branch of main repository for security reasons. # This is to prevent the workflow from running on a forked repository. - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: lucide-icons/lucide - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 214a845e8..e200da21f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,9 +57,9 @@ jobs: '@lucide/vue', ] steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -90,13 +90,14 @@ jobs: contents: read steps: - - uses: actions/checkout@v7 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: lucide-font path: lucide-font - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -125,9 +126,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -144,7 +145,7 @@ jobs: BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }} - name: 'Upload to Artifacts' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: lucide-font path: lucide-font @@ -156,18 +157,19 @@ jobs: permissions: contents: write # Required to upload the release assets steps: - - uses: actions/checkout@v7 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: lucide-font path: lucide-font + - name: Zip font and icons run: | zip -r lucide-font-${{ needs.prepare.outputs.VERSION }}.zip lucide-font zip -r lucide-icons-${{ needs.prepare.outputs.VERSION }}.zip icons - name: Release zip and fonts - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ needs.prepare.outputs.VERSION }} diff --git a/.github/workflows/repo-journal.yml b/.github/workflows/repo-journal.yml index 2be78d817..b457fe47f 100644 --- a/.github/workflows/repo-journal.yml +++ b/.github/workflows/repo-journal.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Set up Node.js environment - uses: actions/setup-node@v7.0.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 diff --git a/.github/workflows/request-review.yml b/.github/workflows/request-review.yml index 3f87de0d1..3139435f8 100644 --- a/.github/workflows/request-review.yml +++ b/.github/workflows/request-review.yml @@ -15,13 +15,13 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: refs/pull/${{ github.event.pull_request.number }}/merge - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v47 + uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 with: files: icons/*.svg - run: | From 249af14dc6c09d846fada19455ac074ed29ee407 Mon Sep 17 00:00:00 2001 From: Karsa Date: Fri, 7 Aug 2026 11:36:43 +0200 Subject: [PATCH 2/4] feat(icons): added `broom` icon (#4683) * Added icons/broom.svg * Added icons/broom.json * Added icons/broom-sparkles.svg * Added icons/broom-sparkles.json * feat(icons): move broom from lab to icons, redesign & add metadata --- icons/broom-sparkles.json | 44 +++++++++++++++++++++++++++++++++++++++ icons/broom-sparkles.svg | 22 ++++++++++++++++++++ icons/broom.json | 38 +++++++++++++++++++++++++++++++++ icons/broom.svg | 16 ++++++++++++++ lab/broom.json | 19 ----------------- lab/broom.svg | 16 -------------- 6 files changed, 120 insertions(+), 35 deletions(-) create mode 100644 icons/broom-sparkles.json create mode 100644 icons/broom-sparkles.svg create mode 100644 icons/broom.json create mode 100644 icons/broom.svg delete mode 100644 lab/broom.json delete mode 100644 lab/broom.svg diff --git a/icons/broom-sparkles.json b/icons/broom-sparkles.json new file mode 100644 index 000000000..7937e7da1 --- /dev/null +++ b/icons/broom-sparkles.json @@ -0,0 +1,44 @@ +{ + "$schema": "../icon.schema.json", + "contributors": [ + "danielbayley", + "karsa-mistmere" + ], + "use-cases": [ + "representing AI-assisted sweeping or cleaning automation", + "indicating spotless or freshly cleaned floors", + "showing magical cleanup actions in smart home apps", + "representing enchanted broom or Halloween themes" + ], + "tags": [ + "broomstick", + "brush", + "sweep", + "sweeping", + "floor", + "cleaning", + "ai", + "magic", + "sparkle", + "smart", + "automation", + "housekeeping", + "chores", + "tidy", + "spotless", + "pristine", + "dust", + "debris", + "bristles", + "handle", + "janitor", + "maintenance", + "witch", + "halloween" + ], + "categories": [ + "tools", + "home", + "gaming" + ] +} diff --git a/icons/broom-sparkles.svg b/icons/broom-sparkles.svg new file mode 100644 index 000000000..7becbfa6d --- /dev/null +++ b/icons/broom-sparkles.svg @@ -0,0 +1,22 @@ + + + + + + + + + + + + diff --git a/icons/broom.json b/icons/broom.json new file mode 100644 index 000000000..eb9cf60a5 --- /dev/null +++ b/icons/broom.json @@ -0,0 +1,38 @@ +{ + "$schema": "../icon.schema.json", + "contributors": [ + "danielbayley", + "karsa-mistmere" + ], + "use-cases": [ + "representing sweeping and floor cleaning tasks", + "indicating housekeeping or janitorial services", + "showing cleaning supplies in home maintenance apps", + "representing witchcraft or Halloween themes" + ], + "tags": [ + "broomstick", + "brush", + "sweep", + "sweeping", + "floor", + "cleaning", + "housekeeping", + "chores", + "tidy", + "spotless", + "dust", + "debris", + "bristles", + "handle", + "janitor", + "maintenance", + "witch", + "halloween" + ], + "categories": [ + "tools", + "home", + "gaming" + ] +} diff --git a/icons/broom.svg b/icons/broom.svg new file mode 100644 index 000000000..75480a553 --- /dev/null +++ b/icons/broom.svg @@ -0,0 +1,16 @@ + + + + + + diff --git a/lab/broom.json b/lab/broom.json deleted file mode 100644 index 3c6655bc2..000000000 --- a/lab/broom.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "$schema": "../icon.schema.json", - "contributors": [ - "danielbayley" - ], - "tags": [ - "broomstick", - "brush", - "sweep", - "floor", - "cleaning", - "witch", - "halloween" - ], - "categories": [ - "tools", - "home" - ] -} diff --git a/lab/broom.svg b/lab/broom.svg deleted file mode 100644 index 814be7559..000000000 --- a/lab/broom.svg +++ /dev/null @@ -1,16 +0,0 @@ - - - - - - From ea29af9ae80c7fd9f5d673ac3f382a21a3f09d0c Mon Sep 17 00:00:00 2001 From: Lazizbek Ergashev Date: Fri, 7 Aug 2026 14:40:53 +0500 Subject: [PATCH 3/4] feat(icons): added `mail-badge` icon (#4638) * feat(icons): added `mail-badge` icon * feat(icons): apply suggested tags/categories/use-cases for mail-badge * Updated icons/mail-badge.json * Updated icons/mail-badge.json --- icons/mail-badge.json | 37 +++++++++++++++++++++++++++++++++++++ icons/mail-badge.svg | 16 ++++++++++++++++ 2 files changed, 53 insertions(+) create mode 100644 icons/mail-badge.json create mode 100644 icons/mail-badge.svg diff --git a/icons/mail-badge.json b/icons/mail-badge.json new file mode 100644 index 000000000..ce403f211 --- /dev/null +++ b/icons/mail-badge.json @@ -0,0 +1,37 @@ +{ + "$schema": "../icon.schema.json", + "contributors": [ + "rrod497", + "colebemis", + "karsa-mistmere", + "ericfennis", + "jguddas", + "danielbayley" + ], + "use-cases": [ + "indicating certified or registered email", + "marking messages with proof of delivery", + "marking a message as signed or sealed", + "labeling official or legal correspondence" + ], + "tags": [ + "email", + "message", + "letter", + "certified", + "registered", + "seal", + "stamp", + "verified", + "envelope", + "rosette", + "signed", + "official", + "delivery" + ], + "categories": [ + "mail", + "communication", + "security" + ] +} diff --git a/icons/mail-badge.svg b/icons/mail-badge.svg new file mode 100644 index 000000000..f38b0dc0d --- /dev/null +++ b/icons/mail-badge.svg @@ -0,0 +1,16 @@ + + + + + + From 113a3b1a3bda9a31d30f4b056cd434ce9462828e Mon Sep 17 00:00:00 2001 From: Samuel Alake <58840187+samuelalake@users.noreply.github.com> Date: Fri, 7 Aug 2026 03:28:36 -0700 Subject: [PATCH 4/4] feat(icons): add angle (#4545) * feat(icons): add angle Adds an angle icon: two rays meeting at a vertex with an arc marking the angle between them. There is no icon for an angle or degree measurement in the set today. The arc is r=10 centred on the vertex at (3,21), so its endpoints land exactly on the two rays rather than floating near them. The rays reuse the 2px rounded corner used throughout the set. * Apply suggestion from @github-actions[bot] Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Apply suggestion from @github-actions[bot] Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --------- Co-authored-by: Eric Fennis Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- icons/angle.json | 34 ++++++++++++++++++++++++++++++++++ icons/angle.svg | 14 ++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 icons/angle.json create mode 100644 icons/angle.svg diff --git a/icons/angle.json b/icons/angle.json new file mode 100644 index 000000000..84bf9fdb2 --- /dev/null +++ b/icons/angle.json @@ -0,0 +1,34 @@ +{ + "$schema": "../icon.schema.json", + "contributors": [ + "samuelalake" + ], + "use-cases": [ + "rotation input in a design inspector", + "measurement tool in cad software", + "dimensioning in technical drawings", + "labeling angles in geometry exercises", + "displaying degrees for rotation controls" + ], + "tags": [ + "angle", + "degree", + "corner", + "geometry", + "measure", + "math", + "rotate", + "vertex", + "slope", + "protractor", + "measurement", + "dimension", + "arc", + "drafting", + "cad" + ], + "categories": [ + "math", + "design" + ] +} diff --git a/icons/angle.svg b/icons/angle.svg new file mode 100644 index 000000000..a188199e6 --- /dev/null +++ b/icons/angle.svg @@ -0,0 +1,14 @@ + + + +