* refactor(ci): move icon preview markup into a composite action
Move generateChangedIconsCommentMarkup.mts into .github/actions/icon-preview
as its own pnpm workspace package, following the suggest-metadata action.
svgson and @lucide/helpers are now real dependencies installed with a
filtered pnpm install, replacing the ad-hoc `npm install svgson --force`.
Paths are resolved from the repo root relative to the script, so it also
works through `pnpm --filter @lucide/icon-preview-action start`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ci): skip icon preview comment when no icons changed
When a pull request only deletes icons, CHANGED_FILES has no SVGs and the
script printed "No changed icons found" to stdout, which was then posted as
the preview comment.
The script now logs that to stderr. The action writes no markup file and
sets `has-changes=false`, the workflow skips the artifact upload, and the
comment workflow skips its steps when no artifact exists instead of failing
on the missing artifact.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci(icon-preview): post the preview comment from a pull_request_target workflow
Like the PR title workflow, the icon preview now runs on pull_request_target
and posts its comment directly, so comment-icon-preview.yml and the
workflow_run artifact hand-off are removed.
The job checks out the base branch and runs the action from there. The
changed SVGs are read from the pull request head with `git fetch` + `git show`
into a temp directory, so no code from the pull request is checked out or run.
File names are checked against `icons/<kebab-case>.svg` before use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* ci(security): add scoped GITHUB_TOKEN permissions to all workflows
Every workflow now declares its token permissions explicitly instead of
inheriting the repository default, which satisfies OpenSSF Scorecard's
token-permissions check.
Multi-job and write-scoped workflows use `permissions: {}` as a
deny-by-default floor at the top level, with the actual grants declared
per job. Consolidating those grants at the workflow level would leak
scopes into jobs that don't need them — a `permissions` block replaces
rather than merges, so the empty top-level block also makes a forgotten
job block fail closed rather than inherit the default.
Single-job read-only package workflows keep a plain top-level
`contents: read`; there is no write scope to leak, so a second block per
file would only add noise.
Scopes were matched to what each job's steps actually do:
- linting-icons: `contents: read` per job. No `pull-requests: read` —
tj-actions/changed-files only needs that with `use_rest_api: true`,
and here it reads the local .git.
- lint-pr-title: `pull-requests: read`, which
action-semantic-pull-request needs to read the PR title.
- close-stale-prs: `pull-requests: write` only; the job never checks out.
- comment-icon-preview: `actions: read` for the cross-run artifact
download, plus `pull-requests: write` to post the comment.
- release: `contents: read` for the checkouts, `id-token: write` only on
the publishing jobs that use npm provenance, and `contents: write` only
on post-release, which uploads the release assets. The prepare job
neither checks out nor calls the API, so its empty scope is explicit.
- ci: `contents: write` only on create-release; the reusable-workflow
calls pass `id-token: write` and `contents: write` down to release.yml,
since a called workflow can only reduce what the caller grants.
Verified with actionlint (no new findings) and zizmor (no
excessive-permissions findings).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(ci): correct pull_request path filter in the lucide-vue workflow
The Vue package lives in packages/vue, not packages/lucide-vue, so the
filter never matched and the workflow did not run for changes to the
package itself.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Remove empty scope in prepare
* Patch WeaknessCWE-506
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
