* feat(ci): run metadata suggestions on every PR update with cached results
- Run on opened/reopened/synchronize and queue runs per PR.
- Cache the model's suggestions per icon name with actions/cache, so the
OpenAI API is only called again for icons that are added or renamed.
- Skip suggestions that were already posted instead of skipping the whole
PR once it has a review.
- Suggest only the values to append after the last array item instead of
the whole array; empty and inline arrays still get the full block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TSdUq9uFpjuQsoobCBqz4j
* refactor(ci): key the suggestions cache on the PR's icon names
Replace the separate restore/save steps and the `cache-updated` output
with a single actions/cache step keyed on a hash of the changed icon
files, so the API is only called again when icon names change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TSdUq9uFpjuQsoobCBqz4j
* style(ci): drop trailing blank line in suggest-metadata action
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TSdUq9uFpjuQsoobCBqz4j
* fix(ci): dedupe metadata suggestions by value instead of comment body
The append-style suggestion includes the array's current last item, so
comparing whole comment bodies reposted the same values after a
contributor added a tag or applied part of a suggestion. Read the values
back from the bot's earlier suggestion blocks per file and field, and
exclude them like the current values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TSdUq9uFpjuQsoobCBqz4j
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(scripts): keep contributors out of metadata suggestions
The shared metadata instructions include a Contributors section asking to
add the PR author, but the suggestion schema has no contributors field, so
the model leaked it into use-cases. Strip that section from the prompt and
explicitly restrict suggestions to tags, categories and use-cases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MThCx7cVXV3XWfo5C327Ci
* refactor(ci): move metadata suggestions into a dedicated composite action
Move scripts/suggestMetaData.mts to .github/actions/suggest-metadata and
wrap it in a composite action with explicit inputs. The workflow now uses
the local action; package.json scripts point to the new location.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MThCx7cVXV3XWfo5C327Ci
* chore(ci): add .env.example for testing the suggest-metadata action locally
Document the env vars the script reads, point the debug/watch scripts at
an action-local .env, and fix the USE_FILE_SYSYEM typo.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MThCx7cVXV3XWfo5C327Ci
* chore(ci): make .github/actions a pnpm workspace
Add .github/actions/* to the pnpm workspace and give the suggest-metadata
action its own package.json with its dependencies (openai, zod, dotenv,
@octokit/rest). openai, zod and dotenv move out of the root package.json;
@octokit/rest stays there for updateContributors. The workflow now only
installs the action's dependencies, and the root suggest:metadata scripts
delegate to the action package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MThCx7cVXV3XWfo5C327Ci
* Upgrade to gpt-6-luna
---------
Co-authored-by: Claude <noreply@anthropic.com>
* ci(security): add scoped GITHUB_TOKEN permissions to all workflows
Every workflow now declares its token permissions explicitly instead of
inheriting the repository default, which satisfies OpenSSF Scorecard's
token-permissions check.
Multi-job and write-scoped workflows use `permissions: {}` as a
deny-by-default floor at the top level, with the actual grants declared
per job. Consolidating those grants at the workflow level would leak
scopes into jobs that don't need them — a `permissions` block replaces
rather than merges, so the empty top-level block also makes a forgotten
job block fail closed rather than inherit the default.
Single-job read-only package workflows keep a plain top-level
`contents: read`; there is no write scope to leak, so a second block per
file would only add noise.
Scopes were matched to what each job's steps actually do:
- linting-icons: `contents: read` per job. No `pull-requests: read` —
tj-actions/changed-files only needs that with `use_rest_api: true`,
and here it reads the local .git.
- lint-pr-title: `pull-requests: read`, which
action-semantic-pull-request needs to read the PR title.
- close-stale-prs: `pull-requests: write` only; the job never checks out.
- comment-icon-preview: `actions: read` for the cross-run artifact
download, plus `pull-requests: write` to post the comment.
- release: `contents: read` for the checkouts, `id-token: write` only on
the publishing jobs that use npm provenance, and `contents: write` only
on post-release, which uploads the release assets. The prepare job
neither checks out nor calls the API, so its empty scope is explicit.
- ci: `contents: write` only on create-release; the reusable-workflow
calls pass `id-token: write` and `contents: write` down to release.yml,
since a called workflow can only reduce what the caller grants.
Verified with actionlint (no new findings) and zizmor (no
excessive-permissions findings).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(ci): correct pull_request path filter in the lucide-vue workflow
The Vue package lives in packages/vue, not packages/lucide-vue, so the
filter never matched and the workflow did not run for changes to the
package itself.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Remove empty scope in prepare
* Patch WeaknessCWE-506
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
