Jobs without a permissions block inherit the repository default token
scope. Scopes are derived from what each workflow actually does with
the token:
- the fourteen package build and test workflows plus the code linter
never write through the token, they drop to contents: read.
- lint-pr-title.yml gets pull-requests: read, which is what the
semantic PR title action documents needing.
- comment-icon-preview.yml runs on workflow_run, a privileged trigger
processing artifacts produced by fork PRs, so an exact scope matters
most there: actions: read to download the artifact, issues: write
plus pull-requests: write to post the preview comment, contents:
read for the rest.
The workflows that already declared scoped permissions (labeler,
stale, linting-icons, release and friends) are untouched.
Both reusable calls to release.yml used 'secrets: inherit', which
forwards the caller's entire secret set. The only secret release.yml
reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload
the code points blob; npm publishing is OIDC trusted publishing and
needs no token secret at all. Declare that one secret on the reusable
workflow and pass it explicitly, so the workflow files show exactly
which secret flows into the release path and nothing else does. It is
declared optional, so tag-push runs (which read it from the repo
secrets directly) and forks without the secret behave as before.
Version tags are movable pointers: whoever controls an action's repo
can re-point them, and the previous commit's CVE is the proof it
happens in practice, to this very repository's dependency set. These
workflows hold real credentials: release.yml publishes the whole
lucide npm family with OIDC trusted publishing, ci.yml creates the
GitHub releases, and the comment and review workflows carry
pull-request write tokens.
Pinning by full commit SHA makes the reviewed code the code that runs.
Every pin keeps a version comment, resolved from the upstream repo and
cross-checked against its release tag (softprops v1 has no patch tag,
the comment names the floating tag it replaced). Dependabot understands
SHA pins and keeps bumping them with the comment in sync; the repo has
no dependabot.yml yet, adding one with the github-actions ecosystem is
a one-block follow-up.
request-review.yml still referenced tj-actions/changed-files@v41, the
action and version range hit by the March 2025 supply chain compromise
(GHSA-mrrh-fwg8-r2c3): the attacker re-pointed existing version tags at
code that dumped the runner's memory, including the job's GITHUB_TOKEN,
into the public build logs.
Bump to v46.0.5, pinned by commit SHA so the ref cannot be re-pointed
again; the two other call sites already on v46 get the same pin in the
next commit. The action's file-matching API is unchanged between v41
and v46 for the patterns used here.
* feat(icons): add layout-freeform
Adds an icon for freeform layout: three blocks, no two sharing an edge.
It matches the "no auto layout" / free positioning mode found in design
tools, as the counterpart to constrained layout modes.
Design notes:
- Reuses the 7x7 rx=1 block already shared by layout-grid, layout-list
and layout-panel-*, rather than introducing a new base shape.
- Each block is offset so that no two share an edge, which is what
separates it from layout-grid.
- The offset is 1px: a 2px offset reads more clearly at 16px, but brings
the top-right and bottom-left blocks within 1.66px of each other
diagonally, under the 2px element spacing guideline. See the PR for the
alternatives.
* Update icons/layout-freeform.json
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---------
Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat(icons): replaces `podcast` icon with new `mic-*` icons
* fix(icons): change contributors, since these are now essentially brand new icons
* fix(prettier): remove path fill from allowed SVG element attributes
* feat(docs): update pull_request_template.md
* Fix link to Lab directory in PR template
Updated link reference for the Lab directory in the pull request template.
---------
Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
* feat(ci): added custom prettier plugin for icon SVG files
* feat(ci): added custom prettier plugin for icon SVG files
* feat(ci): replace prettier plugin implementation with one based on svgo
* fix(ci): fix linting issues in prettier plugin
* Allow fill in path to fix podcast icon
* Format code
---------
Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
* feat(icons): add scan-square
Adds scan-square: a scanning frame with a square detected inside it.
The scan-* family covers what is being detected — scan-face, scan-heart,
scan-text, scan-eye, scan-barcode, scan-qr-code, scan-search, scan-line —
but has nothing for a plain shape or object.
Composed entirely from two existing icons rather than new geometry: the
four corner brackets are scan's, verbatim, and the inner block is
square-square's rect(8,8,8,8) rx=1, verbatim. Nothing here is drawn from
scratch, so it sits in the family without introducing a new vocabulary.
* chore(icons): fill scan-square use-cases and fix recognise/recognize tags
Addresses review on #4550: fills the use-cases field per @ericfennis, and
collapses the duplicate recognise/recognize tags into a single
recognition tag, matching scan-text's vocabulary per @Copilot.
* Update icons/scan-square.json
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update icons/scan-square.json
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---------
Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Karsa <contact@karsa.org>
* fix(packages/angular): add more supported attributes for SVG nodes
* fix(packages/angular): use original matcher syntax instead of toMatchInlineSnapshot matcher
---------
Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
* fix(site): fetch icon search metadata when typing
* fix(site): gate "No results" on metadata availability, not fetch state
* fix(site): also wait on categories metadata on the category page
Keeps the loading guard symmetric with the icons page. The narrower
tags-only check was technically more precise (this page's useSearch
doesn't index categories), but the failure case it guarded against —
brand search landing on a blank area if /api/categories lags behind
/api/tags — is too narrow to justify the asymmetry.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
Thibaud-Vdb