hipowered.dev/lucide
1
0
Fork 0
mirror of https://github.com/lucide-icons/lucide.git synced 2026-11-14 13:58:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,780 Commits 90 Branches 753 Tags
79d4dd48a7d4aa7ebcec7fda550c10e91b617ee4
Commit Graph
286 Commits
Author SHA1 Message Date
Thibaud-Vdb 79d4dd48a7 ci: declare least-privilege workflow permissions 
Jobs without a permissions block inherit the repository default token
scope. Scopes are derived from what each workflow actually does with
the token:

- the fourteen package build and test workflows plus the code linter
  never write through the token, they drop to contents: read.
- lint-pr-title.yml gets pull-requests: read, which is what the
  semantic PR title action documents needing.
- comment-icon-preview.yml runs on workflow_run, a privileged trigger
  processing artifacts produced by fork PRs, so an exact scope matters
  most there: actions: read to download the artifact, issues: write
  plus pull-requests: write to post the preview comment, contents:
  read for the rest.

The workflows that already declared scoped permissions (labeler,
stale, linting-icons, release and friends) are untouched.
 2026-08-05 11:06:37 +02:00
Thibaud-Vdb 8298424ae0 ci: pass only the secret the release workflow needs 
Both reusable calls to release.yml used 'secrets: inherit', which
forwards the caller's entire secret set. The only secret release.yml
reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload
the code points blob; npm publishing is OIDC trusted publishing and
needs no token secret at all. Declare that one secret on the reusable
workflow and pass it explicitly, so the workflow files show exactly
which secret flows into the release path and nothing else does. It is
declared optional, so tag-push runs (which read it from the repo
secrets directly) and forks without the secret behave as before.
 2026-08-05 11:05:42 +02:00
Thibaud-Vdb 7c8f38774b ci: pin actions to commit SHAs 
Version tags are movable pointers: whoever controls an action's repo
can re-point them, and the previous commit's CVE is the proof it
happens in practice, to this very repository's dependency set. These
workflows hold real credentials: release.yml publishes the whole
lucide npm family with OIDC trusted publishing, ci.yml creates the
GitHub releases, and the comment and review workflows carry
pull-request write tokens.

Pinning by full commit SHA makes the reviewed code the code that runs.
Every pin keeps a version comment, resolved from the upstream repo and
cross-checked against its release tag (softprops v1 has no patch tag,
the comment names the floating tag it replaced). Dependabot understands
SHA pins and keeps bumping them with the comment in sync; the repo has
no dependabot.yml yet, adding one with the github-actions ecosystem is
a one-block follow-up.
 2026-08-05 11:05:00 +02:00
Thibaud-Vdb 237ab7fa68 ci: move changed-files off the CVE-2025-30066 affected v41 
request-review.yml still referenced tj-actions/changed-files@v41, the
action and version range hit by the March 2025 supply chain compromise
(GHSA-mrrh-fwg8-r2c3): the attacker re-pointed existing version tags at
code that dumped the runner's memory, including the job's GITHUB_TOKEN,
into the public build logs.

Bump to v46.0.5, pinned by commit SHA so the ref cannot be re-pointed
again; the two other call sites already on v46 get the same pin in the
next commit. The action's file-matching API is unchanged between v41
and v46 for the patterns used here.
 2026-08-05 11:04:21 +02:00
Eric FennisandCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> 1502285072 fix(@lucide/lab): Fix lab build (#4618) 
* chore(lab): Adjust build scripts

* add check workflow

* Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* update gitignore

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
 2026-07-31 09:11:20 +02:00
Eric FennisCopilot Autofix powered by AIKarsa
 		9ecaafbc4d feat(lab): Migrate lab to main repo. (#4521) 
* Add directory

* Add lab check script

* Delete duplicated icons

* Fix the lab page

* Adjust paths

* update lockfile

* update lockfile

* fix(lab/planet): replace with guideline-compliant design

* Add install step

* Add second install step

* Adjust lab in site

* try this

* Fix workflow

* Add cspell

* Format code

* Temporary delete icons for copilot review

* Place back lab icons

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Update lock file

* Revert svg changes

* Fix list

* Rename filenames

* Format tsconfig

---------

Co-authored-by: Karsa <contact@karsa.org>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-24 15:05:40 +02:00
Eric Fennis c757cb9d4b ci(ci.yml): Remove concurrency in ci.yml (#4595) 2026-07-24 14:39:12 +02:00
KarsaandEric Fennis 5d36179bf4 feat(ci): added custom prettier plugin for icon SVG files (#4576) 
* feat(ci): added custom prettier plugin for icon SVG files

* feat(ci): added custom prettier plugin for icon SVG files

* feat(ci): replace prettier plugin implementation with one based on svgo

* fix(ci): fix linting issues in prettier plugin

* Allow fill in path to fix podcast icon

* Format code

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
 2026-07-24 14:23:56 +02:00
Eric Fennis 5a06f7cb1d fix(request-review): Remove pull_request_target (#4593) 2026-07-24 13:23:58 +02:00
Jakob Guddas b442632ee6 fix: broken link in brand logo comment (#4533) 2026-07-11 12:59:38 +02:00
Eric Fennis 52d7c549c3 Set custom COPILOT_GITHUB_TOKEN (#4509) 2026-06-30 20:06:34 +02:00
Eric Fennis 9cb4e49849 Small fix in the workflow (#4508) 2026-06-30 19:15:07 +02:00
Eric FennisandCopilot Autofix powered by AI f59db07ef9 ci(repo-journal.yml): GH copilot repo summary (#4505) 
* gh bot posting info

* Set secret

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-30 14:09:53 +02:00
Eric Fennis cf0e1e44ba ci(release.yml): Remove concurrency field to prevent release mess (#4485) 2026-06-18 14:41:27 +02:00
Eric Fennis 5ff536e139 ci(release.yml): Fix workflow and remove version scripts in package scripts (#4479) 
* ci(release.yml): Remove new-version in release flow

* Remove version in scripts

* Update workflow
 2026-06-16 16:24:07 +02:00
Eric Fennis bb7d2d9839 ci(release.yml): Remove new-version in release flow (#4478) 2026-06-16 15:01:58 +02:00
Eric FennisandCopilot Autofix powered by AI 283e4b2805 chore(suggest-tags): Update metadata suggestion script (#4462) 
* feat(metadata): implement pull request metadata suggestions workflow and replace suggestTags script

* Switch to GPT 5

* Update comment description

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-13 12:28:04 +02:00
Eric FennisandCopilot Autofix powered by AI 03ad294db0 fix(ci): add check to skip release if latest tag was created today (#4085) 
* fix(ci): add check to skip release if latest tag was created today

* Apply dispatch gate to the ci workflow

* Fix ci

* Revert svg changes

* Revert svg

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Format ci file

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-12 14:27:59 +02:00
Eric Fennis 523026ac18 chore(lucide-vue-next|lucide-svelte|lucide-angular): Remove deprecated packages (#4376) 
* Remove deprecated packages

* Remove `lucide-angular` package

* Remove workflow

* Update lock file
 2026-05-15 15:03:42 +02:00
Karsa c81e6846c5 test(build-font): added comprehensive unit tests on build-font tool (#4315) 2026-04-24 14:12:43 +02:00
Karsa fa09963bf8 fix(pipeline): revert custom angular publish step. not even this solves it. 2026-03-24 17:58:37 +01:00
Karsa f1360e1d9b feat(pipeline): fix working directory (angular, not @lucide/angular) 2026-03-24 17:50:32 +01:00
Karsa aed7aeaa72 feat(pipeline): move angular publish step from lucide-static ⇒ release 2026-03-24 17:46:54 +01:00
Karsa 25d96b7ec0 feat(pipeline): fix linting issues 2026-03-24 17:41:09 +01:00
Karsa 10962ce51b feat(pipeline): add separate Angular publish step using dist as the working directory & stripping publishConfig.directory from its package.json 2026-03-24 17:36:52 +01:00
Karsa 7dfbd21bce feat(pipeline): revert debug changes made to release.yml 2026-03-24 17:23:20 +01:00
Karsa b18f27ea8d feat(pipeline): add angular debug to release workflow 2026-03-24 17:14:31 +01:00
Karsa 5e6186ff70 feat(pipeline): add angular debug to release workflow 2026-03-24 17:12:55 +01:00
Karsa acb947a770 Merge remote-tracking branch 'origin/main' 2026-03-24 17:11:02 +01:00
Karsa e9bec8e6f8 feat(pipeline): add angular debug to release workflow 2026-03-24 17:10:48 +01:00
Karsa 4ea3561788 feat(pipeline): add angular debug to release workflow 2026-03-24 17:09:32 +01:00
Karsa 76c1b0caa9 feat(pipeline): add release-angular workflow for testing 2026-03-24 16:45:40 +01:00
Karsa f2eab2c30a feat(icons): debug angular release 2026-03-24 16:21:47 +01:00
Karsa 3fc90467a3 feat(pipeline): re-revert from the working-directory solution & set default tag as latest 2026-03-24 16:18:39 +01:00
Karsa 7a395122a1 feat(pipeline): revert to working-directory solution for testing 2026-03-24 16:10:24 +01:00
KarsaandEric Fennis 914919a4a3 fix(github/workflows): revert release workflow & add --fail-if-no-match (#4201) 
* fix(github/workflows): revert release workflow & add --fail-if-no-match
fix(packages/angular): add "analytics": false to angular.json to prevent build prompt

* Apply suggestion from @ericfennis

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
 2026-03-24 10:25:25 +01:00
Eric FennisandCopilot 3b63c139ae ci(ci.yml): Fix release flow (#4193) 
* ci(ci.yml): Fix release flow

* format code

* Update .github/workflows/release.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-03-24 09:14:50 +01:00
Karsa f50aa846ab fix(github/workflows): fix latest_tag getter (#4191) 2026-03-23 16:04:35 +01:00
Eric Fennis e3db10ac9d ci(release.yml): Change release yml 2026-03-21 15:14:51 +01:00
Eric Fennis 73139fae2d ci(release.yml): Turn on @lucide/angular and @lucide/vue 2026-03-21 15:00:45 +01:00
Eric Fennis 56258a9281 Update release yml file 2026-03-20 15:36:33 +01:00
KarsaCopilotEric Fennis
 		a0e202d759 feat(packages/angular): add new @lucide/angular package (#3897) 
* Add new lucide angular package

* feat(packages/angular): added initial @lucide/angular package

* feat(packages/angular): update readme

* feat(packages/angular): update angular.json

* docs(packages/angular): added (for now) full documentation for @lucide/angular

* docs(packages/angular): added migration guide from lucide-angular

* fix(github): fix package label syntax 😅

* fix(lint): fix linting issues

* fix(github/angular): add prebuild stage

* fix(github/angular): add prebuild stage & fix tests

* fix(github/angular): fix LucideIconComponentType, update with _real_ public members

* fix(github/angular): add prebuild to build step manually

* fix(github/angular): downgrade vitest

* fix(packages/angular): fix migration guide code example

* fix(packages): add vitest + @vitest/* to pnpm overrides

* fix(packages): update pnpm-lock with merged version

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix(packages): fix aria-hidden logic

* fix(packages): update pnpm-lock

* fix(packages): extract vitest and jsdom to root devDependencies

* Fix copy utils script

* Format code

* feat(packages/angular): switched to self-describing IconData object from separate node+name – no more toKebabCase hackery
feat(packages/angular): renamed LucideIconComponentType => LucideIcon, and LucideIcon => LucideDynamicIcon
feat(packages/angular): added backwards compatible CSS class support
feat(packages/angular): switched to vector-effect: non-scaling-stroke implementation from computed stroke width
feat(packages/angular): rewrote icon provider to only accept a list of self-described icons – no more toKebabCase hackery & as an added bonus automatic backwards compatible alias support 🚀
feat(packages/angular): added legacy icon node helper function for passing legacy icons to providers
test(packages/angular): added unit tests on LUCIDE_CONFIG provider usage

* fix(packages/angular): fix linting issues

* feat(packages/angular): extract createLucideIcon logic into helper function, refactor export template to use the iconData object as defined in ExportTemplate

* Replace author

* Remove private field

* fix(packages/angular): remove createLucideIcon, it breaks the package :'(

* fix(packages/angular): fix rendering order of child elements (_before_ projected content)

* Format package.json

* Update docs/guide/packages/angular.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update packages/angular/MIGRATION.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-03-20 15:31:34 +01:00
Eric Fennis 0d7bb4f4a7 chore: Format code 2026-03-19 12:09:04 +01:00
Eric Fennis 7f19f6adf1 ci(release.yml): Fix access public 2026-03-19 11:03:29 +01:00
Eric Fennis 2a7eeb2d87 ci(version-1): Prepare CI.yml for next release tag (#4145) 2026-03-14 20:57:27 +01:00
KarsaandEric Fennis 8fe835c105 feat(packages): added new @lucide/icons package (#3881) 
* feat(packages): added lucide icons package skeleton

* feat(packages): added initial commit of @lucide/icons

* fix: fixed linting issues introduced in c4e5730bc4 (#3858)

* fix(packages/icons): update package, remove UMD export

* fix(packages/icons): update github actions

* docs(packages/icons): add documentation for various helpers and types

* fix(.github/ISSUE_TEMPLATE): fix linting issue (@ is a reserved character)

* fix(packages/icons): fix linting issues in configs

* feat(packages/icons): rename from packages/lucide-icons => packages/icons

* fix(pnpm): update lockfile

* fix(packages/icons): update readme and documentation

* fix(packages/icons): update absoluteStrokeWidth implementation

* test(packages/icons): update absoluteStrokeWidth unit test

* feat(packages/icons): add backwards compatible alias support in buildLucideIconNode

* feat(packages/icons): fix linting issues in build tools

* fix(packages/icons): rename LucideIcon => LucideIconData

---------

Co-authored-by: Eric Fennis <eric.fennis@gmail.com>
 2026-03-13 10:18:53 +01:00
Eric Fennis 6faa55d34e Merge branch 'main' of https://github.com/lucide-icons/lucide into next 2026-03-06 10:49:44 +01:00
Eric Fennis ed6ba4bf0c Merge branch 'main' of https://github.com/lucide-icons/lucide 2026-03-06 09:15:50 +01:00
Eric Fennis c5b155ec37 Merge branch 'main' of https://github.com/lucide-icons/lucide into next 2026-03-05 18:47:02 +01:00
Eric Fennis e6c7d7d495 docs(api): Update nitro to latest version (#4102) 
* update nitro

* try this?

* Try this

* update vercel output

* Add await

* Fix endpoints

* Adjust 404 catch all

* Fix output

* Adjust react in api

* Fix types

* Remove @resvg/resvg-wasm

* Format code

* Fix failing check

* Apply feedback

* Format code
 2026-03-05 14:03:27 +01:00