Thibaud-Vdb
7c8f38774b
ci: pin actions to commit SHAs
...
Version tags are movable pointers: whoever controls an action's repo
can re-point them, and the previous commit's CVE is the proof it
happens in practice, to this very repository's dependency set. These
workflows hold real credentials: release.yml publishes the whole
lucide npm family with OIDC trusted publishing, ci.yml creates the
GitHub releases, and the comment and review workflows carry
pull-request write tokens.
Pinning by full commit SHA makes the reviewed code the code that runs.
Every pin keeps a version comment, resolved from the upstream repo and
cross-checked against its release tag (softprops v1 has no patch tag,
the comment names the floating tag it replaced). Dependabot understands
SHA pins and keeps bumping them with the comment in sync; the repo has
no dependabot.yml yet, adding one with the github-actions ecosystem is
a one-block follow-up.
2026-08-05 11:05:00 +02:00
a0e202d759
feat(packages/angular): add new @lucide/angular package ( #3897 )
...
* Add new lucide angular package
* feat(packages/angular): added initial @lucide/angular package
* feat(packages/angular): update readme
* feat(packages/angular): update angular.json
* docs(packages/angular): added (for now) full documentation for @lucide/angular
* docs(packages/angular): added migration guide from lucide-angular
* fix(github): fix package label syntax 😅
* fix(lint): fix linting issues
* fix(github/angular): add prebuild stage
* fix(github/angular): add prebuild stage & fix tests
* fix(github/angular): fix LucideIconComponentType, update with _real_ public members
* fix(github/angular): add prebuild to build step manually
* fix(github/angular): downgrade vitest
* fix(packages/angular): fix migration guide code example
* fix(packages): add vitest + @vitest/* to pnpm overrides
* fix(packages): update pnpm-lock with merged version
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
* fix(packages): fix aria-hidden logic
* fix(packages): update pnpm-lock
* fix(packages): extract vitest and jsdom to root devDependencies
* Fix copy utils script
* Format code
* feat(packages/angular): switched to self-describing IconData object from separate node+name – no more toKebabCase hackery
feat(packages/angular): renamed LucideIconComponentType => LucideIcon, and LucideIcon => LucideDynamicIcon
feat(packages/angular): added backwards compatible CSS class support
feat(packages/angular): switched to vector-effect: non-scaling-stroke implementation from computed stroke width
feat(packages/angular): rewrote icon provider to only accept a list of self-described icons – no more toKebabCase hackery & as an added bonus automatic backwards compatible alias support 🚀
feat(packages/angular): added legacy icon node helper function for passing legacy icons to providers
test(packages/angular): added unit tests on LUCIDE_CONFIG provider usage
* fix(packages/angular): fix linting issues
* feat(packages/angular): extract createLucideIcon logic into helper function, refactor export template to use the iconData object as defined in ExportTemplate
* Replace author
* Remove private field
* fix(packages/angular): remove createLucideIcon, it breaks the package :'(
* fix(packages/angular): fix rendering order of child elements (_before_ projected content)
* Format package.json
* Update docs/guide/packages/angular.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
* Update packages/angular/MIGRATION.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
---------
Co-authored-by: Eric Fennis <eric.fennis@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-03-20 15:31:34 +01:00
Thibaud-Vdb