Merge branch 'main' of https://github.com/lucide-icons/lucide into add-extra-checks

Update sha
Merge branch 'main' of https://github.com/lucide-icons/lucide into ci-hardening
2026-11-10 13:18:25 +00:00 · 2026-08-07 13:04:12 +02:00 · 2026-08-07 10:42:33 +02:00 · 2026-08-07 09:53:25 +02:00 · 2026-08-05 11:07:03 +02:00 · 2026-08-05 11:06:37 +02:00
4 changed files with 24 additions and 3 deletions
@@ -97,7 +97,7 @@ updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
-      interval: monthly
+      interval: weekly
    groups:
      github-actions:
        patterns:
@@ -69,7 +69,9 @@ jobs:
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
-          cache: 'pnpm'
+          # No cache restore here: this job cuts the release, and caches
+          # are writable from other workflow runs. The lockfile still
+          # guards the install.
          node-version-file: 'package.json'

      - name: Install dependencies
@@ -22,3 +22,19 @@ jobs:

      - name: Run Linter
        run: pnpm lint
+
+  lint-actions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Verify actions are pinned to commit SHAs
+        run: |
+          unpinned=$(grep -rnE "^[[:space:]]*(-[[:space:]]+)?uses:" .github/workflows/ \
+            | grep -vE "uses:[[:space:]]*['\"]?\./" \
+            | grep -vE "uses:[[:space:]]*['\"]?[^@]+@[0-9a-f]{40}([[:space:]]|$|#)" || true)
+          if [ -n "$unpinned" ]; then
+            echo "::error::GitHub Actions must be pinned to a full commit SHA, not a version tag."
+            echo "$unpinned"
+            exit 1
+          fi
@@ -15,6 +15,10 @@ on:
        description: NPM tag
        default: 'latest'
        type: string
+    secrets:
+      BLOB_READ_WRITE_TOKEN:
+        description: Token used by build-font to upload the code points blob
+        required: false

 permissions: {}

@@ -95,7 +99,6 @@ jobs:
        with:
          name: lucide-font
          path: lucide-font
-
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
Author	SHA1	Message	Date
Eric Fennis	917d2ca847	Merge branch 'main' of https://github.com/lucide-icons/lucide into add-extra-checks	2026-08-07 13:04:12 +02:00
Eric Fennis	dd4da98c1f	Update sha	2026-08-07 10:42:33 +02:00
Eric Fennis	cceab3d776	Merge branch 'main' of https://github.com/lucide-icons/lucide into ci-hardening	2026-08-07 09:53:25 +02:00
Thibaud-Vdb	6b9e93615c	ci: don't restore the pnpm cache in the release-creating job The create-release job restored the shared pnpm store through setup-node before computing and tagging the new version. Actions caches can be written by other workflow runs, so the job that cuts releases should install from the registry instead; the frozen lockfile still pins and verifies every dependency, and this job runs only a few times a day at most.	2026-08-05 11:07:03 +02:00
Thibaud-Vdb	79d4dd48a7	ci: declare least-privilege workflow permissions Jobs without a permissions block inherit the repository default token scope. Scopes are derived from what each workflow actually does with the token: - the fourteen package build and test workflows plus the code linter never write through the token, they drop to contents: read. - lint-pr-title.yml gets pull-requests: read, which is what the semantic PR title action documents needing. - comment-icon-preview.yml runs on workflow_run, a privileged trigger processing artifacts produced by fork PRs, so an exact scope matters most there: actions: read to download the artifact, issues: write plus pull-requests: write to post the preview comment, contents: read for the rest. The workflows that already declared scoped permissions (labeler, stale, linting-icons, release and friends) are untouched.	2026-08-05 11:06:37 +02:00
Thibaud-Vdb	8298424ae0	ci: pass only the secret the release workflow needs Both reusable calls to release.yml used 'secrets: inherit', which forwards the caller's entire secret set. The only secret release.yml reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload the code points blob; npm publishing is OIDC trusted publishing and needs no token secret at all. Declare that one secret on the reusable workflow and pass it explicitly, so the workflow files show exactly which secret flows into the release path and nothing else does. It is declared optional, so tag-push runs (which read it from the repo secrets directly) and forks without the secret behave as before.	2026-08-05 11:05:42 +02:00
Thibaud-Vdb	7c8f38774b	ci: pin actions to commit SHAs Version tags are movable pointers: whoever controls an action's repo can re-point them, and the previous commit's CVE is the proof it happens in practice, to this very repository's dependency set. These workflows hold real credentials: release.yml publishes the whole lucide npm family with OIDC trusted publishing, ci.yml creates the GitHub releases, and the comment and review workflows carry pull-request write tokens. Pinning by full commit SHA makes the reviewed code the code that runs. Every pin keeps a version comment, resolved from the upstream repo and cross-checked against its release tag (softprops v1 has no patch tag, the comment names the floating tag it replaced). Dependabot understands SHA pins and keeps bumping them with the comment in sync; the repo has no dependabot.yml yet, adding one with the github-actions ecosystem is a one-block follow-up.	2026-08-05 11:05:00 +02:00
Thibaud-Vdb	237ab7fa68	ci: move changed-files off the CVE-2025-30066 affected v41 request-review.yml still referenced tj-actions/changed-files@v41, the action and version range hit by the March 2025 supply chain compromise (GHSA-mrrh-fwg8-r2c3): the attacker re-pointed existing version tags at code that dumped the runner's memory, including the job's GITHUB_TOKEN, into the public build logs. Bump to v46.0.5, pinned by commit SHA so the ref cannot be re-pointed again; the two other call sites already on v46 get the same pin in the next commit. The action's file-matching API is unchanged between v41 and v46 for the patterns used here.	2026-08-05 11:04:21 +02:00