Skip to content

3月のパッケージアップデート #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ienaga merged 3 commits into from
Mar 1, 2026
Merged

3月のパッケージアップデート #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
045ae01
Bump minimatch
dependabot[bot] Feb 28, 2026
6cb656f
Merge pull request #51 from Next2D/dependabot/npm_and_yarn/multi-770c…
ienaga Mar 1, 2026
f13b88d
#52 3月のパッケージアップデート
ienaga Mar 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,18 @@ name: Lint
on:
push:
branches:
- main
- develop
pull_request:
branches:
- main
- develop
workflow_call:

jobs:
macos-browser-test:
runs-on: macos-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
Expand All @@ -30,7 +29,6 @@ jobs:
runs-on: windows-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,16 @@ permissions:
contents: read

jobs:
lint:
uses: ./.github/workflows/lint.yml

Comment on lines +13 to +15
Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the workflow has permissions: id-token: write at the top level and you added a lint job that calls the reusable lint workflow, that lint job will also receive OIDC token write access. For least privilege, consider moving id-token: write to only the publish job (and keeping the workflow/job default to contents: read), or explicitly setting minimal permissions on the lint job.

Copilot uses AI. Check for mistakes.
publish:
needs: [lint]
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pull-requests: write is being granted to the publish job, but this workflow only runs on push to main and the steps shown don’t interact with PRs. This extra permission increases repo risk; please remove it unless a later step truly needs to write to PRs.

Suggested change
pull-requests: write

Copilot uses AI. Check for mistakes.
id-token: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
Expand Down
Loading
Loading