From 100fc43ede2e8a925c85fe59f16f6e9cdd1d0815 Mon Sep 17 00:00:00 2001 From: Tim Dixon Date: Mon, 13 Jul 2026 14:46:24 +0100 Subject: [PATCH] chore: sync template to v1.6.3 --- .claude/template-version | 2 +- .github/accessibility-tools/package-lock.json | 26 +++++++++++++------ .github/workflows/accessibility.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/codeql.yml | 15 +++++++---- .github/workflows/deploy.yml | 4 +-- .github/workflows/lint.yml | 2 +- .github/workflows/playwright.yml | 2 +- .github/workflows/security.yml | 18 ++++++++++--- 9 files changed, 49 insertions(+), 24 deletions(-) diff --git a/.claude/template-version b/.claude/template-version index fdd3be6..266146b 100644 --- a/.claude/template-version +++ b/.claude/template-version @@ -1 +1 @@ -1.6.2 +1.6.3 diff --git a/.github/accessibility-tools/package-lock.json b/.github/accessibility-tools/package-lock.json index 9234504..3f81f98 100644 --- a/.github/accessibility-tools/package-lock.json +++ b/.github/accessibility-tools/package-lock.json @@ -1117,17 +1117,17 @@ } }, "node_modules/form-data": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz", - "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==", + "version": "4.0.6", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz", + "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==", "dev": true, "license": "MIT", "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", - "hasown": "^2.0.2", - "mime-types": "^2.1.12" + "hasown": "^2.0.4", + "mime-types": "^2.1.35" }, "engines": { "node": ">= 6" @@ -1460,10 +1460,20 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" diff --git a/.github/workflows/accessibility.yml b/.github/workflows/accessibility.yml index 6e4a53c..3a1e38e 100644 --- a/.github/workflows/accessibility.yml +++ b/.github/workflows/accessibility.yml @@ -42,7 +42,7 @@ jobs: name: Pa11y and axe at WCAG 2.2 AAA runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ad7b557..5379094 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # --- Static front-end: HTML, CSS, JavaScript --- # - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4750aa7..44e87b3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,10 @@ +# ── PRIVATE REPOS: REMOVE THIS WORKFLOW ──────────────────────────────────────── +# CodeQL requires GitHub Advanced Security. On a private repository without +# Advanced Security enabled, this workflow will fail with a 403 error. +# Delete this file from any private project repository. +# Keep it only for public repos or private repos with Advanced Security enabled. +# ─────────────────────────────────────────────────────────────────────────────── + # CodeQL static analysis. # # Action versions were verified against GitHub and pinned to commit SHAs @@ -11,8 +18,6 @@ name: CodeQL on: pull_request: - push: - branches: [main] schedule: - cron: '0 6 * * 1' # weekly, Monday morning @@ -25,10 +30,10 @@ jobs: analyze: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Initialise CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 with: languages: javascript - name: Analyse - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index e46f2ae..a91cc89 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -55,7 +55,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 @@ -98,7 +98,7 @@ jobs: # runs-on: ubuntu-latest # steps: # - name: Check out the code - # uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # # - name: Assemble site # run: | diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 2d6a596..4ec2eb5 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml index 6a7af85..12a5987 100644 --- a/.github/workflows/playwright.yml +++ b/.github/workflows/playwright.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the code - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # --- Uncomment and adapt when the project has Playwright tests --- diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b8e541d..8853226 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -16,19 +16,24 @@ jobs: semgrep: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Cache pip packages for Semgrep + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + with: + path: ~/.cache/pip + key: ${{ runner.os }}-semgrep-1.166.0 - name: Semgrep # semgrep scan runs locally with the default ruleset and exits non-zero # on any finding. semgrep ci requires a SEMGREP_APP_TOKEN and uses # cloud-based CI mode; it is not used here to avoid token dependency. run: | - pip install semgrep + pip install semgrep==1.166.0 semgrep scan --config p/default --error trivy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Trivy filesystem scan uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: @@ -36,11 +41,16 @@ jobs: severity: CRITICAL,HIGH exit-code: '1' + # ── PRIVATE REPOS: REMOVE THIS JOB ────────────────────────────────────────── + # dependency-review requires GitHub Advanced Security. On a private repository + # without Advanced Security, this job will fail with a 403 error. + # Remove it from any private project repository. + # ───────────────────────────────────────────────────────────────────────────── dependency-review: runs-on: ubuntu-latest if: github.event_name == 'pull_request' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 # Note for PHP projects: CodeQL does not support PHP. Add a PHP static