Merge branch 'main' into patch-1

Author: kachkaev

.github/actions/setup/action.yml

@@ -4,25 +4,23 @@ description: Install PNPM, Node, and dependencies
 inputs:
   install:
     default: 'true'
-    type: boolean
     description: Whether or not to run 'pnpm install'
 
   installArgs:
     default: ''
-    type: string
     description: Additional args to append to "pnpm install"
 
 runs:
   using: composite
 
   steps:
     - name: 🛠️ Setup PNPM
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@f2b2b233b538f500472c7274c7012f57857d8ce0 # v4.1.0
 
     - name: 🛠️ Setup NodeJS
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
       with:
-        node-version: 18
+        node-version: 20
         cache: pnpm
 
     - name: 📦 Install Dependencies

.github/workflows/notify-unreleased-commits.yml

@@ -0,0 +1,35 @@
+name: 🔔 Notify Unreleased Commits
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 20 * * 1' # Weekly at 8 PM UTC (3 PM CT)
+
+jobs:
+  notify:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
+        with:
+          fetch-depth: 0
+
+      - name: List Commits
+        id: list-commits
+        run: |
+          ./scripts/list-unreleased-commits.sh > summary.txt
+
+      - name: Discord notification
+        run: |
+          PAYLOAD=$(jq -n --arg content "${{ env.MESSAGE }}" '{"content": $content}')
+          curl -X POST \
+            -F "payload_json=${PAYLOAD}" \
+            -F "file1=@summary.txt" \
+            $DISCORD_WEBHOOK
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_UNRELEASED_COMMITS }}
+          MESSAGE: |
+            If a package needs released, please [run the workflow](<https://github.com/wxt-dev/wxt/actions/workflows/release.yml>).
+
+            Before running, consider:
+            - Are there any breaking changes? If so, prepare a list of breaking changes and update the changelog and release notes after the release.
+            - Are there any PRs open that we wait to release after they're merged?

.github/workflows/pkg.pr.new.yml

@@ -17,7 +17,7 @@ jobs:
     if: ${{ github.repository == 'wxt-dev/wxt' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/pr-title.yml

@@ -10,7 +10,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
         with:
           # Only fetch the config file from the repository
           sparse-checkout-cone-mode: false

.github/workflows/publish-docs.yml

@@ -23,13 +23,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup
 
       - name: Login to Docker Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           registry: https://${{ secrets.DOCKER_REGISTRY_HOSTNAME }}
           username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}

.github/workflows/release.yml

@@ -31,16 +31,18 @@ jobs:
 
   publish:
     name: Publish
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
-      contents: write
+      contents: write # Push version changes
+      id-token: write # OIDC for NPM publishing
     needs:
       - validate
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
         with:
           fetch-depth: 0
+          ssh-key: ${{ secrets.DEPLOY_KEY }} # https://github.com/sbellone/release-workflow-example
 
       - name: Setup
         uses: ./.github/actions/setup
@@ -60,9 +62,8 @@ jobs:
       - name: Publish to NPM
         working-directory: packages/${{ inputs.package }}
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" > ~/.npmrc
-          pnpm build
-          pnpm publish
+          sudo npm i -g npm@latest
+          /usr/local/bin/npm publish
 
       - name: Create GitHub release
         run: pnpm tsx scripts/create-github-release.ts ${{ inputs.package }}

.github/workflows/sync-releases.yml

@@ -30,7 +30,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/update-browser-package.yml

@@ -12,16 +12,20 @@ jobs:
     name: 'Sync with @types/chrome'
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # Push version changes
+      id-token: write # OIDC for NPM publishing
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup
         with:
           installArgs: --ignore-scripts
 
+      - name: Update NPM
+        run: sudo npm i -g npm@latest
+
       - name: Generate Latest Code
         working-directory: packages/browser
         run: pnpm gen
@@ -32,7 +36,7 @@ jobs:
 
       - name: Commit Changes
         id: commit
-        uses: stefanzweifel/git-auto-commit-action@v6
+        uses: stefanzweifel/git-auto-commit-action@01d77ca6cb089da1360e540865f7d035c95aa199 # v6.0.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -41,6 +45,4 @@ jobs:
       - name: Publish Package
         if: steps.commit.outputs.changes_detected == 'true'
         working-directory: packages/browser
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" > ~/.npmrc
-          pnpm publish
+        run: npm publish

.github/workflows/validate.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup
@@ -68,13 +68,13 @@ jobs:
             coverage: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@22457c87c1b161cf7dde222c3e82b2b5f8d2bed2 # v2.0.2
 
       - name: Run Tests
         if: ${{ ! matrix.coverage }}
@@ -86,7 +86,7 @@ jobs:
 
       - name: Upload Coverage
         if: matrix.coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
@@ -104,7 +104,7 @@ jobs:
           - vue
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/vhs.yml

@@ -17,7 +17,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Setup
         uses: ./.github/actions/setup
@@ -31,12 +31,12 @@ jobs:
           pnpm dlx wxt@latest --version
 
       - name: Record VHS
-        uses: charmbracelet/vhs-action@v2.1.0
+        uses: charmbracelet/vhs-action@59641cdc7fadf3978db65eb8c6937ea2752f4ec3 # v2.1.0
         with:
           path: 'docs/tapes/init-demo.tape'
 
       - name: Save recorded GIF
-        uses: stefanzweifel/git-auto-commit-action@v6
+        uses: stefanzweifel/git-auto-commit-action@01d77ca6cb089da1360e540865f7d035c95aa199 # v6.0.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: