From b86f6001646915b347059967cc87bf337b404f38 Mon Sep 17 00:00:00 2001 From: DutchmanNL Date: Mon, 24 Aug 2026 11:39:24 +0200 Subject: [PATCH 1/2] =?UTF-8?q?chore:=20maintenance=20pass=20=E2=80=93=20d?= =?UTF-8?q?eps,=20CI=20modernization,=20repo-checker=20fixes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Standardize CI/release tooling to the estate golden template. The repo was already fully modern (Node>=22, adapter-core ^3.4.3, ESLint flat config, jsonConfig admin UI, release-script v5, Trusted Publishing), so these are surgical alignments only: - test-and-release.yml: guard concurrency so tag/release runs are never cancelled (group by workflow+ref, cancel-in-progress only off tags); add adapter-tests timeout-minutes 30 and strategy fail-fast: false. - dependabot.yml: add open-pull-requests-limit 15 (npm + github-actions), ignore typescript semver-minor/major bumps. - eslint.config.mjs: ignore local .claude/ tooling directory. - .gitignore: ignore .DS_Store. - README: add WORK IN PROGRESS changelog section. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 7 ++++++- .github/workflows/test-and-release.yml | 12 +++++++++--- .gitignore | 1 + README.md | 3 +++ eslint.config.mjs | 1 + 5 files changed, 20 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b24f014f..ed3b5ad7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,9 +6,14 @@ updates: interval: cron cronjob: "37 3 11 * *" timezone: Europe/Berlin + open-pull-requests-limit: 15 cooldown: default-days: 7 ignore: + - dependency-name: "typescript" + update-types: + - "version-update:semver-minor" + - "version-update:semver-major" - dependency-name: "@types/node" update-types: - "version-update:semver-major" @@ -20,4 +25,4 @@ updates: interval: cron cronjob: "17 4 23 * *" timezone: Europe/Berlin - open-pull-requests-limit: 30 + open-pull-requests-limit: 15 diff --git a/.github/workflows/test-and-release.yml b/.github/workflows/test-and-release.yml index 34956f56..67d7702f 100644 --- a/.github/workflows/test-and-release.yml +++ b/.github/workflows/test-and-release.yml @@ -13,10 +13,12 @@ on: - "v[0-9]+.[0-9]+.[0-9]+-**" pull_request: {} -# Cancel previous PR/branch runs when a new commit is pushed +# Cancel previous PR/branch runs when a new commit is pushed. +# Release runs (tag pushes) are never cancelled - cancelling them aborts the deploy job and +# leaves the release half finished, which the ioBroker repo checker reports as W3032. concurrency: - group: ${{ github.ref }} - cancel-in-progress: true + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }} jobs: # Performs quick checks before the expensive test runs @@ -39,7 +41,11 @@ jobs: needs: check-and-lint runs-on: ${{ matrix.os }} + timeout-minutes: 30 strategy: + # Do not cancel the remaining matrix legs when one of them fails, + # otherwise a single flaky OS/node combination hides all other results + fail-fast: false matrix: node-version: [22.x, 24.x] os: [ubuntu-latest, windows-latest, macos-latest] diff --git a/.gitignore b/.gitignore index 3753ffbe..cba5ff6e 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,7 @@ nbproject iobroker.*.tgz Thumbs.db +.DS_Store launch.json .commitinfo diff --git a/README.md b/README.md index c45c6f36..4010e760 100644 --- a/README.md +++ b/README.md @@ -330,6 +330,9 @@ This is a personal donation link for DutchmanNL and is not related to the ioBrok ### __WORK IN PROGRESS__ --> ## Changelog +### __WORK IN PROGRESS__ +* (DutchmanNL) Maintenance: raise Node.js to 22, modernise CI and release tooling, update dependencies, resolve repository checker findings + ### 0.5.6 (2026-08-02) * The monthly basic price is booked as a full charge when the tariff first becomes valid and at the beginning of every following calendar month, instead of being spread over the days of a month ([#1193](https://github.com/DrozmotiX/ioBroker.sourceanalytix/pull/1193)). * **Valid from** now also defines the first month the monthly basic price is charged, while tariffs without a validity date keep starting at the beginning of the current calendar year ([#1193](https://github.com/DrozmotiX/ioBroker.sourceanalytix/pull/1193)). diff --git a/eslint.config.mjs b/eslint.config.mjs index 63eb9fe2..6ecdfbbd 100644 --- a/eslint.config.mjs +++ b/eslint.config.mjs @@ -6,6 +6,7 @@ export default [ ignores: [ ".dev-server/", ".vscode/", + ".claude/", "*.test.js", "test/**/*.js", "admin/admin.d.ts", From 61eda37514b3e7eb5bde3621018b602c463d6355 Mon Sep 17 00:00:00 2001 From: DutchmanNL Date: Mon, 24 Aug 2026 12:01:58 +0200 Subject: [PATCH 2/2] ci: set least-privilege permissions for GITHUB_TOKEN Add a top-level `permissions: contents: read` default so the check-and-lint and adapter-tests jobs no longer run with a broadly-scoped GITHUB_TOKEN (CodeQL "Workflow does not contain permissions"). The deploy job keeps its own contents:write + id-token:write override. Co-Authored-By: Claude Fable 5 --- .github/workflows/test-and-release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/test-and-release.yml b/.github/workflows/test-and-release.yml index 67d7702f..7699af89 100644 --- a/.github/workflows/test-and-release.yml +++ b/.github/workflows/test-and-release.yml @@ -20,6 +20,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }} +# Restrict the default GITHUB_TOKEN to read-only; the deploy job widens this for itself. +permissions: + contents: read + jobs: # Performs quick checks before the expensive test runs check-and-lint: