Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.4 in the github-actions group (#743)

* Bump zizmorcore/zizmor-action

Bumps the github-actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/3dc1ecc9bcb9e94e9b2c709687979e1298497054...cc914d7f3750a2d13d75c7f184a1060aa0e9d482)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix zizmor lints

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: bluwy <bjornlu.dev@gmail.com>

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           persona: pedantic
           annotations: true

.github/workflows/publish.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Select mode
         id: select-mode
-        uses: ./select-mode
+        uses: $/select-mode
 
   version:
     name: Version
@@ -62,7 +62,7 @@ jobs:
 
       - name: Create or update release pull request
         id: changesets
-        uses: ./version
+        uses: $/version
         with:
           github-token: ${{ steps.bot-auth.outputs.token }}
           script: pnpm bump
@@ -92,7 +92,7 @@ jobs:
           permission-contents: write # to bypass branch and tag protection rules (release.ts)
 
       - name: Publish to marketplace
-        uses: ./publish
+        uses: $/publish
         with:
           github-token: ${{ steps.bot-auth.outputs.token }}
           script: pnpm release

dist/index.js

@@ -1 +0,0 @@
-import{A as e,D as t,O as n,f as r,j as i,k as a,m as o,o as s,p as c,s as l}from"./utils-j_VOz275.js";import{n as u,r as d,t as f}from"./run-CIL9Fbt6.js";import{t as p}from"./readChangesetState-DLdyz-Wv.js";try{await m()}catch(t){e(t.message)}async function m(){let m=s(`cwd`)||process.cwd();await o(m),c({publish:`publish-script`,version:`version-script`,commit:`commit-message`,title:`pr-title`,branch:`pr-base-branch`,prDraft:`pr-draft`,createGithubReleases:`create-github-releases`}),r();let h=l(`github-token`);if(process.env.GITHUB_TOKEN&&process.env.GITHUB_TOKEN!==h)throw Error(`The GITHUB_TOKEN environment variable is set and does not match the "github-token" input. Please pass the custom GitHub token to the "github-token" input and remove the GITHUB_TOKEN environment variable to avoid conflicts.`);let g=t(`push-with-git-cli`),_=s(`pr-draft`);if(_!==void 0&&_!==`always`&&_!==`create`){e(`Invalid pr-draft: ${_}`);return}let v=new d({cwd:m,githubToken:h,pushWithGitCli:g}),{changesets:y}=await p(m),b=n(`publish-script`),x=y.length!==0,S=y.some(e=>e.releases.length>0),C=!!b;switch(i(`published`,`false`),i(`published-packages`,`[]`),i(`has-changesets`,String(x)),!0){case!x&&!C:a(`No changesets present or were removed by merging version PR. Not publishing because publish-script is not set.`);return;case!x&&C:{a(`No changesets found. Attempting to publish any unpublished packages to npm`);let e=t(`create-github-releases`),n=t(`push-git-tags`);if(e&&!n)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let r=await f({script:b,github:v,createGithubReleases:e,pushGitTags:n,cwd:m});if(r.published&&(i(`published`,`true`),i(`published-packages`,JSON.stringify(r.publishedPackages))),r.exitCode!==0)throw Error(`Publish command exited with code ${r.exitCode}${r.published?`, but some packages were published: ${r.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`);return}case x&&!S:a(`All changesets are empty. Not creating PR`);return;case x:{let{pullRequestNumber:e}=await u({script:s(`version-script`),github:v,cwd:m,prTitle:s(`pr-title`),commitMessage:s(`commit-message`),hasPublishScript:C,prDraft:_,branch:s(`pr-base-branch`)});i(`pr-number`,String(e));return}}}export{};

dist/pack.js

@@ -1 +0,0 @@
-import{A as e,j as t,m as n,n as r,o as i,t as a,y as o}from"./utils-j_VOz275.js";import s from"node:fs/promises";import c from"node:path";import l from"node:os";try{await u()}catch(t){e(t.message)}async function u(){let e=i(`cwd`)||process.cwd();await n(e);let r=i(`publish-plan-artifact-id`),a=process.env.RUNNER_TEMP??await s.realpath(l.tmpdir()),u=c.join(a,`changeset-pack-${Date.now()}`);await d(e,{outDir:u,publishPlanPath:r?await f(a,Number(r)):void 0});let m=await o.uploadArtifact(`changeset-pack-${Date.now()}`,await p(u),u,{retentionDays:30});if(m.id===void 0)throw Error(`Packed artifact upload did not return an artifact id`);t(`pack-dir-artifact-id`,String(m.id))}async function d(e,t){let n=[`pack`,`--out-dir`,t.outDir];t.publishPlanPath&&n.push(`--from-publish-plan`,t.publishPlanPath),await r(n,{cwd:e,env:process.env})}async function f(e,t){let n=await a(e,t,`changeset-publish-plan`);return c.join(n,`publish-plan.json`)}async function p(e){let t=await s.readdir(e,{withFileTypes:!0});return(await Promise.all(t.map(async t=>{let n=c.join(e,t.name);return t.isDirectory()?p(n):[n]}))).flat()}export{};

dist/pr-comment.js

@@ -1 +0,0 @@
-import{A as e,T as t,j as n,k as r,o as i,s as a,w as o}from"./utils-j_VOz275.js";try{await s()}catch(t){e(t.message)}async function s(){let e=o.payload.pull_request;if(!e)throw Error("This action should only be run on `pull_request_target` or `pull_request` events");let s=a(`github-token`),l=a(`body`),u=i(`update-id`),d=u?c(u):null,f=d?`${d}\n\n${l}`:l,p={repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number,body:f},m=t(s),h;if(d&&(r(`Checking for existing comment...`),h=await m.rest.issues.listComments({repo:e.base.repo.name,owner:e.base.repo.owner.login,issue_number:e.number}).then(e=>e.data.find(e=>e.body?.includes(d))?.id)),h)r(`Updating existing comment (id: ${h})...`),await m.rest.issues.updateComment({...p,comment_id:h}),n(`comment-id`,h);else{r(`Creating new comment...`);let e=await m.rest.issues.createComment(p);n(`comment-id`,e.data.id)}r(`Done!`)}function c(e){let t=`changesets-action-pr-comment`;return t===e?`<!-- ${t} -->`:`<!-- ${t}:${e} -->`}export{};

dist/publish.js

@@ -1 +0,0 @@
-import{A as e,D as t,j as n,m as r,o as i,s as a,t as o}from"./utils-j_VOz275.js";import{r as s,t as c}from"./run-CIL9Fbt6.js";import l from"node:fs/promises";import u from"node:os";try{await d()}catch(t){e(t.message)}async function d(){let e=i(`cwd`)||process.cwd();await r(e);let d=a(`github-token`),f=i(`script`),p=i(`pack-dir-artifact-id`),m=t(`create-github-releases`),h=t(`push-git-tags`);if(m&&!h)throw Error(`The input 'create-github-releases' is set to true, but 'push-git-tags' is set to false. Creating GitHub releases requires pushing git tags. Please set 'push-git-tags' to true or set 'create-github-releases' to false.`);let g=new s({cwd:e,githubToken:d}),_=p?await o(process.env.RUNNER_TEMP??await l.realpath(u.tmpdir()),Number(p),`changeset-pack`):void 0,v=await c({script:f,github:g,createGithubReleases:m,pushGitTags:h,cwd:e,fromPackDir:_});if(v.published?(n(`published`,`true`),n(`published-packages`,JSON.stringify(v.publishedPackages))):n(`published`,`false`),v.exitCode!==0)throw Error(`Publish command exited with code ${v.exitCode}${v.published?`, but some packages were published: ${v.publishedPackages.map(e=>`${e.name}@${e.version}`).join(`, `)}`:``}`)}export{};

dist/readChangesetState-DLdyz-Wv.js

@@ -1 +0,0 @@
-import{i as e,t}from"./dist-BjZhuI7Y.js";async function n(n=process.cwd()){let r=await e(n),i=await t(n);return r!==void 0&&r.mode===`pre`?{preState:r,changesets:i.filter(e=>!e.id.startsWith(`pre/`))}:{preState:void 0,changesets:i}}export{n as t};

dist/select-mode.js

@@ -1 +0,0 @@
-import{A as e,j as t,m as n,n as r,o as i,y as a}from"./utils-j_VOz275.js";import{t as o}from"./readChangesetState-DLdyz-Wv.js";import s from"node:fs/promises";import c from"node:path";import l from"node:os";try{await u()}catch(t){e(t.message)}async function u(){let e=i(`cwd`)||process.cwd();await n(e);let r=await d(e);if(t(`mode`,r.mode),r.mode===`publish`){let e=await a.uploadArtifact(c.basename(r.publishPlanPath,`.json`),[r.publishPlanPath],c.dirname(r.publishPlanPath),{skipArchive:!0,retentionDays:30});if(e.id===void 0)throw Error(`Publish plan artifact upload did not return an artifact id`);t(`publish-plan-artifact-id`,String(e.id))}}async function d(e){let{changesets:t}=await o(e);if(t.length>0)return t.some(e=>e.releases.length>0)?{mode:`version`}:{mode:`none`};let n=c.join(process.env.RUNNER_TEMP??await s.realpath(l.tmpdir()),`changeset-publish-plan-${Date.now()}`,`publish-plan.json`);return await r([`publish-plan`,`--output`,n],{cwd:e,env:process.env}),(await f(n)).length===0?{mode:`none`}:{mode:`publish`,publishPlanPath:n}}async function f(e){let t;try{t=await s.readFile(e,`utf8`)}catch(t){throw Error(`Failed to read publish plan at ${e}`,{cause:t})}let n;try{n=JSON.parse(t)}catch(t){throw Error(`Failed to parse publish plan at ${e}`,{cause:t})}if(typeof n!=`object`||!n||!(`version`in n)||typeof n.version!=`number`||!(`plan`in n)||!Array.isArray(n.plan))throw Error(`Invalid publish plan at ${e}: expected { version: number; plan: unknown[] }`);return n.plan}export{};

dist/version.js

@@ -1 +0,0 @@
-import{A as e,D as t,f as n,j as r,m as i,o as a,s as o}from"./utils-j_VOz275.js";import{n as s,r as c}from"./run-CIL9Fbt6.js";try{await l()}catch(t){e(t.message)}async function l(){let e=a(`cwd`)||process.cwd();await i(e),n();let l=o(`github-token`),u=a(`script`),d=o(`commit-message`),f=o(`pr-title`),p=a(`pr-draft`),m=a(`pr-base-branch`),h=t(`push-with-git-cli`);if(p!==void 0&&p!==`always`&&p!==`create`)throw Error(`Invalid pr-draft input: ${p}`);let g=new c({cwd:e,githubToken:l,pushWithGitCli:h}),{pullRequestNumber:_}=await s({script:u,github:g,cwd:e,prTitle:f,commitMessage:d,hasPublishScript:!0,prDraft:p,branch:m});r(`pr-number`,String(_))}export{};

package.json

@@ -23,33 +23,33 @@
     "@actions/core": "^3.0.1",
     "@actions/exec": "^3.0.0",
     "@actions/github": "^9.1.1",
-    "@changesets/get-release-plan": "^5.0.0",
+    "@changesets/get-release-plan": "^5.0.2",
     "@changesets/ghcommit": "^3.0.0",
-    "@changesets/git": "^4.0.0",
+    "@changesets/git": "^4.0.1",
     "@changesets/pre": "^3.0.0",
-    "@changesets/read": "^1.0.0",
+    "@changesets/read": "^1.0.1",
     "@manypkg/get-packages": "^3.1.0",
-    "@octokit/core": "^7.0.7",
+    "@octokit/core": "^7.0.8",
     "@octokit/plugin-throttling": "^11.0.5",
     "human-id": "^4.2.1",
     "markdown-table": "^3.0.4",
     "semver": "^7.8.5",
-    "tinyexec": "^1.3.0"
+    "tinyexec": "^1.3.1"
   },
   "devDependencies": {
-    "@changesets/changelog-github": "^1.0.0",
+    "@changesets/changelog-github": "^1.0.1",
-    "@changesets/cli": "^3.0.1",
+    "@changesets/cli": "^3.0.3",
     "@changesets/types": "^7.0.0",
     "@changesets/write": "^1.0.1",
     "@tsconfig/node24": "^24.0.5",
-    "@types/node": "^26.3.0",
+    "@types/node": "^26.6.2",
     "@types/semver": "^7.8.0",
-    "fs-fixture": "^2.14.0",
+    "fs-fixture": "^2.16.0",
-    "oxfmt": "^0.65.0",
+    "oxfmt": "^0.70.0",
-    "rolldown": "^1.2.5",
+    "rolldown": "^1.2.10",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
-    "vitest": "^4.1.11",
+    "vitest": "^5.0.1",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.1"
   },
   "engines": {
     "node": ">=24"