From 4c2ca8159ab79c96f7db5f09fa78540c80b06014 Mon Sep 17 00:00:00 2001
From: Paul Smiechowicz <paul@designofadecade.com>
Date: Thu, 10 Sep 2026 09:03:30 -0400
Subject: [PATCH] chore(ci): update actions to latest and fix workflow
 permission alerts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every action was several majors behind and being force-run on Node 24, which
the runner reported as a deprecation warning on the 10.3.0 publish.

- actions/checkout        v4 -> v7
- actions/setup-node      v4 -> v7
- softprops/action-gh-release v1 -> v3
- codecov/codecov-action  v4 -> v7

Checked for breaking input changes rather than assuming: codecov v5 deprecated
`file`/`plugin`, neither of which this repo uses, and all five inputs it does
use still exist in v7. setup-node v5/v6 added automatic caching driven by a
`packageManager` field in package.json; there is none here and `cache: 'npm'`
stays explicit, so behaviour is unchanged.

Also resolves two medium CodeQL alerts (actions/missing-workflow-permissions),
one of which the typescript-next job introduced. Both workflows now declare a
read-only default with jobs opting in:

- publish-npm keeps `contents: write` for the GitHub Release and
  `id-token: write` for Trusted Publishing and provenance.
- Dropped `packages: write`, which was never used — this publishes to
  registry.npmjs.org, not GitHub Packages.

Made the lint step gating instead of `continue-on-error`. `eslint .` exits
non-zero only on errors, and the repo is at 0 errors, so the pre-existing
no-explicit-any warnings do not fail the build. Same for coverage generation,
which was already covered by the test step.
---
 .github/workflows/publish.yml | 24 +++++++++++--------
 .github/workflows/test.yml    | 45 +++++++++++++++++++++--------------
 2 files changed, 41 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 078c850..e4c2a42 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,36 +7,40 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
     permissions:
+      # Creating the GitHub Release.
       contents: write
-      packages: write
+      # Trusted Publishing (OIDC) and npm provenance attestations.
       id-token: write
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@v7
+
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
-          
+
       - name: Install dependencies
         run: npm ci
-      
+
       - name: Run tests
         run: npm test
-        
+
       - name: Build
         run: npm run build
-      
+
       - name: Publish to npm (Trusted Publishing)
         run: npm publish --provenance --access public
-      
+
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           generate_release_notes: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ccc96fe..39188cf 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,42 +6,49 @@ on:
   pull_request:
     branches: [main, develop]
 
+# Least privilege by default; jobs opt into more only if they need it.
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
-    
+    permissions:
+      contents: read
+
     strategy:
       matrix:
         node-version: [24.x]
-    
+
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@v7
+
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
-          
+
       - name: Install dependencies
         run: npm ci
-        
-      - name: Run linter (if configured)
-        run: npm run lint --if-present
-        continue-on-error: true
-        
+
+      # Gating, not advisory. `eslint .` exits non-zero only on errors, so the
+      # pre-existing `no-explicit-any` warnings do not fail the build.
+      - name: Run linter
+        run: npm run lint
+
+      # Also runs the *.test-d.ts type assertions via vitest --typecheck.
       - name: Run tests
         run: npm test
-        
+
       - name: Build
         run: npm run build
-        
+
       - name: Generate coverage report
         run: npm run test:coverage
-        continue-on-error: true
-        
+
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/coverage-final.json
@@ -57,12 +64,14 @@ jobs:
   typescript-next:
     runs-on: ubuntu-latest
     continue-on-error: true
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'