Merge branch 'main' into docs/blog-plugin

Author: trueberryless

.agents/PLUGINS.md

@@ -9,6 +9,13 @@ on:
     tags:
       - '!**'
 
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   test:
     strategy:
@@ -19,6 +26,8 @@ jobs:
           - windows-latest
     runs-on: ${{ matrix.os }}
     name: ${{ matrix.os }}
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

.github/workflows/ci-bun.yml

@@ -11,6 +11,13 @@ on:
     tags:
       - '!**'
 
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   test:
     strategy:
@@ -25,6 +32,8 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     name: ${{ matrix.os }} (Node v${{ matrix.node }})
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/ci-legacy-5.0.4.yml

@@ -11,10 +11,19 @@ on:
     tags:
       - '!**'
 
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
     name: Ubuntu/Node v22
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/ci-legacy-latest.yml

@@ -9,10 +9,19 @@ on:
     tags:
       - '!**'
 
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
     name: Ubuntu/Node v24
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/ci.yml

@@ -14,13 +14,21 @@ on:
     tags:
       - '!**'
 
-permissions:
-  issues: write
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
 
 jobs:
   publish:
     name: Build and publish Knip
+    if: ${{ github.repository_owner == 'webpro-nl' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write # comment on referenced issues
     outputs:
       sha: ${{ steps.publish.outputs.sha }}
     steps:
@@ -64,6 +72,8 @@ jobs:
     name: Run Knip in ${{ matrix.project.name }}
     needs: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       PKG_URL: https://pkg.pr.new/knip@${{ needs.publish.outputs.sha }}
       SNAP: ${{ github.workspace }}/.github/workflows/scripts/snap.sh
@@ -237,6 +247,8 @@ jobs:
     if: ${{ inputs.update_snapshots }}
     needs: integration
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:

.github/workflows/integration.yml

@@ -7,9 +7,18 @@ on:
     tags:
       - '!**'
 
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 

.github/workflows/markdown-link-check.yml

@@ -1,3 +1,5 @@
+Unlisted binaries (1)
+scripts/create-github-release.mjs: gh
 Unused exported types (2)
 packages/lit-query/src/createQueriesController.ts: CreateQueriesOptions
 packages/preact-query/src/__tests__/ErrorBoundary/types.ts: ErrorBoundaryPropsWithComponent, ErrorBoundaryPropsWithRender, ErrorBoundaryPropsWithFallback

.github/workflows/snapshots/query.txt

@@ -14,7 +14,8 @@
       "entry": ["{remark,scripts}/*.ts"]
     },
     "packages/vscode-knip": {
-      "entry": ["src/index.js!", "scripts/*.js", "test/*.mjs"]
+      "entry": ["src/index.js!", "scripts/*.js", "test/*.mjs"],
+      "ignoreBinaries": ["vsce", "ovsx"]
     }
   }
 }