From 2cf042088ff05dd055f649d5bc7b085e418c02b3 Mon Sep 17 00:00:00 2001 From: Ryan Cavanaugh Date: Tue, 2 Jun 2026 11:02:41 -0700 Subject: [PATCH 01/11] Delete browser-integration job from ci.yml (#63528) --- .github/workflows/ci.yml | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ca285bdb25f0e..912275e9954b3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -209,24 +209,6 @@ jobs: - name: Check formatting run: npx dprint check - browser-integration: - if: ${{ github.event_name != 'merge_group' }} - - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 - with: - node-version: 'lts/*' - - run: npm ci - - - name: Installing browsers - run: npx playwright install --with-deps - - - name: Validate the browser can import TypeScript - run: npx hereby test-browser-integration - typecheck: runs-on: ubuntu-latest @@ -422,7 +404,6 @@ jobs: - lint - knip - format - - browser-integration - typecheck - smoke - package-size From 6fbce89821d93a5b761581d9ac540455f38e9acb Mon Sep 17 00:00:00 2001 From: Ievgen Bondarenko Date: Thu, 4 Jun 2026 13:43:55 -0700 Subject: [PATCH 02/11] Update toFixed/toExponential/toPrecision digit range in docs to match the spec (#63516) --- src/lib/es5.d.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/lib/es5.d.ts b/src/lib/es5.d.ts index ced21a6d72af1..673ac55e47612 100644 --- a/src/lib/es5.d.ts +++ b/src/lib/es5.d.ts @@ -547,19 +547,19 @@ interface Number { /** * Returns a string representing a number in fixed-point notation. - * @param fractionDigits Number of digits after the decimal point. Must be in the range 0 - 20, inclusive. + * @param fractionDigits Number of digits after the decimal point. Must be in the range 0 - 100, inclusive. */ toFixed(fractionDigits?: number): string; /** * Returns a string containing a number represented in exponential notation. - * @param fractionDigits Number of digits after the decimal point. Must be in the range 0 - 20, inclusive. + * @param fractionDigits Number of digits after the decimal point. Must be in the range 0 - 100, inclusive. */ toExponential(fractionDigits?: number): string; /** * Returns a string containing a number represented either in exponential or fixed-point notation with a specified number of digits. - * @param precision Number of significant digits. Must be in the range 1 - 21, inclusive. + * @param precision Number of significant digits. Must be in the range 1 - 100, inclusive. */ toPrecision(precision?: number): string; From 7539c04d94b5adc924efb3f8fef90e4de18d39d3 Mon Sep 17 00:00:00 2001 From: niteagent <75220825+driphtyio@users.noreply.github.com> Date: Fri, 5 Jun 2026 16:12:43 -0700 Subject: [PATCH 03/11] =?UTF-8?q?Fix=20JSDoc=20grammar=20typo:=20'returns?= =?UTF-8?q?=20a=20undefined'=20=E2=86=92=20'returns=20undefined'=20(#63525?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Tech-Savvy Builder --- src/lib/es2015.symbol.d.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/es2015.symbol.d.ts b/src/lib/es2015.symbol.d.ts index 9ede0239fafbe..32bb690d3189c 100644 --- a/src/lib/es2015.symbol.d.ts +++ b/src/lib/es2015.symbol.d.ts @@ -19,7 +19,7 @@ interface SymbolConstructor { /** * Returns a key from the global symbol registry matching the given Symbol if found. - * Otherwise, returns a undefined. + * Otherwise, returns undefined. * @param sym Symbol to find the key for. */ keyFor(sym: symbol): string | undefined; From 345012d5a9c9f047f44dbf32d0348921c5072c2f Mon Sep 17 00:00:00 2001 From: Jake Bailey <5341706+jakebailey@users.noreply.github.com> Date: Mon, 8 Jun 2026 12:58:53 -0700 Subject: [PATCH 04/11] Switch from bot PAT to GitHub App token via Azure Key Vault (#63538) --- .../workflows/accept-baselines-fix-lints.yaml | 31 +- .github/workflows/close-issues.yml | 24 +- .github/workflows/create-cherry-pick-pr.yml | 36 +- .github/workflows/lkg.yml | 31 +- .github/workflows/new-release-branch.yaml | 35 +- .github/workflows/pr-modified-files.yml | 31 +- .github/workflows/set-version.yaml | 33 +- .github/workflows/sync-branch.yaml | 33 +- .github/workflows/sync-wiki.yml | 35 +- .github/workflows/twoslash-repros.yaml | 24 +- .github/workflows/update-package-lock.yaml | 37 +- azure-pipelines.release-publish.yml | 110 +++- scripts/create-github-app-token.yml | 614 ++++++++++++++++++ 13 files changed, 1025 insertions(+), 49 deletions(-) create mode 100644 scripts/create-github-app-token.yml diff --git a/.github/workflows/accept-baselines-fix-lints.yaml b/.github/workflows/accept-baselines-fix-lints.yaml index 15280cfa7814c..64c0f49d91f28 100644 --- a/.github/workflows/accept-baselines-fix-lints.yaml +++ b/.github/workflows/accept-baselines-fix-lints.yaml @@ -5,6 +5,7 @@ on: permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -15,11 +16,14 @@ defaults: jobs: build: runs-on: ubuntu-latest + environment: + name: azure + deployment: false steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + persist-credentials: false - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 'lts/*' @@ -37,4 +41,27 @@ jobs: git add ./tests/baselines/reference git diff --cached git commit -m "Update Baselines, Applied Lint Fixes, and/or Formatted" - git push + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + - name: Configure git for GitHub App token + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" + - run: git push diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml index 5c819fc636644..62c777b7d1715 100644 --- a/.github/workflows/close-issues.yml +++ b/.github/workflows/close-issues.yml @@ -7,6 +7,7 @@ on: permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -17,15 +18,36 @@ defaults: jobs: close-issues: runs-on: ubuntu-latest + environment: + name: azure + deployment: false if: github.repository == 'microsoft/TypeScript' permissions: contents: read # Apparently required to create issues + id-token: write issues: write steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-issues: write - name: Close issues env: - GH_TOKEN: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} REPO: ${{ github.repository }} run: | DATE=$(date --date='2 days ago' --iso-8601) diff --git a/.github/workflows/create-cherry-pick-pr.yml b/.github/workflows/create-cherry-pick-pr.yml index ecdd770e02776..a09226521daf6 100644 --- a/.github/workflows/create-cherry-pick-pr.yml +++ b/.github/workflows/create-cherry-pick-pr.yml @@ -34,6 +34,7 @@ run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0}) permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -44,6 +45,9 @@ defaults: jobs: open-pr: runs-on: ubuntu-latest + environment: + name: azure + deployment: false if: github.repository == 'microsoft/TypeScript' steps: @@ -51,8 +55,32 @@ jobs: with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} - + persist-credentials: false + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + permission-issues: write + permission-pull-requests: write + - name: Configure git for GitHub App token + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 id: open-pr env: @@ -64,7 +92,7 @@ jobs: STATUS_COMMENT: ${{ inputs.status_comment }} with: retries: 3 - github-token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} result-encoding: string script: | const { @@ -182,7 +210,7 @@ jobs: with: success_comment: ${{ steps.open-pr.outputs.result }} failure_comment: 'I was unable to cherry-pick this PR.' - github_token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + github_token: ${{ steps.app-token.outputs.token }} distinct_id: ${{ inputs.distinct_id }} source_issue: ${{ inputs.source_issue }} requesting_user: ${{ inputs.requesting_user }} diff --git a/.github/workflows/lkg.yml b/.github/workflows/lkg.yml index 69601b61a902a..4ac50669f600b 100644 --- a/.github/workflows/lkg.yml +++ b/.github/workflows/lkg.yml @@ -10,6 +10,7 @@ on: permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -20,6 +21,9 @@ defaults: jobs: build: runs-on: ubuntu-latest + environment: + name: azure + deployment: false steps: - env: BRANCH_NAME: ${{ inputs.branch_name }} @@ -32,7 +36,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ inputs.branch_name }} - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + persist-credentials: false - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 'lts/*' @@ -48,4 +52,27 @@ jobs: git config user.email "typescriptbot@microsoft.com" git config user.name "TypeScript Bot" git commit -m 'Update LKG' - git push + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + - name: Configure git for GitHub App token + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" + - run: git push diff --git a/.github/workflows/new-release-branch.yaml b/.github/workflows/new-release-branch.yaml index 06a52bd6cc9f5..495389f1e27df 100644 --- a/.github/workflows/new-release-branch.yaml +++ b/.github/workflows/new-release-branch.yaml @@ -38,6 +38,7 @@ run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0}) permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -48,13 +49,16 @@ defaults: jobs: build: runs-on: ubuntu-latest + environment: + name: azure + deployment: false steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + persist-credentials: false - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 'lts/*' @@ -85,14 +89,39 @@ jobs: git config user.email "typescriptbot@microsoft.com" git config user.name "TypeScript Bot" git commit -m "Bump version to $PACKAGE_VERSION and LKG" - git push --set-upstream origin "$BRANCH_NAME" + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + - name: Configure git for GitHub App token + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" + - env: + BRANCH_NAME: ${{ inputs.branch_name }} + run: git push --set-upstream origin "$BRANCH_NAME" - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master if: ${{ !cancelled() && inputs.distinct_id }} with: success_comment: "I've created ${{ inputs.branch_name }} with version ${{ inputs.package_version }} for you." failure_comment: 'I was unable to create the new release branch.' - github_token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + github_token: ${{ steps.app-token.outputs.token }} distinct_id: ${{ inputs.distinct_id }} source_issue: ${{ inputs.source_issue }} requesting_user: ${{ inputs.requesting_user }} diff --git a/.github/workflows/pr-modified-files.yml b/.github/workflows/pr-modified-files.yml index 71f0aa908c85c..af4c35867d4cc 100644 --- a/.github/workflows/pr-modified-files.yml +++ b/.github/workflows/pr-modified-files.yml @@ -17,6 +17,7 @@ concurrency: permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -27,17 +28,37 @@ defaults: jobs: manage-prs: runs-on: ubuntu-latest + environment: + name: azure + deployment: false if: github.repository == 'microsoft/TypeScript' - # No need to set explicit permissions; we are using typescript-bot's token, not github-actions' token. + # No need to set explicit permissions; we are using the GitHub App token, not github-actions' token. env: - GH_TOKEN: ${{ secrets.TS_BOT_GITHUB_TOKEN }} PR_NUMBER: ${{ github.event.pull_request.number }} PR_AUTHOR: ${{ github.event.pull_request.user.login }} REPO: ${{ github.repository }} steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-issues: write + permission-pull-requests: write - name: Check if PR author is in pr_owners.txt id: pr_owner run: | @@ -91,6 +112,8 @@ jobs: - name: Generated DOM files if: steps.pr_owner.outputs.pr_owner == 'false' + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | if ./is_changed.sh "src/lib/dom.generated.d.ts" \ "src/lib/dom.iterable.generated.d.ts" \ @@ -107,6 +130,8 @@ jobs: fi - name: Check if PR modifies protocol.ts + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | if ./is_changed.sh "src/server/protocol.ts"; then MESSAGE="Thanks for the PR! It looks like you've changed the TSServer protocol in some way." @@ -122,6 +147,8 @@ jobs: fi - name: Check for breaking changes + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | if ./is_changed.sh "tests/baselines/reference/api/typescript.d.ts"; then MESSAGE="Looks like you're introducing a change to the public API surface area." diff --git a/.github/workflows/set-version.yaml b/.github/workflows/set-version.yaml index cd32ffd0028d8..0efbc6919b77f 100644 --- a/.github/workflows/set-version.yaml +++ b/.github/workflows/set-version.yaml @@ -38,6 +38,7 @@ run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0}) permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -48,11 +49,14 @@ defaults: jobs: build: runs-on: ubuntu-latest + environment: + name: azure + deployment: false steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ inputs.branch_name }} - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + persist-credentials: false - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 'lts/*' @@ -88,14 +92,37 @@ jobs: git config user.email "typescriptbot@microsoft.com" git config user.name "TypeScript Bot" git commit -m "Bump version to $PACKAGE_VERSION and LKG" - git push + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + - name: Configure git for GitHub App token + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" + - run: git push - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master if: ${{ !cancelled() && inputs.distinct_id }} with: success_comment: "I've set the version of ${{ inputs.branch_name }} to ${{ inputs.package_version }} for you." failure_comment: 'I was unable set the version.' - github_token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + github_token: ${{ steps.app-token.outputs.token }} distinct_id: ${{ inputs.distinct_id }} source_issue: ${{ inputs.source_issue }} requesting_user: ${{ inputs.requesting_user }} diff --git a/.github/workflows/sync-branch.yaml b/.github/workflows/sync-branch.yaml index e3bb90894abc3..56e70f9b50b76 100644 --- a/.github/workflows/sync-branch.yaml +++ b/.github/workflows/sync-branch.yaml @@ -30,6 +30,7 @@ run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0}) permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -40,6 +41,9 @@ defaults: jobs: build: runs-on: ubuntu-latest + environment: + name: azure + deployment: false steps: - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 @@ -50,7 +54,7 @@ jobs: ref: ${{ inputs.branch_name }} filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + persist-credentials: false # required client_payload members: # branch_name - the target branch - run: | @@ -62,14 +66,37 @@ jobs: npx hereby LKG git add --force ./lib git commit -m 'Update LKG' - git push + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + - name: Configure git for GitHub App token + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" + - run: git push - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master if: ${{ !cancelled() && inputs.distinct_id }} with: success_comment: "I've pulled main into ${{ inputs.branch_name }} for you." failure_comment: 'I was unable merge main into ${{ inputs.branch_name }}.' - github_token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + github_token: ${{ steps.app-token.outputs.token }} distinct_id: ${{ inputs.distinct_id }} source_issue: ${{ inputs.source_issue }} requesting_user: ${{ inputs.requesting_user }} diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml index ebe024316b7ef..eafc2f3a2df7e 100644 --- a/.github/workflows/sync-wiki.yml +++ b/.github/workflows/sync-wiki.yml @@ -4,6 +4,7 @@ on: [gollum] permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -14,17 +15,45 @@ defaults: jobs: sync: runs-on: ubuntu-latest + environment: + name: azure + deployment: false steps: - name: Get repo name run: R=${GITHUB_REPOSITORY%?wiki}; echo "BASENAME=${R##*/}" >> $GITHUB_ENV - name: Checkout ${{ env.BASENAME }}-wiki uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - repository: '${{ GITHUB.repository_owner }}/${{ env.BASENAME }}-wiki' - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + repository: '${{ github.repository_owner }}/${{ env.BASENAME }}-wiki' fetch-depth: 0 + persist-credentials: false + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: | + TypeScript + TypeScript-wiki + permission-contents: write + - name: Configure git for GitHub App token + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" - name: Run sync run: ./.github/workflows/sync env: PUSHER: typescript-bot - AUTH: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + AUTH: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/twoslash-repros.yaml b/.github/workflows/twoslash-repros.yaml index 26de5f9d70d55..db24db7be438f 100644 --- a/.github/workflows/twoslash-repros.yaml +++ b/.github/workflows/twoslash-repros.yaml @@ -38,6 +38,7 @@ run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0}) permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -49,19 +50,40 @@ jobs: run: if: ${{ github.repository == 'microsoft/TypeScript' }} runs-on: ubuntu-latest + environment: + name: azure + deployment: false steps: - if: ${{ github.event.inputs.bisect }} uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. + persist-credentials: false - if: ${{ !github.event.inputs.bisect }} uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + permission-issues: write - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 'lts/*' - uses: microsoft/TypeScript-Twoslash-Repro-Action@master with: - github-token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} issue: ${{ github.event.inputs.issue }} bisect: ${{ github.event.inputs.bisect }} diff --git a/.github/workflows/update-package-lock.yaml b/.github/workflows/update-package-lock.yaml index 592989ec4864c..e1e7dc6101d36 100644 --- a/.github/workflows/update-package-lock.yaml +++ b/.github/workflows/update-package-lock.yaml @@ -9,6 +9,7 @@ on: permissions: contents: read + id-token: write # Ensure scripts are run with pipefail. See: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference @@ -19,12 +20,15 @@ defaults: jobs: build: runs-on: ubuntu-latest + environment: + name: azure + deployment: false if: github.repository == 'microsoft/TypeScript' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - token: ${{ secrets.TS_BOT_GITHUB_TOKEN }} + persist-credentials: false - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: 'lts/*' @@ -35,12 +39,14 @@ jobs: npm --version - name: Update package-lock.json and push + id: update run: | rm package-lock.json npm install if git diff --exit-code --name-only package-lock.json; then echo "No change." + echo "changed=false" >> "$GITHUB_OUTPUT" else npm test npx hereby LKG @@ -48,5 +54,32 @@ jobs: git config user.name "TypeScript Bot" git add -f package-lock.json git commit -m "Update package-lock.json" - git push + echo "changed=true" >> "$GITHUB_OUTPUT" fi + - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + if: steps.update.outputs.changed == 'true' + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - name: Create GitHub App token + if: steps.update.outputs.changed == 'true' + id: app-token + uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 + with: + client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} + key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} + owner: microsoft + repositories: TypeScript + permission-contents: write + - name: Push + if: steps.update.outputs.changed == 'true' + shell: bash + env: + GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + set -euo pipefail + basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" + echo "::add-mask::$basic_auth" + git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" + git push diff --git a/azure-pipelines.release-publish.yml b/azure-pipelines.release-publish.yml index 3b5cd831455f7..3103fa403f21c 100644 --- a/azure-pipelines.release-publish.yml +++ b/azure-pipelines.release-publish.yml @@ -28,6 +28,10 @@ variables: value: ${{ parameters.RELEASE_TITLE_NAME }} - name: TAG_NAME value: ${{ parameters.TAG_NAME }} + - name: TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID + value: 'Iv23li4GolzJSEp1mzHI' + - name: TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID + value: 'https://jststeam-passwords.vault.azure.net/keys/typescript-automation' resources: pipelines: @@ -133,26 +137,86 @@ extends: echo "##vso[task.setvariable variable=GIT_COMMIT_HASH]$GIT_COMMIT_HASH" echo "Git commit hash: $GIT_COMMIT_HASH" - - task: GitHubRelease@1 - displayName: GitHub release (create) - inputs: - # This must match the service connection name. - gitHubConnection: typescript-bot connection - repositoryName: microsoft/TypeScript - tagSource: userSpecifiedTag - tag: $(TAG_NAME) - title: TypeScript $(RELEASE_TITLE_NAME) - target: $(GIT_COMMIT_HASH) - releaseNotesSource: inline - releaseNotesInline: | - - assets: $(Pipeline.Workspace)/tgz/**/typescript-*.tgz - isDraft: ${{ not(eq(parameters.PUBLISH_TAG, 'latest')) }} - addChangeLog: false + - template: scripts/create-github-app-token.yml + parameters: + repositories: TypeScript + permissions: contents:write + insertSteps: + - task: CmdLine@2 + displayName: GitHub release (create) + inputs: + script: | + set -euo pipefail + + TARBALL=$(find "$(Pipeline.Workspace)/tgz" -maxdepth 2 -name 'typescript-*.tgz' -type f | head -1) + if [ -z "$TARBALL" ] || [ ! -f "$TARBALL" ]; then + echo "ERROR: no typescript-*.tgz tarball found under $(Pipeline.Workspace)/tgz" >&2 + exit 1 + fi + TARBALL_NAME=$(basename "$TARBALL") + + if [ "$PUBLISH_TAG" = "latest" ]; then + FINAL_DRAFT=false + else + FINAL_DRAFT=true + fi + + RELEASE_BODY='' + export RELEASE_BODY + + echo "Creating draft release $TAG_NAME at $GIT_COMMIT_HASH" + + # Create as draft first, then upload asset, then set final draft state. + # This avoids a half-created non-draft release if the upload fails. + RESPONSE=$(curl -fsS \ + -X POST \ + -H "Authorization: Bearer $GH_TOKEN" \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "https://api.github.com/repos/microsoft/TypeScript/releases" \ + -d "$(node -e "process.stdout.write(JSON.stringify({ + tag_name: process.env.TAG_NAME, + target_commitish: process.env.GIT_COMMIT_HASH, + name: 'TypeScript ' + process.env.RELEASE_TITLE_NAME, + body: process.env.RELEASE_BODY, + draft: true + }))")") + + RELEASE_ID=$(node -e "process.stdout.write(String(JSON.parse(process.argv[1]).id))" "$RESPONSE") + UPLOAD_URL=$(node -e "process.stdout.write(JSON.parse(process.argv[1]).upload_url.replace('{?name,label}',''))" "$RESPONSE") + echo "Release ID: $RELEASE_ID" + echo "Upload URL: $UPLOAD_URL" + echo "Uploading $TARBALL_NAME" + + curl -fsS \ + -X POST \ + -H "Authorization: Bearer $GH_TOKEN" \ + -H "Accept: application/vnd.github+json" \ + -H "Content-Type: application/gzip" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "${UPLOAD_URL}?name=${TARBALL_NAME}" \ + --data-binary "@${TARBALL}" + + # Set the final draft state (may undraft the release). + curl -fsS \ + -X PATCH \ + -H "Authorization: Bearer $GH_TOKEN" \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "https://api.github.com/repos/microsoft/TypeScript/releases/${RELEASE_ID}" \ + -d "{\"draft\": ${FINAL_DRAFT}}" + + echo "Release created (draft=$FINAL_DRAFT) and tarball uploaded." + env: + GH_TOKEN: $(GH_TOKEN) + TAG_NAME: $(TAG_NAME) + GIT_COMMIT_HASH: $(GIT_COMMIT_HASH) + PUBLISH_TAG: $(PUBLISH_TAG) + RELEASE_TITLE_NAME: $(RELEASE_TITLE_NAME) diff --git a/scripts/create-github-app-token.yml b/scripts/create-github-app-token.yml new file mode 100644 index 0000000000000..ae93c18288992 --- /dev/null +++ b/scripts/create-github-app-token.yml @@ -0,0 +1,614 @@ +# Step template for creating a GitHub App token via Azure Key Vault. +# This template can be used in release jobs where checkout is not available. +# The CLI script from microsoft/create-github-app-token-via-key-vault is inlined below. +# +# The token is created and stored in an Azure Pipelines variable (default: GH_TOKEN). +# A revocation step runs at the end with condition: always(). +# To use the token, add your steps between this template's create and revoke steps +# by setting insertSteps. + +parameters: + - name: azureSubscription + type: string + default: 'TypeScript Public CI' + - name: owner + type: string + default: 'microsoft' + - name: repositories + type: string + - name: permissions + type: string + - name: tokenVariable + type: string + default: 'GH_TOKEN' + - name: insertSteps + type: stepList + default: [] + +steps: + - task: AzureCLI@2 + displayName: Create GitHub App token + inputs: + azureSubscription: ${{ parameters.azureSubscription }} + scriptType: bash + scriptLocation: inlineScript + inlineScript: | + cat << 'GITHUB_APP_TOKEN_CLI_EOF' > /tmp/create-github-app-token.cjs + "use strict"; + + // src/api.ts + var defaultRefreshWindowMs = 5 * 60 * 1e3; + var defaultGitHubApiUrl = "https://api.github.com"; + var transientRetryCount = 3; + var GitHubRequestError = class extends Error { + status; + constructor(message, status) { + super(message); + this.status = status; + } + }; + function assertValue(value, message) { + if (!value) { + throw new Error(message); + } + return value; + } + function base64url(value) { + return Buffer.from(value).toString("base64url"); + } + async function sleep(ms) { + await new Promise((resolve) => setTimeout(resolve, ms)); + } + function isRetryableError(error) { + return error instanceof GitHubRequestError ? error.status >= 500 : error instanceof TypeError; + } + async function retryTransient(operation) { + for (let attempt = 0; ; attempt++) { + try { + return await operation(); + } catch (error) { + if (attempt >= transientRetryCount || !isRetryableError(error)) { + throw error; + } + await sleep(2 ** attempt * 1e3); + } + } + } + function splitRepositoryNames(repositories) { + if (Array.isArray(repositories)) { + return repositories.map((repo) => `${repo}`.trim()).filter(Boolean); + } + if (typeof repositories === "string") { + return repositories.split(/[,\n]/).map((repo) => repo.trim()).filter(Boolean); + } + return []; + } + function stableObject(value) { + if (!value || typeof value !== "object" || Array.isArray(value)) { + return value; + } + return Object.fromEntries( + Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, stableObject(entry)]) + ); + } + function githubHeaders(token, json = false) { + return { + "Accept": "application/vnd.github+json", + "Authorization": `Bearer ${token}`, + ...json ? { "Content-Type": "application/json" } : {}, + "X-GitHub-Api-Version": "2022-11-28" + }; + } + function isRecord(value) { + return typeof value === "object" && value !== null && !Array.isArray(value); + } + function requiredIntegerProperty(value, property, failureMessage) { + const propertyValue = isRecord(value) ? value[property] : void 0; + if (typeof propertyValue !== "number" || !Number.isInteger(propertyValue)) { + throw new Error(failureMessage); + } + return propertyValue; + } + function requiredStringProperty(value, property, failureMessage) { + const propertyValue = isRecord(value) ? value[property] : void 0; + if (typeof propertyValue !== "string" || !propertyValue) { + throw new Error(failureMessage); + } + return propertyValue; + } + function validatePermissionName(key) { + if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) { + throw new Error(`Invalid permission name: ${key}`); + } + } + function validatePermissionLevel(key, level) { + if (level !== "read" && level !== "write" && level !== "admin") { + throw new Error(`Invalid permission level for ${key}: ${level}`); + } + return level; + } + function validatePermissions(value) { + if (value === void 0) { + return void 0; + } + if (!isRecord(value)) { + throw new Error("permissions must be an object"); + } + const permissions = {}; + for (const [key, level] of Object.entries(value)) { + validatePermissionName(key); + permissions[key] = validatePermissionLevel(key, level); + } + return Object.keys(permissions).length === 0 ? void 0 : permissions; + } + async function requestJson(url, init, failureMessage) { + const response = await fetch(url, init); + const body = await response.text(); + if (!response.ok) { + throw new GitHubRequestError( + `${failureMessage}: ${response.status} ${response.statusText}: ${body}`, + response.status + ); + } + try { + return JSON.parse(body); + } catch { + throw new Error(`${failureMessage}: GitHub returned invalid JSON`); + } + } + async function requestNoContent(url, init, failureMessage) { + const response = await fetch(url, init); + if (!response.ok) { + const body = await response.text(); + throw new GitHubRequestError( + `${failureMessage}: ${response.status} ${response.statusText}: ${body}`, + response.status + ); + } + } + function parseRepositoryInput(input) { + const parts = input.split("/"); + if (parts.length === 1 && parts[0]) { + return { input, name: parts[0] }; + } + if (parts.length === 2 && parts[0] && parts[1]) { + return { input, owner: parts[0], name: parts[1] }; + } + throw new Error(`Invalid repository '${input}'. Expected 'repository' or 'owner/repository'.`); + } + function normalizeRepositoryTarget(owner, repositories, defaultOwner) { + const parsedRepositories = repositories.map(parseRepositoryInput); + const repositoryOwner = parsedRepositories.find((repository) => repository.owner)?.owner; + const parsedOwner = owner || defaultOwner || repositoryOwner; + if (!parsedOwner) { + throw new Error("owner is required when repositories are provided"); + } + const mismatchedRepository = parsedRepositories.find( + (repository) => repository.owner && repository.owner.toLowerCase() !== parsedOwner.toLowerCase() + ); + if (mismatchedRepository) { + throw new Error( + `Repository '${mismatchedRepository.input}' includes owner '${mismatchedRepository.owner}', which does not match the resolved owner '${parsedOwner}'.` + ); + } + return { + owner: parsedOwner, + repositories: parsedRepositories.map((repository) => repository.name) + }; + } + function resolveInstallationTarget(options, defaultOwner) { + const repositories = splitRepositoryNames(options.repositories ?? options.repositoryNames); + if (options.enterprise) { + if (options.owner || repositories.length > 0) { + throw new Error("Cannot use 'enterprise' with 'owner' or 'repositories'"); + } + return { type: "enterprise", enterprise: options.enterprise }; + } + const owner = assertValue(options.owner ?? defaultOwner, "owner is required to discover installation ID"); + if (repositories.length === 0) { + return { type: "owner", owner }; + } + return { type: "repository", owner, repositories }; + } + function createGitHubAppAuth(options) { + assertValue(options.appClientId, "appClientId is required"); + assertValue(options.signer, "signer is required"); + const appClientId = options.appClientId; + const signer = options.signer; + const defaultOwner = options.defaultOwner; + const refreshWindowMs = options.refreshWindowMs ?? defaultRefreshWindowMs; + const githubApiUrl = options.githubApiUrl ?? defaultGitHubApiUrl; + const installationCache = /* @__PURE__ */ new Map(); + const tokenCache = /* @__PURE__ */ new Map(); + async function createJwt() { + const now = Math.floor(Date.now() / 1e3); + const iat = now - 60; + const exp = now + 9 * 60; + const header = base64url(JSON.stringify({ typ: "JWT", alg: "RS256" })); + const payload = base64url(JSON.stringify({ iat, exp, iss: appClientId })); + const signingInput = `${header}.${payload}`; + const signature = await signer(signingInput); + return `${signingInput}.${signature}`; + } + async function discoverInstallation(target) { + const cacheKey = JSON.stringify(target); + const cached = installationCache.get(cacheKey); + if (cached !== void 0) { + return cached; + } + const jwt = await createJwt(); + let installation; + switch (target.type) { + case "enterprise": + installation = await requestJson( + `${githubApiUrl}/enterprises/${target.enterprise}/installation`, + { headers: githubHeaders(jwt) }, + "Could not discover GitHub App installation ID" + ); + break; + case "owner": + try { + installation = await requestJson( + `${githubApiUrl}/orgs/${target.owner}/installation`, + { headers: githubHeaders(jwt) }, + "Could not discover GitHub App installation ID" + ); + } catch (error) { + if (!(error instanceof GitHubRequestError) || error.status !== 404) { + throw error; + } + installation = await requestJson( + `${githubApiUrl}/users/${target.owner}/installation`, + { headers: githubHeaders(jwt) }, + "Could not discover GitHub App installation ID" + ); + } + break; + case "repository": + installation = await requestJson( + `${githubApiUrl}/repos/${target.owner}/${assertValue(target.repositories[0], "repository is required")}/installation`, + { headers: githubHeaders(jwt) }, + "Could not discover GitHub App installation ID" + ); + break; + } + const result = { + id: requiredIntegerProperty(installation, "id", "GitHub did not return an installation ID"), + appSlug: requiredStringProperty(installation, "app_slug", "GitHub did not return an App slug") + }; + installationCache.set(cacheKey, result); + return result; + } + async function getInstallationToken(options2) { + const target = resolveInstallationTarget(options2, defaultOwner); + const permissions = validatePermissions(options2.permissions); + return retryTransient(async () => { + const installation = await discoverInstallation(target); + const repositories = target.type === "repository" ? target.repositories : []; + const cacheKey = JSON.stringify({ + installationId: installation.id, + repositories: [...repositories].sort(), + permissions: stableObject(permissions) + }); + const cached = tokenCache.get(cacheKey); + if (cached && Date.now() < new Date(cached.expiresAt).getTime() - refreshWindowMs) { + return cached; + } + const jwt = await createJwt(); + const body = { + ...repositories.length > 0 ? { repositories } : {}, + ...permissions ? { permissions } : {} + }; + const token = await requestJson( + `${githubApiUrl}/app/installations/${installation.id}/access_tokens`, + { + method: "POST", + headers: githubHeaders(jwt, true), + body: JSON.stringify(body) + }, + "Could not create GitHub App installation token" + ); + const result = { + token: requiredStringProperty(token, "token", "GitHub did not return an installation token"), + expiresAt: requiredStringProperty( + token, + "expires_at", + "GitHub did not return an installation token expiration" + ), + installationId: installation.id, + appSlug: installation.appSlug, + repositories, + permissions: isRecord(token) && isRecord(token["permissions"]) ? token["permissions"] : permissions ?? {} + }; + tokenCache.set(cacheKey, result); + return result; + }); + } + async function getToken(options2) { + return (await getInstallationToken(options2)).token; + } + async function revokeToken(token) { + await requestNoContent( + `${githubApiUrl}/installation/token`, + { + method: "DELETE", + headers: githubHeaders(token) + }, + "Could not revoke GitHub App installation token" + ); + } + return { + getInstallationToken, + getToken, + revokeToken + }; + } + + // src/azureCliSigner.ts + var import_node_child_process = require("node:child_process"); + var import_node_crypto = require("node:crypto"); + var cachedAzCommand; + function isRecord2(value) { + return typeof value === "object" && value !== null; + } + function base64ToBase64url(value) { + return value.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, ""); + } + function commandExists(command) { + try { + (0, import_node_child_process.execFileSync)("where.exe", [command], { + encoding: "utf8", + stdio: ["ignore", "ignore", "ignore"] + }); + return true; + } catch { + return false; + } + } + function azCommand() { + if (cachedAzCommand) { + return cachedAzCommand; + } + if (process.platform !== "win32") { + cachedAzCommand = { command: "az", argsPrefix: [] }; + return cachedAzCommand; + } + for (const command of ["az.exe", "az.cmd", "az.bat", "az"]) { + if (commandExists(command)) { + cachedAzCommand = command.endsWith(".exe") ? { command, argsPrefix: [] } : { command: process.env["ComSpec"] || "cmd.exe", argsPrefix: ["/d", "/s", "/c", command] }; + return cachedAzCommand; + } + } + throw new Error("Azure CLI (`az`) was not found on PATH"); + } + function signDigest(keyId, digest) { + const { command, argsPrefix } = azCommand(); + try { + return (0, import_node_child_process.execFileSync)(command, [ + ...argsPrefix, + "keyvault", + "key", + "sign", + "--id", + keyId, + "--algorithm", + "RS256", + "--digest", + digest, + "--query", + "signature", + "--output", + "tsv", + "--only-show-errors" + ], { + encoding: "utf8", + stdio: ["ignore", "pipe", "pipe"] + }).trim(); + } catch (error) { + if (isRecord2(error)) { + if (error["code"] === "ENOENT") { + throw new Error("Azure CLI (`az`) was not found on PATH"); + } + const errorStderr = error["stderr"]; + const stderr = typeof errorStderr === "string" ? errorStderr.trim() : ""; + if (typeof error["status"] === "number") { + throw new Error( + `Azure Key Vault signing failed with exit code ${error["status"]}${stderr ? `: ${stderr}` : ""}` + ); + } + } + throw new Error("Azure Key Vault signing failed"); + } + } + function createAzureCliKeyVaultSigner(keyId) { + if (!keyId) { + throw new Error("keyId is required"); + } + return async (signingInput) => { + const digest = (0, import_node_crypto.createHash)("sha256").update(signingInput).digest("base64"); + const signature = signDigest(keyId, digest); + if (!signature) { + throw new Error("Azure Key Vault did not return a signature"); + } + return base64ToBase64url(signature); + }; + } + + // src/proxy.ts + var proxyEnvironmentKeys = [ + "https_proxy", + "HTTPS_PROXY", + "http_proxy", + "HTTP_PROXY" + ]; + function proxyEnvironmentConfigured() { + return proxyEnvironmentKeys.some((key) => process.env[key]); + } + function nativeProxySupportEnabled() { + return process.env["NODE_USE_ENV_PROXY"] === "1"; + } + function ensureNativeProxySupport() { + if (!proxyEnvironmentConfigured() || nativeProxySupportEnabled()) { + return; + } + throw new Error( + "A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 before running this tool." + ); + } + + // src/cli.ts + function requiredEnv(name) { + const value = process.env[name]; + if (!value) { + throw new Error(`${name} must be set`); + } + return value; + } + function getAppClientId() { + const appClientId = process.env["APP_CLIENT_ID"]; + if (!appClientId) { + throw new Error("APP_CLIENT_ID must be set"); + } + return appClientId; + } + function validatePermissionName2(key) { + if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) { + throw new Error(`Invalid permission name: ${key}`); + } + } + function validatePermissionLevel2(key, level) { + if (level !== "read" && level !== "write" && level !== "admin") { + throw new Error(`Invalid permission level for ${key}: ${level}`); + } + return level; + } + function parsePermissions(value) { + if (!value) { + return void 0; + } + const permissions = {}; + for (const entry of splitRepositoryNames(value)) { + const parts = entry.split(":"); + if (parts.length !== 2) { + throw new Error(`Permission entry must include an explicit level: ${entry}`); + } + const key = parts[0]?.trim(); + const rawLevel = parts[1]?.trim(); + if (!key) { + throw new Error(`Permission entry must include a permission name: ${entry}`); + } + validatePermissionName2(key); + if (Object.hasOwn(permissions, key)) { + throw new Error(`Duplicate permission: ${key}`); + } + permissions[key] = validatePermissionLevel2(key, rawLevel); + } + return Object.keys(permissions).length === 0 ? void 0 : permissions; + } + function validateVariableName(name, envName) { + if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) { + throw new Error(`${envName} must be an environment-style variable name`); + } + } + function parseOutputMode(value) { + const output = (value || "stdout").trim().toLowerCase(); + if (output === "azure" || output === "azure-pipelines" || output === "stdout") { + return output; + } + throw new Error('OUTPUT must be "azure", "azure-pipelines", or "stdout"'); + } + function getTokenOptions() { + const enterprise = process.env["ENTERPRISE"]; + const owner = process.env["OWNER"]; + const repositories = splitRepositoryNames(process.env["REPOSITORIES"]); + const permissions = parsePermissions(process.env["PERMISSIONS"]); + if (enterprise) { + if (owner || repositories.length > 0) { + throw new Error("Cannot use ENTERPRISE with OWNER or REPOSITORIES"); + } + return { enterprise, permissions }; + } + if (repositories.length > 0) { + return { ...normalizeRepositoryTarget(owner, repositories, void 0), permissions }; + } + if (owner) { + return { owner, permissions }; + } + throw new Error("OWNER, REPOSITORIES, or ENTERPRISE must be set"); + } + function writeAzurePipelinesOutput(installationToken) { + const variableName = requiredEnv("AZURE_TOKEN_VARIABLE"); + validateVariableName(variableName, "AZURE_TOKEN_VARIABLE"); + process.stdout.write(`##vso[task.setvariable variable=${variableName};isSecret=true]${installationToken.token} + `); + } + function writeOutput(installationToken, output) { + switch (output) { + case "azure": + case "azure-pipelines": + writeAzurePipelinesOutput(installationToken); + break; + case "stdout": + process.stdout.write(`${installationToken.token} + `); + break; + } + } + function reportError(error) { + const message = error instanceof Error ? error.message : String(error); + console.error(`error: ${message}`); + } + async function main() { + ensureNativeProxySupport(); + const githubApiUrl = process.env["GITHUB_API_URL"] || "https://api.github.com"; + const revokeTokenValue = process.env["REVOKE_TOKEN"]; + if (revokeTokenValue) { + const response = await fetch(`${githubApiUrl}/installation/token`, { + method: "DELETE", + headers: { + "Accept": "application/vnd.github+json", + "Authorization": `Bearer ${revokeTokenValue}`, + "X-GitHub-Api-Version": "2022-11-28" + } + }); + if (!response.ok) { + const body = await response.text(); + throw new Error(`Could not revoke token: ${response.status} ${response.statusText}: ${body}`); + } + return; + } + const githubAuth = createGitHubAppAuth({ + appClientId: getAppClientId(), + signer: createAzureCliKeyVaultSigner(requiredEnv("KEY_ID")), + githubApiUrl + }); + const installationToken = await githubAuth.getInstallationToken(getTokenOptions()); + writeOutput(installationToken, parseOutputMode(process.env["OUTPUT"])); + } + void main().catch((error) => { + reportError(error); + process.exitCode = 1; + }); + GITHUB_APP_TOKEN_CLI_EOF + node /tmp/create-github-app-token.cjs + env: + APP_CLIENT_ID: $(TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID) + KEY_ID: $(TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID) + OWNER: ${{ parameters.owner }} + REPOSITORIES: ${{ parameters.repositories }} + PERMISSIONS: ${{ parameters.permissions }} + OUTPUT: azure-pipelines + AZURE_TOKEN_VARIABLE: ${{ parameters.tokenVariable }} + + - ${{ each step in parameters.insertSteps }}: + - ${{ step }} + + - task: Bash@3 + displayName: Revoke GitHub App token + condition: always() + continueOnError: true + inputs: + targetType: inline + script: node /tmp/create-github-app-token.cjs + env: + REVOKE_TOKEN: $(${{ parameters.tokenVariable }}) From 3e2482c4fa6ab1915df31cdc6dd12f23f18e5310 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Jun 2026 20:29:49 +0000 Subject: [PATCH 05/11] Bump the github-actions group across 1 directory with 7 updates (#63529) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .../workflows/accept-baselines-fix-lints.yaml | 4 +- .github/workflows/ci.yml | 54 +++++++++---------- .github/workflows/close-issues.yml | 2 +- .github/workflows/codeql.yml | 8 +-- .github/workflows/copilot-setup-steps.yml | 4 +- .github/workflows/create-cherry-pick-pr.yml | 4 +- .github/workflows/insiders.yaml | 8 +-- .github/workflows/lkg.yml | 4 +- .github/workflows/new-release-branch.yaml | 4 +- .github/workflows/nightly.yaml | 8 +-- .github/workflows/pr-modified-files.yml | 2 +- .../workflows/release-branch-artifact.yaml | 6 +-- .github/workflows/scorecard.yml | 6 +-- .github/workflows/set-version.yaml | 4 +- .github/workflows/sync-branch.yaml | 4 +- .github/workflows/sync-wiki.yml | 2 +- .github/workflows/twoslash-repros.yaml | 6 +-- .github/workflows/update-package-lock.yaml | 4 +- 18 files changed, 67 insertions(+), 67 deletions(-) diff --git a/.github/workflows/accept-baselines-fix-lints.yaml b/.github/workflows/accept-baselines-fix-lints.yaml index 64c0f49d91f28..d34adcc3435f2 100644 --- a/.github/workflows/accept-baselines-fix-lints.yaml +++ b/.github/workflows/accept-baselines-fix-lints.yaml @@ -21,10 +21,10 @@ jobs: deployment: false steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 912275e9954b3..2a83a27129f98 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -107,9 +107,9 @@ jobs: name: Test Node ${{ matrix.config.node-version }} on ${{ matrix.config.os }}${{ (!matrix.config.bundle && ' with --no-bundle') || '' }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Use node version ${{ matrix.config.node-version }} - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.config.node-version }} check-latest: true @@ -142,8 +142,8 @@ jobs: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci @@ -152,12 +152,12 @@ jobs: run: npm test -- --no-lint --coverage - name: Upload coverage artifact - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage path: coverage - - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 + - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }} disable_search: true @@ -167,8 +167,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci @@ -180,8 +180,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci @@ -193,13 +193,13 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci - - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ~/.cache/dprint key: ${{ runner.os }}-dprint-${{ hashFiles('package-lock.json', '.dprint.jsonc') }} @@ -213,8 +213,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci @@ -226,9 +226,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | @@ -269,16 +269,16 @@ jobs: if: github.event_name == 'pull_request' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: path: pr - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: path: base ref: ${{ github.base_ref }} - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | @@ -316,8 +316,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci @@ -332,8 +332,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci @@ -353,8 +353,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: npm ci @@ -390,7 +390,7 @@ jobs: - name: Upload baseline diff artifact if: ${{ failure() && steps.check-baselines.conclusion == 'failure' }} - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fix_baselines.patch path: fix_baselines.patch diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml index 62c777b7d1715..fc6977904f81f 100644 --- a/.github/workflows/close-issues.yml +++ b/.github/workflows/close-issues.yml @@ -28,7 +28,7 @@ jobs: issues: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3b01f77624bef..b93a67178cdba 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -42,11 +42,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: config-file: ./.github/codeql/codeql-configuration.yml # Override language selection by uncommenting this and choosing your languages @@ -56,7 +56,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below). - name: Autobuild - uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -70,4 +70,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index cd0d22be26605..21c2c6a973e4c 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -15,8 +15,8 @@ jobs: # You can define any steps you want, and they will run before the agent starts. # If you do not check out your code, Copilot will do this for you. steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - run: npm ci # pull dprint caches before network access is blocked - run: npx hereby check-format || true diff --git a/.github/workflows/create-cherry-pick-pr.yml b/.github/workflows/create-cherry-pick-pr.yml index a09226521daf6..c2db597e0a9b0 100644 --- a/.github/workflows/create-cherry-pick-pr.yml +++ b/.github/workflows/create-cherry-pick-pr.yml @@ -51,7 +51,7 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. @@ -81,7 +81,7 @@ jobs: basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')" echo "::add-mask::$basic_auth" git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}" - - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 id: open-pr env: PR: ${{ inputs.pr }} diff --git a/.github/workflows/insiders.yaml b/.github/workflows/insiders.yaml index 22e7feef14be7..bc4c9b183f1ac 100644 --- a/.github/workflows/insiders.yaml +++ b/.github/workflows/insiders.yaml @@ -20,8 +20,8 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | @@ -42,8 +42,8 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry. diff --git a/.github/workflows/lkg.yml b/.github/workflows/lkg.yml index 4ac50669f600b..8cabd5fd55cee 100644 --- a/.github/workflows/lkg.yml +++ b/.github/workflows/lkg.yml @@ -33,11 +33,11 @@ jobs: exit 1 fi - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ inputs.branch_name }} persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | diff --git a/.github/workflows/new-release-branch.yaml b/.github/workflows/new-release-branch.yaml index 495389f1e27df..e369439b67b23 100644 --- a/.github/workflows/new-release-branch.yaml +++ b/.github/workflows/new-release-branch.yaml @@ -54,12 +54,12 @@ jobs: deployment: false steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 1aa2787d35ef4..8219ee2f21094 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -21,8 +21,8 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | @@ -42,8 +42,8 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' # Use NODE_AUTH_TOKEN environment variable to authenticate to this registry. diff --git a/.github/workflows/pr-modified-files.yml b/.github/workflows/pr-modified-files.yml index af4c35867d4cc..797059bb5a7cf 100644 --- a/.github/workflows/pr-modified-files.yml +++ b/.github/workflows/pr-modified-files.yml @@ -41,7 +41,7 @@ jobs: REPO: ${{ github.repository }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 diff --git a/.github/workflows/release-branch-artifact.yaml b/.github/workflows/release-branch-artifact.yaml index 32cb5c7cee702..6e65c7ec7d1d6 100644 --- a/.github/workflows/release-branch-artifact.yaml +++ b/.github/workflows/release-branch-artifact.yaml @@ -19,8 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | @@ -44,7 +44,7 @@ jobs: npm pack ./ mv typescript-*.tgz typescript.tgz - name: Upload built tarfile - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: tgz path: typescript.tgz diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2ac3f36089f7a..83dd107d76460 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -29,7 +29,7 @@ jobs: steps: - name: 'Checkout code' - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -47,7 +47,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: 'Upload artifact' - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: SARIF file path: results.sarif @@ -55,6 +55,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: 'Upload to code-scanning' - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: results.sarif diff --git a/.github/workflows/set-version.yaml b/.github/workflows/set-version.yaml index 0efbc6919b77f..1a8705381d446 100644 --- a/.github/workflows/set-version.yaml +++ b/.github/workflows/set-version.yaml @@ -53,11 +53,11 @@ jobs: name: azure deployment: false steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ inputs.branch_name }} persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | diff --git a/.github/workflows/sync-branch.yaml b/.github/workflows/sync-branch.yaml index 56e70f9b50b76..08029bf129625 100644 --- a/.github/workflows/sync-branch.yaml +++ b/.github/workflows/sync-branch.yaml @@ -46,10 +46,10 @@ jobs: deployment: false steps: - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ inputs.branch_name }} filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml index eafc2f3a2df7e..bfe7568a6e82b 100644 --- a/.github/workflows/sync-wiki.yml +++ b/.github/workflows/sync-wiki.yml @@ -22,7 +22,7 @@ jobs: - name: Get repo name run: R=${GITHUB_REPOSITORY%?wiki}; echo "BASENAME=${R##*/}" >> $GITHUB_ENV - name: Checkout ${{ env.BASENAME }}-wiki - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: repository: '${{ github.repository_owner }}/${{ env.BASENAME }}-wiki' fetch-depth: 0 diff --git a/.github/workflows/twoslash-repros.yaml b/.github/workflows/twoslash-repros.yaml index db24db7be438f..2c1c089f72f0d 100644 --- a/.github/workflows/twoslash-repros.yaml +++ b/.github/workflows/twoslash-repros.yaml @@ -55,13 +55,13 @@ jobs: deployment: false steps: - if: ${{ github.event.inputs.bisect }} - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. persist-credentials: false - if: ${{ !github.event.inputs.bisect }} - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 @@ -79,7 +79,7 @@ jobs: repositories: TypeScript permission-contents: write permission-issues: write - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - uses: microsoft/TypeScript-Twoslash-Repro-Action@master diff --git a/.github/workflows/update-package-lock.yaml b/.github/workflows/update-package-lock.yaml index e1e7dc6101d36..e693266531594 100644 --- a/.github/workflows/update-package-lock.yaml +++ b/.github/workflows/update-package-lock.yaml @@ -26,10 +26,10 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - run: | From 7964e22f2b85f16e520f0e902c7fd7b6f0c15416 Mon Sep 17 00:00:00 2001 From: Jake Bailey <5341706+jakebailey@users.noreply.github.com> Date: Mon, 8 Jun 2026 15:44:51 -0700 Subject: [PATCH 06/11] Update git identity from typescript-bot to typescript-automation[bot] (#63544) --- .github/workflows/accept-baselines-fix-lints.yaml | 4 ++-- .github/workflows/create-cherry-pick-pr.yml | 4 ++-- .github/workflows/lkg.yml | 4 ++-- .github/workflows/new-release-branch.yaml | 4 ++-- .github/workflows/pr-modified-files.yml | 2 +- .github/workflows/set-version.yaml | 4 ++-- .github/workflows/sync-branch.yaml | 4 ++-- .github/workflows/sync-wiki.yml | 2 +- .github/workflows/update-package-lock.yaml | 4 ++-- 9 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/accept-baselines-fix-lints.yaml b/.github/workflows/accept-baselines-fix-lints.yaml index d34adcc3435f2..e9f554399a8ae 100644 --- a/.github/workflows/accept-baselines-fix-lints.yaml +++ b/.github/workflows/accept-baselines-fix-lints.yaml @@ -30,8 +30,8 @@ jobs: - name: Configure Git, Run Tests, Update Baselines, Apply Fixes run: | - git config user.email "typescriptbot@microsoft.com" - git config user.name "TypeScript Bot" + git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com" + git config user.name "typescript-automation[bot]" npm ci git rm -r --quiet tests/baselines/reference npx hereby runtests-parallel --ci --fix || true diff --git a/.github/workflows/create-cherry-pick-pr.yml b/.github/workflows/create-cherry-pick-pr.yml index c2db597e0a9b0..ae2a71db737a1 100644 --- a/.github/workflows/create-cherry-pick-pr.yml +++ b/.github/workflows/create-cherry-pick-pr.yml @@ -116,8 +116,8 @@ jobs: const title = `🤖 Pick PR #${PR} (${pr.data.title.substring(0, 35)}${pr.data.title.length > 35 ? "..." : ""}) into ${TARGET_BRANCH}`; - await exec.exec("git", ["config", "user.email", "typescriptbot@microsoft.com"]); - await exec.exec("git", ["config", "user.name", "TypeScript Bot"]); + await exec.exec("git", ["config", "user.email", "290192711+typescript-automation[bot]@users.noreply.github.com"]); + await exec.exec("git", ["config", "user.name", "typescript-automation[bot]"]); await exec.exec("git", ["switch", "--detach", `origin/${TARGET_BRANCH}`]); await exec.exec("git", ["switch", "-c", pickBranch]); diff --git a/.github/workflows/lkg.yml b/.github/workflows/lkg.yml index 8cabd5fd55cee..b56ea51c0f69c 100644 --- a/.github/workflows/lkg.yml +++ b/.github/workflows/lkg.yml @@ -49,8 +49,8 @@ jobs: npm ci npx hereby LKG git add --force ./lib - git config user.email "typescriptbot@microsoft.com" - git config user.name "TypeScript Bot" + git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com" + git config user.name "typescript-automation[bot]" git commit -m 'Update LKG' - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: diff --git a/.github/workflows/new-release-branch.yaml b/.github/workflows/new-release-branch.yaml index e369439b67b23..6085645499ca1 100644 --- a/.github/workflows/new-release-branch.yaml +++ b/.github/workflows/new-release-branch.yaml @@ -86,8 +86,8 @@ jobs: git add src/compiler/corePublic.ts git add tests/baselines/reference/api/typescript.d.ts git add --force ./lib - git config user.email "typescriptbot@microsoft.com" - git config user.name "TypeScript Bot" + git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com" + git config user.name "typescript-automation[bot]" git commit -m "Bump version to $PACKAGE_VERSION and LKG" - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: diff --git a/.github/workflows/pr-modified-files.yml b/.github/workflows/pr-modified-files.yml index 797059bb5a7cf..a3406c0575b36 100644 --- a/.github/workflows/pr-modified-files.yml +++ b/.github/workflows/pr-modified-files.yml @@ -104,7 +104,7 @@ jobs: FILENAME=bot_comments.txt if [ ! -f $FILENAME ]; then gh pr view $PR_NUMBER --repo $REPO \ - --json 'comments' --jq '.comments[] | select(.author.login == "typescript-bot") | .body' > $FILENAME + --json 'comments' --jq '.comments[] | select(.author.login == "typescript-bot" or .author.login == "typescript-automation[bot]") | .body' > $FILENAME fi exec grep -Fq -m1 "$1" $FILENAME EOF diff --git a/.github/workflows/set-version.yaml b/.github/workflows/set-version.yaml index 1a8705381d446..e1c8ecea96ec3 100644 --- a/.github/workflows/set-version.yaml +++ b/.github/workflows/set-version.yaml @@ -89,8 +89,8 @@ jobs: git add src/compiler/corePublic.ts git add tests/baselines/reference/api/typescript.d.ts git add --force ./lib - git config user.email "typescriptbot@microsoft.com" - git config user.name "TypeScript Bot" + git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com" + git config user.name "typescript-automation[bot]" git commit -m "Bump version to $PACKAGE_VERSION and LKG" - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: diff --git a/.github/workflows/sync-branch.yaml b/.github/workflows/sync-branch.yaml index 08029bf129625..9ee3158d700aa 100644 --- a/.github/workflows/sync-branch.yaml +++ b/.github/workflows/sync-branch.yaml @@ -58,8 +58,8 @@ jobs: # required client_payload members: # branch_name - the target branch - run: | - git config user.email "typescriptbot@microsoft.com" - git config user.name "TypeScript Bot" + git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com" + git config user.name "typescript-automation[bot]" git fetch origin main git merge origin/main --no-ff npm ci diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml index bfe7568a6e82b..a312206c5d5e8 100644 --- a/.github/workflows/sync-wiki.yml +++ b/.github/workflows/sync-wiki.yml @@ -55,5 +55,5 @@ jobs: - name: Run sync run: ./.github/workflows/sync env: - PUSHER: typescript-bot + PUSHER: typescript-automation[bot] <290192711+typescript-automation[bot]@users.noreply.github.com> AUTH: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/update-package-lock.yaml b/.github/workflows/update-package-lock.yaml index e693266531594..9722544840702 100644 --- a/.github/workflows/update-package-lock.yaml +++ b/.github/workflows/update-package-lock.yaml @@ -50,8 +50,8 @@ jobs: else npm test npx hereby LKG - git config user.email "typescriptbot@microsoft.com" - git config user.name "TypeScript Bot" + git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com" + git config user.name "typescript-automation[bot]" git add -f package-lock.json git commit -m "Update package-lock.json" echo "changed=true" >> "$GITHUB_OUTPUT" From 8ef3e2f3d43c8c92bda9510c47f7d4d2b3aeca33 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 09:06:04 -0700 Subject: [PATCH 07/11] Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (#63571) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .../workflows/accept-baselines-fix-lints.yaml | 2 +- .github/workflows/ci.yml | 24 +++++++++---------- .github/workflows/close-issues.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/copilot-setup-steps.yml | 2 +- .github/workflows/create-cherry-pick-pr.yml | 2 +- .github/workflows/insiders.yaml | 4 ++-- .github/workflows/lkg.yml | 2 +- .github/workflows/new-release-branch.yaml | 2 +- .github/workflows/nightly.yaml | 4 ++-- .github/workflows/pr-modified-files.yml | 2 +- .../workflows/release-branch-artifact.yaml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/set-version.yaml | 2 +- .github/workflows/sync-branch.yaml | 2 +- .github/workflows/sync-wiki.yml | 2 +- .github/workflows/twoslash-repros.yaml | 4 ++-- .github/workflows/update-package-lock.yaml | 2 +- 18 files changed, 32 insertions(+), 32 deletions(-) diff --git a/.github/workflows/accept-baselines-fix-lints.yaml b/.github/workflows/accept-baselines-fix-lints.yaml index e9f554399a8ae..bae71c13560dc 100644 --- a/.github/workflows/accept-baselines-fix-lints.yaml +++ b/.github/workflows/accept-baselines-fix-lints.yaml @@ -21,7 +21,7 @@ jobs: deployment: false steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2a83a27129f98..340e6ad1d381e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -107,7 +107,7 @@ jobs: name: Test Node ${{ matrix.config.node-version }} on ${{ matrix.config.os }}${{ (!matrix.config.bundle && ' with --no-bundle') || '' }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Use node version ${{ matrix.config.node-version }} uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -142,7 +142,7 @@ jobs: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -167,7 +167,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -180,7 +180,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -193,7 +193,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -213,7 +213,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -226,7 +226,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -269,11 +269,11 @@ jobs: if: github.event_name == 'pull_request' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: path: pr - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: path: base ref: ${{ github.base_ref }} @@ -316,7 +316,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -332,7 +332,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -353,7 +353,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml index fc6977904f81f..5db0656bce28c 100644 --- a/.github/workflows/close-issues.yml +++ b/.github/workflows/close-issues.yml @@ -28,7 +28,7 @@ jobs: issues: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b93a67178cdba..da2999e25c39e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 21c2c6a973e4c..71347f0621b2d 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -15,7 +15,7 @@ jobs: # You can define any steps you want, and they will run before the agent starts. # If you do not check out your code, Copilot will do this for you. steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - run: npm ci # pull dprint caches before network access is blocked diff --git a/.github/workflows/create-cherry-pick-pr.yml b/.github/workflows/create-cherry-pick-pr.yml index ae2a71db737a1..526706539a75c 100644 --- a/.github/workflows/create-cherry-pick-pr.yml +++ b/.github/workflows/create-cherry-pick-pr.yml @@ -51,7 +51,7 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. diff --git a/.github/workflows/insiders.yaml b/.github/workflows/insiders.yaml index bc4c9b183f1ac..f9045cf39e89e 100644 --- a/.github/workflows/insiders.yaml +++ b/.github/workflows/insiders.yaml @@ -20,7 +20,7 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -42,7 +42,7 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' diff --git a/.github/workflows/lkg.yml b/.github/workflows/lkg.yml index b56ea51c0f69c..ba0b3b27b8379 100644 --- a/.github/workflows/lkg.yml +++ b/.github/workflows/lkg.yml @@ -33,7 +33,7 @@ jobs: exit 1 fi - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.branch_name }} persist-credentials: false diff --git a/.github/workflows/new-release-branch.yaml b/.github/workflows/new-release-branch.yaml index 6085645499ca1..8aac9c8d0064a 100644 --- a/.github/workflows/new-release-branch.yaml +++ b/.github/workflows/new-release-branch.yaml @@ -54,7 +54,7 @@ jobs: deployment: false steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 8219ee2f21094..5627baf235b54 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -21,7 +21,7 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' @@ -42,7 +42,7 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' diff --git a/.github/workflows/pr-modified-files.yml b/.github/workflows/pr-modified-files.yml index a3406c0575b36..19b19c200668c 100644 --- a/.github/workflows/pr-modified-files.yml +++ b/.github/workflows/pr-modified-files.yml @@ -41,7 +41,7 @@ jobs: REPO: ${{ github.repository }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 diff --git a/.github/workflows/release-branch-artifact.yaml b/.github/workflows/release-branch-artifact.yaml index 6e65c7ec7d1d6..42a50cba8f864 100644 --- a/.github/workflows/release-branch-artifact.yaml +++ b/.github/workflows/release-branch-artifact.yaml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 83dd107d76460..49d590321f686 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -29,7 +29,7 @@ jobs: steps: - name: 'Checkout code' - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/.github/workflows/set-version.yaml b/.github/workflows/set-version.yaml index e1c8ecea96ec3..c1a328c60c2ee 100644 --- a/.github/workflows/set-version.yaml +++ b/.github/workflows/set-version.yaml @@ -53,7 +53,7 @@ jobs: name: azure deployment: false steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.branch_name }} persist-credentials: false diff --git a/.github/workflows/sync-branch.yaml b/.github/workflows/sync-branch.yaml index 9ee3158d700aa..9a104d555c8da 100644 --- a/.github/workflows/sync-branch.yaml +++ b/.github/workflows/sync-branch.yaml @@ -49,7 +49,7 @@ jobs: - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 'lts/*' - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.branch_name }} filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml index a312206c5d5e8..4734270c63c69 100644 --- a/.github/workflows/sync-wiki.yml +++ b/.github/workflows/sync-wiki.yml @@ -22,7 +22,7 @@ jobs: - name: Get repo name run: R=${GITHUB_REPOSITORY%?wiki}; echo "BASENAME=${R##*/}" >> $GITHUB_ENV - name: Checkout ${{ env.BASENAME }}-wiki - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: '${{ github.repository_owner }}/${{ env.BASENAME }}-wiki' fetch-depth: 0 diff --git a/.github/workflows/twoslash-repros.yaml b/.github/workflows/twoslash-repros.yaml index 2c1c089f72f0d..492962422526e 100644 --- a/.github/workflows/twoslash-repros.yaml +++ b/.github/workflows/twoslash-repros.yaml @@ -55,13 +55,13 @@ jobs: deployment: false steps: - if: ${{ github.event.inputs.bisect }} - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. persist-credentials: false - if: ${{ !github.event.inputs.bisect }} - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 diff --git a/.github/workflows/update-package-lock.yaml b/.github/workflows/update-package-lock.yaml index 9722544840702..cfb4e8a2cb5ac 100644 --- a/.github/workflows/update-package-lock.yaml +++ b/.github/workflows/update-package-lock.yaml @@ -26,7 +26,7 @@ jobs: if: github.repository == 'microsoft/TypeScript' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 From 7816ae6fa7ccfd59b2be3485cc8c108174f2560e Mon Sep 17 00:00:00 2001 From: Nilesh Das Date: Wed, 24 Jun 2026 21:51:55 +0530 Subject: [PATCH 08/11] docs: add JSDoc comments to ReadonlySet interface (#63483) --- src/lib/es2015.collection.d.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/lib/es2015.collection.d.ts b/src/lib/es2015.collection.d.ts index a01b21dded868..cbc5219f5d79b 100644 --- a/src/lib/es2015.collection.d.ts +++ b/src/lib/es2015.collection.d.ts @@ -106,8 +106,17 @@ interface SetConstructor { declare var Set: SetConstructor; interface ReadonlySet { + /** + * Executes a provided function once per each value in the ReadonlySet object, in insertion order. + */ forEach(callbackfn: (value: T, value2: T, set: ReadonlySet) => void, thisArg?: any): void; + /** + * @returns a boolean indicating whether an element with the specified value exists in the Set or not. + */ has(value: T): boolean; + /** + * @returns the number of (unique) elements in the Set. + */ readonly size: number; } From 637d5746b70257028fb95aad32ddec6b26ab0a14 Mon Sep 17 00:00:00 2001 From: core-dumpling <295348225+core-dumpling@users.noreply.github.com> Date: Fri, 26 Jun 2026 03:40:36 +0800 Subject: [PATCH 09/11] Fix infinite loop (#63581) Co-authored-by: core-dumpling Co-authored-by: Ryan Cavanaugh --- src/compiler/scanner.ts | 2 +- src/testRunner/unittests/comments.ts | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/src/compiler/scanner.ts b/src/compiler/scanner.ts index 343df39ad9cbc..c4e20bb055e28 100644 --- a/src/compiler/scanner.ts +++ b/src/compiler/scanner.ts @@ -3915,7 +3915,7 @@ export function createScanner( if (isIdentifierStart(ch, languageVersion)) { let char = ch; - while (pos < end && isIdentifierPart(char = codePointUnchecked(pos), languageVersion) || char === CharacterCodes.minus) pos += charSize(char); + while (pos < end && (isIdentifierPart(char = codePointUnchecked(pos), languageVersion) || char === CharacterCodes.minus)) pos += charSize(char); tokenValue = text.substring(tokenStart, pos); if (char === CharacterCodes.backslash) { tokenValue += scanIdentifierParts(); diff --git a/src/testRunner/unittests/comments.ts b/src/testRunner/unittests/comments.ts index a1eeeb8aacfa1..0193826938b60 100644 --- a/src/testRunner/unittests/comments.ts +++ b/src/testRunner/unittests/comments.ts @@ -11,6 +11,7 @@ describe("comment parsing", () => { const withTrailing = `;/* comment */ // another one `; + const endingInHyphen = "/**comment-*/"; it("skips shebang", () => { const result = ts.getLeadingCommentRanges(withShebang, 0); assert.isDefined(result); @@ -29,4 +30,16 @@ describe("comment parsing", () => { assert.strictEqual(result.length, 1); assert.strictEqual(result[0].kind, ts.SyntaxKind.SingleLineCommentTrivia); }); + + it("parses /** block comments ending in hyphen", () => { + const sourceFile = ts.createSourceFile( + "file.ts", + `${endingInHyphen}\nconst x = 1;`, + ts.ScriptTarget.ESNext, + /*setParentNodes*/ true, + ); + + assert.strictEqual(sourceFile.parseDiagnostics.length, 0); + assert.strictEqual(sourceFile.statements.length, 1); + }); }); From cc5c6e2d32e2228fff83a66537bbe6042943054d Mon Sep 17 00:00:00 2001 From: Jake Bailey <5341706+jakebailey@users.noreply.github.com> Date: Thu, 23 Jul 2026 11:31:29 -0700 Subject: [PATCH 10/11] Remove twoslash-repros workflow (#63675) --- .github/workflows/twoslash-repros.yaml | 89 -------------------------- 1 file changed, 89 deletions(-) delete mode 100644 .github/workflows/twoslash-repros.yaml diff --git a/.github/workflows/twoslash-repros.yaml b/.github/workflows/twoslash-repros.yaml deleted file mode 100644 index 492962422526e..0000000000000 --- a/.github/workflows/twoslash-repros.yaml +++ /dev/null @@ -1,89 +0,0 @@ -name: Twoslash Code Sample Repros - -on: - schedule: - - cron: '0 8 * * *' - repository_dispatch: - types: [run-twoslash-repros] - workflow_dispatch: - inputs: - issue: - description: Limits run to a single issue. - required: false - type: string - bisect: - description: If set, runs a git bisect on an existing repro. Requires 'issue' to be set. Value can be revision labels (e.g. `good v4.7.3 bad main`) or `true` to infer bisect range. - required: false - type: string - - # Inputs provided by the bot - distinct_id: - description: '(bot) A distinct ID' - required: false - default: '' - source_issue: - description: '(bot) The issue that triggered this workflow' - required: false - default: '' - requesting_user: - description: '(bot) The user who requested this workflow' - required: false - default: '' - status_comment: - description: '(bot) The comment to update with the status of this workflow' - required: false - default: '' - -run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0})', inputs.distinct_id) || '' }} - -permissions: - contents: read - id-token: write - -# Ensure scripts are run with pipefail. See: -# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference -defaults: - run: - shell: bash - -jobs: - run: - if: ${{ github.repository == 'microsoft/TypeScript' }} - runs-on: ubuntu-latest - environment: - name: azure - deployment: false - steps: - - if: ${{ github.event.inputs.bisect }} - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/ - fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none. - persist-credentials: false - - if: ${{ !github.event.inputs.bisect }} - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 - with: - client-id: ${{ vars.AZURE_CLIENT_ID }} - tenant-id: ${{ vars.AZURE_TENANT_ID }} - subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - - name: Create GitHub App token - id: app-token - uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1 - with: - client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }} - key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }} - owner: microsoft - repositories: TypeScript - permission-contents: write - permission-issues: write - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: 'lts/*' - - uses: microsoft/TypeScript-Twoslash-Repro-Action@master - with: - github-token: ${{ steps.app-token.outputs.token }} - issue: ${{ github.event.inputs.issue }} - bisect: ${{ github.event.inputs.bisect }} From b465fdbfe175304d9b977da137b2c178ae1091d3 Mon Sep 17 00:00:00 2001 From: Siddhant Gudwani Date: Tue, 28 Jul 2026 02:25:30 +0530 Subject: [PATCH 11/11] =?UTF-8?q?fix(lib):=20remove=20callable=20signature?= =?UTF-8?q?=20without=20new=20from=20Intl.PluralRules=E2=80=A6=20(#63608)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/lib/es2018.intl.d.ts | 1 - src/lib/es2020.intl.d.ts | 1 - 2 files changed, 2 deletions(-) diff --git a/src/lib/es2018.intl.d.ts b/src/lib/es2018.intl.d.ts index 9bfa24d277b0b..22676d6ef5a7e 100644 --- a/src/lib/es2018.intl.d.ts +++ b/src/lib/es2018.intl.d.ts @@ -31,7 +31,6 @@ declare namespace Intl { interface PluralRulesConstructor { new (locales?: string | readonly string[], options?: PluralRulesOptions): PluralRules; - (locales?: string | readonly string[], options?: PluralRulesOptions): PluralRules; supportedLocalesOf(locales: string | readonly string[], options?: { localeMatcher?: "lookup" | "best fit"; }): string[]; } diff --git a/src/lib/es2020.intl.d.ts b/src/lib/es2020.intl.d.ts index 727dc64644612..f706490761d47 100644 --- a/src/lib/es2020.intl.d.ts +++ b/src/lib/es2020.intl.d.ts @@ -449,7 +449,6 @@ declare namespace Intl { interface PluralRulesConstructor { new (locales?: LocalesArgument, options?: PluralRulesOptions): PluralRules; - (locales?: LocalesArgument, options?: PluralRulesOptions): PluralRules; supportedLocalesOf(locales: LocalesArgument, options?: { localeMatcher?: "lookup" | "best fit"; }): string[]; }