.github/renovate.json5

@@ -4,38 +4,94 @@
     "config:recommended",
     "schedule:weekly",
     "group:allNonMajor",
-    ":disablePeerDependencies", 
+    ":disablePeerDependencies",
     "regexManagers:biomeVersions",
+    "helpers:pinGitHubActionDigestsToSemver"
+  ],
+  "labels": [
+    "dependencies"
   ],
-  "labels": ["dependencies"],
   "rangeStrategy": "bump",
-  "postUpdateOptions": ["pnpmDedupe"],
-  "ignorePaths": ["**/node_modules/**"],
+  "postUpdateOptions": [
+    "pnpmDedupe"
+  ],
+  "ignorePaths": [
+    "**/node_modules/**"
+  ],
   "packageRules": [
     // TODO: remove once the tailwind integration is removed
     {
-      "matchPackageNames": ["tailwindcss"],
-      "ignorePaths": ["packages/integrations/tailwind"]
+      "matchPackageNames": [
+        "tailwindcss"
+      ],
+      "ignorePaths": [
+        "packages/integrations/tailwind"
+      ]
+    },
+    {
+      "groupName": "github-actions",
+      "matchManagers": [
+        "github-actions"
+      ]
+    },
+    {
+      "groupName": "astro dependencies",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "packages/astro/**",
+        "packages/integrations/mdx/**",
+        "packages/integrations/remark/**",
+      ]
+    },
+    {
+      "groupName": "astro adapters",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "packages/integrations/node/**",
+        "packages/integrations/netlify/**",
+        "packages/integrations/cloudflare/**",
+        "packages/integrations/vercel/**",
+      ]
+    },
+    {
+      "groupName": "astro client runtimes",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "packages/integrations/react/**",
+        "packages/integrations/solid/**",
+        "packages/integrations/preact/**",
+        "packages/integrations/svelte/**",
+        "packages/integrations/vue/**",
+      ]
     }
   ],
   "ignoreDeps": [
     // manually bumping deps
     "@biomejs/biome",
     "@types/node",
-    "astro-embed", // TODO: investigate upgrade (zod import issues with atproto)
-    "drizzle-orm", // TODO: investigate upgrade (has type issues)
+
+    // TODO: investigate upgrade (zod import issues with atproto)
+    "astro-embed",
+
+    // TODO: investigate upgrade (has type issues)
+    "drizzle-orm",
     "sharp",
-
     // manually bumping workflow actions
     "actions/labeler",
-
     // ignore "engines" update
     "node",
     "npm",
     "pnpm",
-
     // follow vite deps version
     "postcss-load-config",
     "esbuild",
+    // TODO: follow https://github.com/withastro/astro/pull/13478
+    "@vitejs/plugin-vue"
   ],
 }

.github/workflows/benchmark.yml

@@ -21,23 +21,23 @@ jobs:
       MAIN-BENCH: ${{ steps.benchmark-main.outputs.BENCH_RESULT }}
     steps:
       - name: Check if user has write access
-        uses: lannonbr/repo-permission-check-action@2.0.2
+        uses: lannonbr/repo-permission-check-action@2bb8c89ba8bf115c4bfab344d6a6f442b24c9a1f # 2.0.2
         with:
           permission: write
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # https://github.com/actions/checkout/issues/331#issuecomment-1438220926
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.issue.number }}/head
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -70,7 +70,7 @@ jobs:
         shell: bash
 
       # main benchmark
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: "main"
@@ -101,7 +101,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment PR
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         continue-on-error: true
         with:
           issue-number: ${{ github.event.issue.number }}

.github/workflows/check-merge.yml

@@ -0,0 +1,96 @@
+name: Check mergeability
+
+on: pull_request_target
+
+permissions:
+  pull-requests: write
+  checks: write
+  statuses: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if there is already a block on this PR
+        id: blocked
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          issue_number:  ${{ github.event.number }}
+        with:
+          script: |
+            const { data: reviews } = await github.rest.pulls.listReviews({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: process.env.issue_number,
+            });
+
+            for (const review of reviews) {
+              if (review.user.login === 'github-actions[bot]' && review.state === 'CHANGES_REQUESTED') {
+                return 'true'
+              }
+            }
+            return 'false'
+          result-encoding: string
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        if: steps.blocked.outputs.result != 'true'
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Get changed files in the .changeset folder
+        id: changed-files
+        uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1
+        if: steps.blocked.outputs.result != 'true'
+        with:
+          files: |
+            .changeset/**/*.md
+
+      - name: Check if any changesets contain minor or major changes
+        id: check
+        if: steps.blocked.outputs.result != 'true'
+        env:
+          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+        run: |
+          echo "Checking for changesets marked as minor or major"
+          echo "found=false" >> $GITHUB_OUTPUT
+
+          regex="[\"']astro[\"']: (minor|major)"
+          for file in ${ALL_CHANGED_FILES}; do
+              if [[ $(cat $file) =~ $regex ]]; then
+                  version="${BASH_REMATCH[1]}"
+                  echo "version=$version" >> $GITHUB_OUTPUT
+                  echo "found=true" >> $GITHUB_OUTPUT
+                  echo "$file has a $version release tag"
+              fi
+          done
+
+      - name: Add label
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        if: steps.check.outputs.found == 'true'
+        env:
+          issue_number: ${{ github.event.number }}
+        with:
+          script: |
+            github.rest.issues.addLabels({
+              issue_number: process.env.issue_number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              labels: ['semver: ${{ steps.check.outputs.version }}']
+            });
+
+      - name: Change PR Status
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        if: steps.check.outputs.found == 'true'
+        env:
+          issue_number: ${{ github.event.number }}
+        with:
+          script: |
+            github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: process.env.issue_number,
+              event: 'REQUEST_CHANGES',
+              body: 'This PR is blocked because it contains a `${{ steps.check.outputs.version }}` changeset. A reviewer will merge this at the next release if approved.'
+            });

.github/workflows/check.yml

@@ -28,13 +28,13 @@ jobs:
     timeout-minutes: 7
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"

.github/workflows/ci.yml

@@ -47,13 +47,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -77,13 +77,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -122,13 +122,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -159,13 +159,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -195,19 +195,19 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
 
       - name: Checkout docs
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: withastro/docs
           path: smoke/docs
@@ -232,7 +232,7 @@ jobs:
 
       - name: Check if docs changed
         id: changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             docs:

.github/workflows/cleanup-cache.yml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Cleanup caches older than 5 days
         if: github.event_name == 'schedule'
-        uses: MyAlbum/purge-cache@v2
+        uses: MyAlbum/purge-cache@881eb5957687193fa612bf74c0042adc78ea5e54 # v2.2.0
         with:
           max-age: 432000