Merge branch 'main' into cleanup-7-0-barrel

Author: ef4

.github/actions/setup/action.yml

@@ -13,16 +13,18 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - uses: pnpm/action-setup@v4
+    - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       name: Install pnpm
       with:
         run_install: false
     - name: Install Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version: '${{ inputs.node-version }}'
         registry-url: 'https://registry.npmjs.org'
         cache: pnpm
 
-    - run: pnpm install ${{ fromJSON('{"false":"--no-lockfile", "true":"--frozen-lockfile"}')[inputs.use_lockfile] }}
+    - run: pnpm install ${INSTALL_OPTIONS}
+      env: 
+        INSTALL_OPTIONS: ${{ fromJSON('{"false":"--no-lockfile", "true":"--frozen-lockfile"}')[inputs.use_lockfile] }}
       shell: bash

.github/dependabot.yml

@@ -0,0 +1,27 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended"],
+  automerge: false,
+  lockFileMaintenance: true,
+  dependencyDashboard: true,
+  schedule: ["every weekend"],
+  minimumReleaseAge: "10 days",
+  prConcurrentLimit: 5,
+  packageRules: [
+    {
+      description: "All @babel/* packages",
+      groupName: "babel",
+      matchPackageNames: ["@babel/{/,}**"],
+    },
+    {
+      description: "All @embroider/* packages",
+      groupName: "embroider",
+      matchPackageNames: ["@embroider/{/,}**"],
+    },
+    {
+      description: "eslint and releated packages",
+      groupName: "eslint",
+      matchPackageNames: ["eslint{/,}**"],
+    },
+  ],
+}

.github/renovate.json5

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { execSync } from "node:child_process";
+
+const [appDir, targetDir, replaceTestScript = "false"] = process.argv.slice(2);
+
+if (!appDir || !targetDir) {
+  console.error("Usage: update-smoke-test-template.sh <appDir> <targetDir>");
+  process.exit(1);
+}
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+function writeJson(filePath, data) {
+  fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+}
+
+const resolvedAppDir = path.resolve(appDir);
+const resolvedTargetDir = path.resolve(targetDir);
+
+fs.rmSync(path.join(resolvedAppDir, ".ember-cli"), { force: true });
+
+const pkgPath = path.join(resolvedAppDir, "package.json");
+const pkg = readJson(pkgPath);
+pkg.scripts = pkg.scripts || {};
+const shouldReplaceTest = replaceTestScript === "true";
+if (shouldReplaceTest) {
+  pkg.scripts.test = "ember test";
+}
+
+if (pkg.devDependencies && pkg.devDependencies["@glimmer/component"]) {
+  pkg.devDependencies["@glimmer/component"] = "workspace:^";
+} else if (pkg.dependencies && pkg.dependencies["@glimmer/component"]) {
+  pkg.dependencies["@glimmer/component"] = "workspace:^";
+} else {
+  pkg.devDependencies = pkg.devDependencies || {};
+  pkg.devDependencies["@glimmer/component"] = "workspace:^";
+}
+
+if (pkg.devDependencies && pkg.devDependencies["ember-source"]) {
+  pkg.devDependencies["ember-source"] = "workspace:*";
+}
+
+pkg.devDependencies = pkg.devDependencies || {};
+const trackedBuiltInsVersion = execSync("npm view tracked-built-ins version", {
+  encoding: "utf8"
+}).trim();
+pkg.devDependencies["tracked-built-ins"] = `^${trackedBuiltInsVersion}`;
+
+writeJson(pkgPath, pkg);
+
+const envPath = path.join(resolvedAppDir, "config", "environment.js");
+const source = fs.readFileSync(envPath, "utf8");
+if (!source.includes("_OVERRIDE_DEPRECATION_VERSION")) {
+  const block = [
+    "/* The following enables the infrastructure allow us to test as if deprecations",
+    "  have been turned into errors at a specific version.",
+    "*/",
+    "_OVERRIDE_DEPRECATION_VERSION: process.env.OVERRIDE_DEPRECATION_VERSION,"
+  ];
+  const updated = source.replace(
+    /EmberENV:\s*\{\s*\n([ \t]*)/,
+    (match, indent) => {
+      const pad = `${indent}  `;
+      const injected = block.map((line) => pad + line).join("\n");
+      return match + injected + "\n" + indent;
+    }
+  );
+  if (updated === source) {
+    throw new Error("Failed to locate EmberENV block for injection.");
+  }
+  fs.writeFileSync(envPath, updated);
+}
+
+fs.rmSync(resolvedTargetDir, { recursive: true, force: true });
+fs.renameSync(resolvedAppDir, resolvedTargetDir);

.github/scripts/update-smoke-test-template.mjs

@@ -5,19 +5,19 @@ on:
     - cron: '0 20 * * 3' # weekly (Wednesday)
   workflow_dispatch:
 
+permissions:
+  contents: read # PAT used for push
+  
 jobs:
   tests:
     uses: ./.github/workflows/ci-jobs.yml
 
   release:
-    permissions:
-      contents: read # PAT used for push
-
     name: Tag + Push
     runs-on: ubuntu-latest
     needs: [ tests ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
@@ -31,9 +31,9 @@ jobs:
           export NEXT_ALPHA=`node bin/next-alpha-version.js ${LATEST_ALPHA}`
           echo "NEXT_ALPHA=$NEXT_ALPHA" >> $GITHUB_ENV
       - name: bump version
-        run: npm version ${{env.NEXT_ALPHA}} --allow-same-version --no-git-tag-version
+        run: npm version ${NEXT_ALPHA} --allow-same-version --no-git-tag-version
       - name: create tag
-        run: git tag v${{env.NEXT_ALPHA}}-ember-source
+        run: git tag v${NEXT_ALPHA}-ember-source
       - name: push tag
         # Push in a way that WILL trigger other workflows
-        run: git push https://${GITHUB_ACTOR}:${{ secrets.PERSONAL_TOKEN }}@github.com/${GITHUB_REPOSITORY} v${{env.NEXT_ALPHA}}-ember-source
+        run: git push https://${GITHUB_ACTOR}:${{ secrets.PERSONAL_TOKEN }}@github.com/${GITHUB_REPOSITORY} v${NEXT_ALPHA}-ember-source

.github/workflows/alpha-releases.yml

@@ -13,7 +13,9 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: linting
         run: pnpm lint
@@ -27,12 +29,16 @@ jobs:
     name: Type Checking (current version)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: build types
         run: pnpm build:types
       - name: Check internal types
         run: pnpm type-check:internals
+      - name: Check @handlebars/parser types
+        run: pnpm type-check:handlebars
       - name: Check published types
         run: pnpm type-check:types
 
@@ -44,7 +50,9 @@ jobs:
       matrix:
         ts-version: ["5.2", "5.3", "5.4", "5.5", "5.6", "5.7", "5.8", "5.9"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: build stable type definitions
         run: pnpm build:types
@@ -57,7 +65,9 @@ jobs:
     name: Basic Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: build
         run: pnpm vite build --mode=development
@@ -91,7 +101,9 @@ jobs:
             ENABLE_OPTIONAL_FEATURES: "true"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: build
         run: pnpm vite build --mode=${{ matrix.BUILD || 'development' }}
@@ -111,7 +123,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [basic-test, lint, types]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: build
         env:
@@ -141,7 +155,9 @@ jobs:
       fail-fast: false
       matrix: ${{fromJson(needs.lint.outputs.matrix)}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
         with:
           use_lockfile: "false"
@@ -150,28 +166,58 @@ jobs:
       - name: test
         working-directory: smoke-tests/scenarios
         run: |
-          ${{ matrix.command }}
+          ${MATRIX_COMMAND}
+        env:
+          MATRIX_COMMAND: ${{ matrix.command }}
+          
+  smoke-test-with-deprecations-removed:
+    name: Smoke tests with Deprecations Removed (Full Ember Apps)
+    runs-on: ubuntu-latest
+    needs: [basic-test, lint, types]
+    strategy:
+      fail-fast: false
+      matrix: ${{fromJson(needs.lint.outputs.matrix)}}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          use_lockfile: "false"
+      - name: build
+        run: pnpm build
+      - name: test
+        env:
+          OVERRIDE_DEPRECATION_VERSION: "15.0.0"
+          MATRIX_COMMAND: ${{ matrix.command }}
+        working-directory: smoke-tests/scenarios
+        run: |
+          ${MATRIX_COMMAND}
 
   node-test:
     name: Node.js Tests
     runs-on: ubuntu-latest
     needs: [basic-test, lint, types]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: build
         env:
           SHOULD_TRANSPILE_FOR_NODE: true
         run: pnpm build
       - name: test
-        run: pnpm test:node
+        run: pnpm test:node && pnpm --filter "@handlebars/parser" test
 
   blueprint-test:
     name: Blueprint Tests
     runs-on: ubuntu-latest
     needs: [lint]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: test
         run: pnpm test:blueprints
@@ -181,12 +227,14 @@ jobs:
     runs-on: ubuntu-22.04 # Firefox is not installing on Ubuntu 24 on GitHub Actions https://github.com/browser-actions/setup-firefox/issues/622
     needs: [basic-test, lint, types]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: build
         run: pnpm vite build --mode=development
       - name: Setup firefox
-        uses: browser-actions/setup-firefox@latest
+        uses: browser-actions/setup-firefox@fcf821c621167805dd63a29662bd7cb5676c81a8 # v1.7.1
         with:
           firefox-version: 115.9.1esr
       - run: firefox --version
@@ -196,10 +244,13 @@ jobs:
   perf-check:
     name: Perf script still works
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }} # Don't run on tags
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: ./.github/actions/setup
       - name: Check that the perf script works, so we don't regress
         run: RUNS='2' pnpm bench

.github/workflows/ci-jobs.yml

@@ -28,7 +28,7 @@ jobs:
     # Only run on pushes to branches that are not from the cron workflow
     if: github.event_name == 'push' && contains(github.ref, 'cron') != true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] creds are used for build-for-publishing.js
       - uses: ./.github/actions/setup
       - name: build for publish
         run: node bin/build-for-publishing.js
@@ -46,7 +46,7 @@ jobs:
     # Only run on pushes to main
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] creds are used for build-for-publishing.js
       - uses: ./.github/actions/setup
       - name: build for publish
         run: node bin/build-for-publishing.js
@@ -65,7 +65,7 @@ jobs:
     needs: [ tests ]
     if: failure() && contains(github.ref, 'cron') == true
     steps:
-      - uses: sarisia/actions-status-discord@v1
+      - uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         with:
           webhook: ${{ secrets.FRAMEWORK_WEBHOOK }}
           status: 'Failure'