chore: v2.1.0

.github/dependabot.yml

@@ -1,10 +1,14 @@
 version: 2
 updates:
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-    interval: "weekly"
-- package-ecosystem: "npm"
-  directory: "/"
-  schedule:
-    interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/lint.yml

@@ -1,33 +1,38 @@
----
-  name: Lint
-
-  on:  # yamllint disable-line rule:truthy
-    push: null
-    pull_request: null
-
-  permissions: read-all 
+name: Lint
 
-  jobs:
-    build:
-      name: Lint
-      runs-on: ubuntu-latest
-
-      permissions:
-        contents: read
-        packages: read
-        # To report GitHub Actions status checks
-        statuses: write
-
-      steps:
-        - name: Checkout code
-          uses: actions/checkout@v4
-          with:
-            # super-linter needs the full git history to get the
-            # list of files that changed across commits
-            fetch-depth: 0
+on: # yamllint disable-line rule:truthy
+  push: null
+  pull_request: null
 
-        - name: Super-linter
-          uses: super-linter/super-linter/slim@v6.7.0
-          env:
-            # To report GitHub Actions status checks
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+permissions: {}
+
+jobs:
+  build:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: read
+      # issues and pull-requests permissions to write results as pull
+      # request comments. Omit them if you don't need summary comments
+      issues: write
+      pull-requests: write
+      # To report GitHub Actions status checks. Omit if you don't need
+      # to update commit status
+      statuses: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # super-linter needs the full git history to get the
+          # list of files that changed across commits
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Super-linter
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
+        env:
+          # To report GitHub Actions status checks
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/static.yml

@@ -3,20 +3,29 @@ on:
   workflow_call:
     inputs:
       deploy_to_github_pages:
-        description: 'Whether or not to deploy to GitHub Pages. If disabled, the workflow will only build and create an artifact for deployment.'
+        description: "Whether or not to deploy to GitHub Pages. If disabled, the workflow will only build and create an artifact for deployment."
+        default: true
+        type: boolean
+        required: false
+      upload_artifact:
+        description: "Whether or not to upload the built static site as an artifact. This is required to deploy to GitHub Pages, but can be used independently if you want to use the built static site for another purpose (e.g. deploying to a different hosting provider)."
         default: true
         type: boolean
         required: false
       generator_repository:
-        description: 'The repository name, with owner, to use as the generator. If not provided, the generator will be inferred from the static.json file.'
+        description: "The repository name, with owner, to use as the generator. If not provided, the generator will be inferred from the static.json file."
         type: string
         required: false
       generator_ref:
-        description: 'The branch, tag, or SHA to checkout. If not provided, the version will be inferred from the ecosystem file and used as the ref.'
+        description: "The branch, tag, or SHA to checkout. If not provided, the version will be inferred from the ecosystem file and used as the ref."
+        type: string
+        required: false
+      static_json_path:
+        description: "Path to the static.json file to use. Defaults to './static.json'."
+        default: "./static.json"
         type: string
         required: false
 
-
 # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
   contents: read
@@ -32,20 +41,28 @@ concurrency:
 jobs:
   static:
     environment:
-      name: ${{ inputs.deploy_to_github_pages == true && 'github-pages' || 'static-output' }}
-      url: ${{ inputs.deploy_to_github_pages == true && steps.deployment.outputs.page_url || ''}}
+      name: ${{ inputs.deploy_to_github_pages && 'github-pages' || 'static-output' }}
+      url: ${{ inputs.deploy_to_github_pages && steps.deployment.outputs.page_url || '' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Configure GitHub Pages
-        if: ${{ inputs.deploy_to_github_pages == true }}
+        if: ${{ inputs.deploy_to_github_pages }}
         id: configure-pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
       # Parses the defined static.json file for use in steps and injects "_static" internal configuration.
       - name: Parsing static.json
         id: static
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        env:
+          base_url: ${{ steps.configure-pages.outputs.base_url }}
+          origin: ${{ steps.configure-pages.outputs.origin }}
+          host: ${{ steps.configure-pages.outputs.host }}
+          base_path: ${{ steps.configure-pages.outputs.base_path }}
+          static_json_path: ${{ inputs.static_json_path }}
         with:
           script: |
             /**
@@ -57,7 +74,7 @@ jobs:
             const fs = require('fs');
             let config = {};
             try {
-              config = JSON.parse(fs.readFileSync('./static.json', 'utf8'));
+              config = JSON.parse(fs.readFileSync(process.env.static_json_path, 'utf8'));
             } catch (e) {
               core.setFailed(`Unable to parse static.json: ${e.message}`);
             }
@@ -103,39 +120,44 @@ jobs:
 
             return utils.parse({ core }, {
               host: {
-                "base_url": "${{ steps.configure-pages.outputs.base_url }}",
-                "origin": "${{ steps.configure-pages.outputs.origin }}",
-                "host": "${{ steps.configure-pages.outputs.host }}",
-                "base_path": "${{ steps.configure-pages.outputs.base_path }}",
+                "base_url": process.env.base_url,
+                "origin": process.env.origin,
+                "host": process.env.host,
+                "base_path": process.env.base_path,
               }
             });
       # Build the application and create an artifact for deployment.
       - name: Configure Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           cache: npm
-          node-version: lts/iron
+          node-version: lts/krypton
       - name: Install Dependencies
         run: npm ci
       - name: Obtain Generator Version
+        env:
+          GENERATOR_PACKAGE: ${{ fromJson(steps.static.outputs.result)._static.generator.name }}
         run: |
-          echo "GENERATOR_VERSION=$(npm show '${{ fromJson(steps.static.outputs.result)._static.generator.name }}' --json | jq -r '.version')" >> "$GITHUB_ENV"
-      # Obtrains the repository URL from the generator's npm package and converts it to `<owner>/<repo>` format for actions/checkout.
+          echo "GENERATOR_VERSION=$(npm show $GENERATOR_PACKAGE --json | jq -r '.version')" >> "$GITHUB_ENV"
+      # Obtains the repository URL from the generator's npm package and converts it to `<owner>/<repo>` format for actions/checkout.
       - name: Obtain Generator Repository
+        env:
+          GENERATOR_PACKAGE: ${{ fromJson(steps.static.outputs.result)._static.generator.name }}
         run: |
           echo "GENERATOR_REPOSITORY=$( \
-            npm show '${{ fromJson(steps.static.outputs.result)._static.generator.name }}' --json \
+            npm show $GENERATOR_PACKAGE --json \
               | jq -r '.repository.url' \
               | sed 's/git+https:\/\/github.com\///' \
               | sed 's/.git//' \
           )" >> "$GITHUB_ENV"
       # Clone the generator repository and checkout the version specified in the static.json file.
       - name: Cloning Generator
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{inputs.generator_repository || env.GENERATOR_REPOSITORY}}
           ref: ${{inputs.generator_ref || env.GENERATOR_VERSION}}
-          path: '.static--generator'
+          path: ".static--generator"
       # Ensure the static.json file is the user-defined file and not the generator's file.
       # Uses `jq` and an environment variable to avoid issues with unescaped quotes in JSON values.
       - name: Replacing static.json in Generator
@@ -161,10 +183,11 @@ jobs:
       - name: Copying Output to Base Directory
         run: cp -r ./.static--generator/out ./out
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        if: ${{ inputs.upload_artifact }}
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: ./out
       - name: Deploy to GitHub Pages
-        if: ${{ inputs.deploy_to_github_pages == true }}
+        if: ${{ inputs.deploy_to_github_pages }}
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

README.md

@@ -2,7 +2,6 @@
 
 Reusable GitHub Actions and workflows that can be used to implement [`static`](https://github.com/from-static) application design patterns.
 
-
 ## Available Workflows
 
 ### `static`
@@ -44,7 +43,6 @@ jobs:
 
 The `static` workflow injects the following properties into the provided `static.json` file during the build process:
 
-
 - Sourced from [`actions/configure-pages@4`](https://github.com/actions/configure-pages/blob/1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d/action.yml#L22)
   - `_static.host.base_url`
     - GitHub Pages site full base URL.
@@ -66,12 +64,12 @@ Since `v2`, the `static` workflow uses `npm` to install generators (and uses the
 ```yaml
 version: 2
 updates:
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-    interval: "weekly"
-- package-ecosystem: "npm"
-  directory: "/"
-  schedule:
-    interval: "weekly"
-```
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+```