chore(workflows): Update workflows

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-name: Build
+name: 🛠️ Build
 
 on:
   push:
@@ -14,22 +14,20 @@ permissions:
 jobs:
   build:
     runs-on: [ubuntu-latest]
-
     name: Build Material Icons Browser Extension
-
     steps:
-      - name: Checkout 🛎
+      - name: 🛎️ Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
 
-      - name: Install dependencies 📦
+      - name: 📦 Install dependencies
         run: npm ci
 
-      - name: Check code quality 🔍
+      - name: 🧹 Check code quality
         run: npm run lint
 
-      - name: Build extension 🛠
+      - name: 🛠️ Build extension
         run: npm run build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-closed.yml

@@ -0,0 +1,33 @@
+name: 🎉 PR closed
+
+on:
+  pull_request:
+    types:
+      - closed
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  thank-you:
+    runs-on: ubuntu-latest
+
+    if: github.event.pull_request.merged == true
+
+    steps:
+      - name: 🙏 Post Thank You Comment
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `
+              ## Merge Successful
+
+              Thanks for your contribution! 🎉
+
+              The changes will be part of the upcoming update on the Marketplace.`
+            })

.github/workflows/pr-title.yml

@@ -0,0 +1,43 @@
+name: ✅ Check PR Title
+
+on:
+  pull_request:
+    types: [opened, edited]
+
+permissions:
+  pull-requests: write
+  issues: write # Update issue labels
+
+jobs:
+  lint-pr-title:
+    name: Check PR Title
+
+    runs-on: ubuntu-latest
+
+    if: ${{ github.event.action == 'opened' || github.event.changes.title != null }}
+
+    steps:
+      - name: 📥 Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # Only fetch the config file from the repository
+          sparse-checkout-cone-mode: false
+          sparse-checkout: |
+            .github/scripts/update-status-label.sh
+            commitlint.config.js
+
+      - name: 📦 Install dependencies
+        run: npm install --global @commitlint/config-conventional commitlint
+
+      - name: 🔍 Check PR title with commitlint
+        id: title-check
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          HELP_URL: https://github.com/material-extensions/vscode-material-icon-theme/blob/main/CONTRIBUTING.md#conventional-pull-request-titles
+        run: echo "$PR_TITLE" | npx commitlint --help-url $HELP_URL
+
+      - name: 🏷️ Manage label based on PR title check result
+        if: always()
+        run: .github/scripts/update-status-label.sh ${{ github.event.pull_request.number }} ${{ steps.title-check.outcome }} "🔤 invalid title"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: Release new version
+name: 🚀 Release new version
 on:
   workflow_dispatch:
     inputs:
@@ -28,51 +28,53 @@ jobs:
       id-token: write
 
     steps:
-      - name: Use App Token for the Bot which is allowed to create releases
+      - name: 🤖 Use App Token for the Bot which is allowed to create releases
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
         id: app-token
         with:
           app-id: ${{ vars.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - name: 📥 Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/setup-node@v4
+      - name: 🛠️ Setup Node
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: "20"
 
-      - name: install dependencies
+      - name: 📦 Install dependencies
         run: npm ci
 
-      - name: build extension
+      - name: 🏗️ Build extension
         if: ${{ github.event.inputs.onlyUpload != 'not' && github.event.inputs.onlyUpload != 'none' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm run build
 
-      - name: Attempt update
+      - name: 🔄 Attempt update
         if: ${{ github.event.inputs.onlyUpload == 'not' || github.event.inputs.onlyUpload == 'none' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm run release ${{ github.event.inputs.versionChange }}
 
-      - name: Get package version
+      - name: 📝 Get package version
         if: ${{ github.event.inputs.onlyUpload == 'not' || github.event.inputs.onlyUpload == 'none' }}
         run: echo "package_version=v$(jq -r .version package.json)" >> $GITHUB_ENV
 
-      - name: Commit updated files
+      - name: 💾 Commit updated files
         if: ${{ github.event.inputs.onlyUpload == 'not' || github.event.inputs.onlyUpload == 'none' }}
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           add: "."
           message: "[auto] release  ${{env.package_version}}"
           tag: "${{env.package_version}}"
 
-      - name: Release
+      - name: 🚀 Release
         if: ${{ github.event.inputs.onlyUpload == 'not' || github.event.inputs.onlyUpload == 'none' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -80,10 +82,10 @@ jobs:
           files: "*.zip"
           generate_release_notes: true
 
-      - name: Upload to chrome store
+      - name: 🌐 Upload to chrome store
         if: ${{ github.event.inputs.onlyUpload != 'firefox' && github.event.inputs.onlyUpload != 'none' }}
         continue-on-error: true
-        uses: trmcnvn/chrome-addon@v2
+        uses: trmcnvn/chrome-addon@7fc5a5ad3ff597dc64d6a13de7dcaa8515328be7 # v2
         with:
           extension: bggfcpfjbdkhfhfmkjpbhnkhnpjjeomc
           zip: github-material-icons-chrome-extension.zip
@@ -91,10 +93,10 @@ jobs:
           client-secret: ${{ secrets.CHROME_CLIENT_SECRET }}
           refresh-token: ${{ secrets.CHROME_REFRESH_TOKEN }}
 
-      - name: Upload to edge store
+      - name: 🌐 Upload to edge store
         if: ${{ github.event.inputs.onlyUpload != 'edge' && github.event.inputs.onlyUpload != 'none' }}
         continue-on-error: true
-        uses: wdzeng/edge-addon@v1
+        uses: wdzeng/edge-addon@e307af4adb6d4e1c12387dc7d6bd545dcd075909 # v1.2.5
         with:
           product-id: d7692295-d84f-4bf5-9447-3cbb6ae29517
           zip-path: github-material-icons-edge-extension.zip
@@ -102,7 +104,7 @@ jobs:
           client-secret: ${{ secrets.EDGE_CLIENT_SECRET }}
           access-token-url: ${{ secrets.EDGE_ACCESS_TOKEN_URL }}
 
-      - name: Upload to firefox store
+      - name: 🌐 Upload to firefox store
         if: ${{ github.event.inputs.onlyUpload != 'chrome' && github.event.inputs.onlyUpload != 'none'}}
         continue-on-error: true
         run: npx web-ext sign -s ./dist/firefox/ --channel=listed --api-key=${{ secrets.FIREFOX_API_JWT_ISSUER }} --api-secret=${{ secrets.FIREFOX_API_JWT_SECRET }}

.github/workflows/update-from-upstream.yml

@@ -16,25 +16,27 @@ jobs:
       id-token: write
 
     steps:
-      - name: Use App Token for the Bot which is allowed to create releases
+      - name: 🤖 Use App Token for the Bot which is allowed to create releases
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
         id: app-token
         with:
           app-id: ${{ vars.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - name: 📥 Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/setup-node@v4
+      - name: 🛠️ Setup Node
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: "20"
 
-      - name: Install dependencies
+      - name: 📦 Install dependencies
         run: npm ci
 
-      - name: Fetch release version
+      - name: 🔍 Fetch release version
         id: upstream
         run: |
           release_tag=$(npm view material-icon-theme version)
@@ -42,7 +44,7 @@ jobs:
           echo "release_tag=$release_tag" >> $GITHUB_ENV
           echo "current_tag=$current_tag" >> $GITHUB_ENV
 
-      - name: Attempt update
+      - name: 🔄 Attempt update
         if: env.release_tag != env.current_tag
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -50,22 +52,22 @@ jobs:
           npm run update
           npm i material-icon-theme@5.x
 
-      - name: Get package version
+      - name: 📝 Get package version
         if: env.release_tag != env.current_tag
         run: |
           echo "package_version=v$(jq -r .version package.json)" >> $GITHUB_ENV
 
-      - name: Commit updated files
+      - name: 💾 Commit updated files
         if: env.release_tag != env.current_tag
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           add: "."
           message: "[auto] update to upstream ${{env.release_tag}}"
           tag: "${{env.package_version}}"
 
-      - name: Release
+      - name: 🚀 Release
         if: env.release_tag != env.current_tag
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -74,10 +76,10 @@ jobs:
           files: "*.zip"
           generate_release_notes: true
 
-      - name: Upload to chrome store
+      - name: 🌐 Upload to chrome store
         if: env.release_tag != env.current_tag
         continue-on-error: true
-        uses: trmcnvn/chrome-addon@v2
+        uses: trmcnvn/chrome-addon@7fc5a5ad3ff597dc64d6a13de7dcaa8515328be7 # v2
         with:
           extension: bggfcpfjbdkhfhfmkjpbhnkhnpjjeomc
           zip: github-material-icons-chrome-extension.zip
@@ -85,10 +87,10 @@ jobs:
           client-secret: ${{ secrets.CHROME_CLIENT_SECRET }}
           refresh-token: ${{ secrets.CHROME_REFRESH_TOKEN }}
 
-      - name: Upload to edge store
+      - name: 🌐 Upload to edge store
         if: env.release_tag != env.current_tag
         continue-on-error: true
-        uses: wdzeng/edge-addon@v1
+        uses: wdzeng/edge-addon@e307af4adb6d4e1c12387dc7d6bd545dcd075909 # v1.2.5
         with:
           product-id: d7692295-d84f-4bf5-9447-3cbb6ae29517
           zip-path: github-material-icons-edge-extension.zip
@@ -96,7 +98,7 @@ jobs:
           client-secret: ${{ secrets.EDGE_CLIENT_SECRET }}
           access-token-url: ${{ secrets.EDGE_ACCESS_TOKEN_URL }}
 
-      - name: Upload to firefox store
+      - name: 🌐 Upload to firefox store
         if: env.release_tag != env.current_tag
         continue-on-error: true
         run: npx web-ext sign -s ./dist/firefox/ --channel=listed --api-key=${{ secrets.FIREFOX_API_JWT_ISSUER }} --api-secret=${{ secrets.FIREFOX_API_JWT_SECRET }}

renovate.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base", "helpers:pinGitHubActionDigests"],
+  "ignoreDeps": ["material-icon-theme"],
+  "packageRules": [
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "GitHub Actions workflows",
+      "groupSlug": "github-actions"
+    },
+    {
+      "matchManagers": ["npm"],
+      "groupName": "NPM packages",
+      "groupSlug": "npm-packages"
+    }
+  ]
+}