wp

.eslintrc-code-compatibility.js

@@ -14,6 +14,7 @@ module.exports = {
   ],
   ignorePatterns: [
     '/libs/deps/*',
+    '/libs/navigation/dist/*',
     '/tools/loc/*',
   ],
 };

.eslintrc.js

@@ -62,6 +62,7 @@ module.exports = {
     '/libs/features/mas/*',
     '/tools/loc/*',
     '/libs/features/spectrum-web-components/*',
+    '/libs/navigation/dist/*',
   ],
   plugins: [
     'chai-friendly',

.github/codeql/codeql-config.yml

@@ -6,3 +6,4 @@ paths-ignore:
   - 'tools/translation/**'
   - node_modules
   - libs/deps/mas
+  - libs/features/mas/dist

.github/workflows/README.md

@@ -0,0 +1,5 @@
+### Description
+Based on the [Github security guidance](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) we pinned actions to a full length commit SHA's rather than tags, which are more common.
+In order to upgrade an action, simply go to the Github repo such as: https://github.com/actions/checkout/releases - find the latest release and the commit-SHA that is connected to it and replace it for all actions that use the 3rd party package you want to upgrade.
+
+To QA the change, when you run the action on your own fork, you can simply validate it's still running as expected and manages to download the 3rd party package within the scope of the action.

.github/workflows/code-compatibility.yaml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Check for unsupported functions
         run: |

.github/workflows/codeql.yml

@@ -34,19 +34,19 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/codeql-config.yml
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -59,6 +59,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dispatch.yml

@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4    
-      - uses: dorny/paths-filter@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683    
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
         id: changes
         with:
           base: ${{ github.ref }}
@@ -23,7 +23,7 @@ jobs:
               - 'libs/**'    
       - if: steps.changes.outputs.src == 'true'
         name: Trigger DC Workflow
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
           github-token: ${{ secrets.DC_PAT }}
           script: |

.github/workflows/fg-sync-repos.yml

@@ -22,15 +22,15 @@ jobs:
     steps:
       - name: Generate a token
         id: generate_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e
         with:
           app-id: ${{ secrets.FG_SYNC_APP_ID }}
           private-key: ${{ secrets.FG_SYNC_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: "milo-pink"
 
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           persist-credentials: false
           ref: ${{ inputs.syncBranch || github.ref_name }}

.github/workflows/helpers.js

@@ -3,57 +3,83 @@
 const owner = process.env.REPO_OWNER || ''; // example owner: adobecom
 const repo = process.env.REPO_NAME || ''; // example repo name: milo
 const auth = process.env.GH_TOKEN || ''; // https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
-const CURRENT_YEAR = 2024;
 const RCPDates = [
   {
-    start: new Date('2024-05-26T00:00:00-07:00'),
-    end: new Date('2024-06-01T00:00:00-07:00'),
+    start: new Date('2024-12-12T11:00:00-08:00'),
+    end: new Date('2024-12-12T14:00:00-08:00'),
   },
   {
-    start: new Date('2024-06-13T11:00:00-07:00'),
-    end: new Date('2024-06-13T14:00:00-07:00'),
+    start: new Date('2024-12-15T00:00:00-08:00'),
+    end: new Date('2025-01-02T00:00:00-08:00'),
   },
   {
-    start: new Date('2024-06-30T00:00:00-07:00'),
-    end: new Date('2024-07-06T00:00:00-07:00'),
+    start: new Date('2025-02-23T00:00:00-08:00'),
+    end: new Date('2025-03-01T00:00:00-08:00'),
   },
   {
-    start: new Date('2024-08-25T00:00:00-07:00'),
-    end: new Date('2024-08-31T00:00:00-07:00'),
+    start: new Date('2025-03-12T11:00:00-07:00'),
+    end: new Date('2025-03-12T14:00:00-07:00'),
   },
   {
-    start: new Date('2024-09-12T11:00:00-07:00'),
-    end: new Date('2024-09-12T14:00:00-07:00'),
+    start: new Date('2025-03-17T00:00:00-07:00'),
+    end: new Date('2025-03-20T17:00:00-07:00'),
   },
   {
-    start: new Date('2024-10-07T00:00:00-07:00'),
-    end: new Date('2024-10-18T17:00:00-07:00'),
+    start: new Date('2025-05-25T00:00:00-07:00'),
+    end: new Date('2025-05-31T00:00:00-07:00'),
   },
   {
-    start: new Date('2024-11-17T00:00:00-08:00'),
-    end: new Date('2024-11-30T00:00:00-08:00'),
+    start: new Date('2025-06-12T11:00:00-07:00'),
+    end: new Date('2025-06-12T14:00:00-07:00'),
   },
   {
-    start: new Date('2024-12-12T11:00:00-08:00'),
-    end: new Date('2024-12-12T14:00:00-08:00'),
+    start: new Date('2025-06-29T00:00:00-07:00'),
+    end: new Date('2025-07-05T00:00:00-07:00'),
   },
   {
-    start: new Date('2024-12-15T00:00:00-08:00'),
-    end: new Date('2025-01-02T00:00:00-08:00'),
+    start: new Date('2025-08-24T00:00:00-07:00'),
+    end: new Date('2025-08-30T00:00:00-07:00'),
+  },
+  {
+    start: new Date('2025-09-11T11:00:00-07:00'),
+    end: new Date('2025-09-11T14:00:00-07:00'),
+  },
+  {
+    start: new Date('2025-10-06T00:00:00-07:00'),
+    end: new Date('2025-10-16T17:00:00-07:00'),
+  },
+  {
+    start: new Date('2025-11-16T00:00:00-08:00'),
+    end: new Date('2025-11-29T00:00:00-08:00'),
+  },
+  {
+    start: new Date('2025-12-10T11:00:00-08:00'),
+    end: new Date('2025-12-10T14:00:00-08:00'),
+  },
+  {
+    start: new Date('2025-12-14T00:00:00-08:00'),
+    end: new Date('2026-01-04T00:00:00-08:00'),
   },
 ];
 
-const isWithinRCP = (offset = 0) => {
+const isShortRCP = (start, end) => {
+  return ((end - start) / (1000 * 60 * 60)) < 24;
+};
+
+const isWithinRCP = ({ offset = 0, excludeShortRCP = false } = {}) => {
   const now = new Date();
-  if (now.getFullYear() !== CURRENT_YEAR) {
-    console.log(`ADD NEW RCPs for ${CURRENT_YEAR + 1}`);
+  const lastRcpDate = RCPDates.reverse()[0];
+  if (now > lastRcpDate.end) {
+    console.log('ADD NEW RCPs for the current year');
     return true;
   }
 
   if (RCPDates.some(({ start, end }) => {
     const adjustedStart = new Date(start);
     adjustedStart.setDate(adjustedStart.getDate() - offset);
-    return start <= now && now <= end
+    const match = adjustedStart <= now && now <= end;
+    if (!match || (excludeShortRCP && isShortRCP(start, end))) return false;
+    return true;
   })) {
     console.log(
       'Current date is within a RCP (2 days earlier for stage, to keep stage clean & make CSO contributions during an RCP easier). Stopping execution.'
@@ -138,6 +164,7 @@ const getReviews = ({ pr, github, owner, repo }) =>
       owner,
       repo,
       pull_number: pr.number,
+      per_page: 100,
     })
     .then(({ data }) => {
       pr.reviews = data;
@@ -148,6 +175,7 @@ module.exports = {
   getLocalConfigs,
   slackNotification,
   pulls: { addLabels, addFiles, getChecks, getReviews },
+  isShortRCP,
   isWithinRCP,
   RCPDates,
 };

.github/workflows/high-impact-alert.yml

@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           ref: ${{ github.event.pull_request.base.ref }}
 
       - name: Send Slack message for high impact PRs
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
           script: |
             const main = require('./.github/workflows/high-impact-alert.js')

.github/workflows/label-zero-impact.yaml

@@ -10,10 +10,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Add the zero impact label
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
           script: |
             const main = require('./.github/workflows/label-zero-impact.js')

.github/workflows/mark-stale-prs.yaml

@@ -9,7 +9,7 @@ jobs:
     if: github.repository_owner == 'adobecom'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: 'This PR has not been updated recently and will be closed in 7 days if no action is taken. Please ensure all checks are passing, https://github.com/orgs/adobecom/discussions/997 provides instructions. If the PR is ready to be merged, please mark it with the "Ready for Stage" label.'

.github/workflows/merge-to-main.js

@@ -9,6 +9,7 @@ const {
 const PR_TITLE = '[Release] Stage to Main';
 const STAGE = 'stage';
 const PROD = 'main';
+const MIN_SOT_APPROVALS = process.env.MIN_SOT_APPROVALS ? Number(process.env.MIN_SOT_APPROVALS) : 4;
 
 let github, owner, repo;
 
@@ -40,7 +41,7 @@ const main = async (params) => {
     const stageToMainPR = await getStageToMainPR();
     const signOffs = stageToMainPR?.labels.filter((l) => l.includes('SOT'));
     console.log(`${signOffs.length} SOT labels on PR ${stageToMainPR.number}`);
-    if (signOffs.length >= 4) {
+    if (signOffs.length >= MIN_SOT_APPROVALS) {
       console.log('Stage to Main  PR has all required labels. Merging...');
       await github.rest.pulls.merge({
         owner,