Maintenance

.github/workflows/cicd.yml

@@ -6,24 +6,28 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
 
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
         with:
-          node-version: 24
+          persist-credentials: false
 
-      - run: corepack enable
+      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+        with:
+          node-version: 25
 
       - name: find pnpm cache path
         id: cache
-        run: echo "path=$(pnpm store path)" >> $GITHUB_OUTPUT
+        run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.cache.outputs.path }}
           key: v1-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -36,7 +40,7 @@ jobs:
       - run: node --run lint
 
   fmt:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
@@ -48,22 +52,23 @@ jobs:
       - run: biome check
 
   typecheck:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
 
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
         with:
-          node-version: 24
+          persist-credentials: false
 
-      - run: corepack enable
+      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+        with:
+          node-version: 25
 
       - name: find pnpm cache path
         id: cache
-        run: echo "path=$(pnpm store path)" >> $GITHUB_OUTPUT
+        run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.cache.outputs.path }}
           key: v1-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -76,22 +81,23 @@ jobs:
       - run: node --run typecheck
 
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
 
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-
-      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
         with:
-          node-version: 24
+          persist-credentials: false
 
-      - run: corepack enable
+      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+        with:
+          node-version: 25
 
       - name: find pnpm cache path
         id: cache
-        run: echo "path=$(pnpm store path)" >> $GITHUB_OUTPUT
+        run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.cache.outputs.path }}
           key: v1-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -106,7 +112,7 @@ jobs:
           NODE_ENV: test
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
     permissions:
       contents: read
       packages: write
@@ -115,37 +121,35 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         with:
           images: |
             ghcr.io/${{ github.repository }}
           tags: |
             type=raw,value={{sha}}
             type=raw,value=latest
 
-      - name: Set up depot
-        uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1
-
       - name: Login to GHCR
         if: github.ref == 'refs/heads/main'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and maybe Push Docker image
-        uses: depot/build-push-action@9785b135c3c76c33db102e45be96a25ab55cd507 # v1
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
-          project: ks849krng9
           push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          #cache-from: type=gha
+          #cache-to: type=gha,mode=max
 
   deploy:
     if: github.ref == 'refs/heads/main'
     needs: [lint, test, typecheck, build]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
     environment:
       name: prod
       url: https://arm.haglund.dev/api

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine as base
+FROM node:25-alpine AS base
 
 WORKDIR /app
 
@@ -11,19 +11,22 @@ ENV NODE_ENV=production
 ENV NODE_COMPILE_CACHE=/node-cc
 RUN mkdir -p $NODE_COMPILE_CACHE
 
-FROM base as base_deps
+FROM base AS base_deps
 
 ENV CI=1
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
+RUN npm i -g npm@latest
+RUN npm i -g --force corepack@latest
 RUN corepack enable
 RUN corepack prepare --activate
 
 # Install dependencies
-RUN pnpm install --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm install --frozen-lockfile --ignore-scripts
 
-FROM base_deps as build
+FROM base_deps AS build
 
 COPY tsconfig.json tsdown.config.ts ./
 COPY src/ src/

biome.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.0.5/schema.json",
+	"$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",

eslint.config.ts

@@ -0,0 +1,62 @@
+import antfu from "@antfu/eslint-config"
+
+export default antfu({
+	ignores: ["**/*.json"],
+	markdown: false,
+	stylistic: false,
+	jsonc: false,
+	jsx: false,
+	pnpm: false,
+	toml: false,
+	test: { overrides: { "test/no-import-node-test": "off" } },
+	typescript: {
+		tsconfigPath: "tsconfig.json",
+		ignoresTypeAware: ["copy.ts", "*.config.*"],
+
+		overridesTypeAware: {
+			"ts/no-floating-promises": [
+				"error",
+				{
+					allowForKnownSafeCalls: [
+						{ from: "package", package: "node:test", name: ["describe", "it", "test"] },
+					],
+				},
+			],
+		},
+
+		overrides: {
+			"no-console": "off",
+			"antfu/no-top-level-await": "off",
+			"import/consistent-type-specifier-style": ["error", "prefer-top-level"],
+			"node/prefer-global/process": "off",
+			"ts/consistent-type-definitions": "off",
+			"ts/consistent-type-imports": [
+				"error",
+				{ fixStyle: "inline-type-imports", disallowTypeAnnotations: false },
+			],
+			"ts/no-unsafe-argument": "off",
+			"ts/no-unsafe-assignment": "off",
+			"ts/no-use-before-define": "off",
+			"unused-imports/no-unused-vars": "off",
+
+			"perfectionist/sort-imports": [
+				"error",
+				{
+					type: "natural",
+					internalPattern: ["^@/", "^~/", "^#[a-zA-Z0-9-]+/"],
+					newlinesBetween: "always",
+					groups: [
+						["builtin", "builtin-type"],
+						["external", "external-type"],
+						["internal", "internal-type"],
+						["parent", "parent-type"],
+						["sibling", "sibling-type"],
+						["index", "index-type"],
+						"object",
+						"unknown",
+					],
+				},
+			],
+		},
+	},
+})

mise.toml

@@ -1,2 +1,2 @@
 [tools]
-node = "24"
+node = "25"

package.json

@@ -6,9 +6,9 @@
 	"private": true,
 	"license": "AGPL-3.0-only",
 	"homepage": "https://arm.haglund.dev/docs",
-	"packageManager": "pnpm@10.18.1",
+	"packageManager": "pnpm@10.26.2",
 	"engines": {
-		"node": "^24"
+		"node": "^25"
 	},
 	"simple-git-hooks": {
 		"pre-commit": "node_modules/.bin/nano-staged"
@@ -34,28 +34,28 @@
 		"prepare": "simple-git-hooks"
 	},
 	"devDependencies": {
-		"@antfu/eslint-config": "5.4.1",
-		"@biomejs/biome": "2.2.5",
-		"@tsconfig/node24": "24.0.1",
-		"@tsconfig/strictest": "2.0.6",
+		"@antfu/eslint-config": "6.7.3",
+		"@biomejs/biome": "2.3.10",
+		"@tsconfig/node24": "24.0.3",
+		"@tsconfig/strictest": "2.0.8",
 		"@types/json-schema": "7.0.15",
-		"@types/node": "24.7.0",
-		"@typescript/native-preview": "7.0.0-dev.20251008.1",
-		"@vitest/coverage-v8": "4.0.0-beta.17",
+		"@types/node": "25.0.3",
+		"@typescript/native-preview": "7.0.0-dev.20251230.1",
+		"@vitest/coverage-v8": "4.0.16",
 		"db0": "0.3.4",
-		"eslint": "9.37.0",
-		"h3": "2.0.1-rc.2",
-		"kysely": "0.28.7",
+		"eslint": "9.39.2",
+		"h3": "2.0.1-rc.6",
+		"kysely": "0.28.9",
 		"kysely-db0": "0.1.0-beta.0",
-		"mentoss": "0.11.0",
+		"mentoss": "0.12.0",
 		"nano-staged": "0.8.0",
 		"onchange": "7.1.0",
-		"pino": "10.0.0",
-		"pino-pretty": "13.1.1",
+		"pino": "10.1.0",
+		"pino-pretty": "13.1.3",
 		"simple-git-hooks": "2.13.1",
-		"tsdown": "0.15.6",
-		"valibot": "1.1.0",
-		"vitest": "4.0.0-beta.17",
-		"xior": "0.7.8"
+		"tsdown": "0.18.3",
+		"valibot": "1.2.0",
+		"vitest": "4.0.16",
+		"xior": "0.8.2"
 	}
 }