Merge pull request #3 from DIYgod/master

[pull] master from diygod:master

.github/workflows/build-assets.yml

@@ -1,18 +1,25 @@
-name: build assets
+name: Build assets
 
 on:
   push:
     branches:
       - master
     paths:
-      - 'lib/**'
-      - 'scripts/workflow/*.js'
+      - 'assets/radar-rules.js'
+      - 'lib/**/maintainer.js'
+      - 'lib/**/radar-rules.js'
+      - 'lib/**/radar.js'
+
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
     name: Build assets
     timeout-minutes: 5
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/comment-on-issue.yml

@@ -9,6 +9,7 @@ jobs:
     name: Call maintainers
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    if: github.event.sender.login != 'issuehunt-oss[bot]'
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v2

.github/workflows/docker-release.yml

@@ -1,4 +1,4 @@
-name: '[docker] CI for releases'
+name: 'Docker Release'
 
 on:
   push:
@@ -13,7 +13,7 @@ on:
       - '!lib/v2/test/**'
       - '!test/**'
       - 'Dockerfile'
-  workflow_dispatch: ~
+  workflow_dispatch: {}
 
 jobs:
   check-env:

.github/workflows/pr-deploy-route-test.yml → .github/workflows/docker-test-cont.yml

@@ -1,4 +1,5 @@
 name: PR - route test
+
 on:
   workflow_run:
     workflows: [ PR - Docker build test ]  # open, reopen, synchronized, edited included
@@ -32,7 +33,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Fetch affected routes
-        id: fetchRoute
+        id: fetch-route
         uses: actions/github-script@v6
         env:
           PULL_REQUEST: ${{ steps.pr-data.outputs.data }}
@@ -87,17 +88,17 @@ jobs:
         uses: actions/github-script@v6
         env:
           TEST_BASEURL: http://localhost:1200
-          TEST_ROUTES: ${{ steps.fetchRoute.outputs.result }}
+          TEST_ROUTES: ${{ steps.fetch-route.outputs.result }}
           PULL_REQUEST: ${{ steps.pr-data.outputs.data }}
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const PR = JSON.parse(process.env.PULL_REQUEST)
             const link = process.env.TEST_BASEURL
             const routes = JSON.parse(process.env.TEST_ROUTES)
             const number = PR.number
             core.info(`${link}, ${routes}, ${number}`)
-            const got = require("got");
+            const got = require("got")
             const script = require(`${process.env.GITHUB_WORKSPACE}/scripts/workflow/test-route/test.js`)
             return script({ github, context, core, got }, link, routes, number)
 

.github/workflows/docker-test.yml

@@ -1,5 +1,3 @@
-# name: '[docker] CI for build tests'
-# https://github.community/t/215358
 name: PR - Docker build test
 
 on:

.github/workflows/docs-search-index.yml

@@ -8,17 +8,19 @@ on:
       - '.github/workflows/docs-search-index.yml'
       - 'scripts/docs-scraper/docs.rsshub.app.json'
       - 'website/**'
-  workflow_dispatch: ~
+  workflow_dispatch: {}
   schedule:
   - cron: '44 1 * * 1'
 
+permissions:
+  contents: read
+
 concurrency:
   group: docs-search-index
 
 jobs:
   scrape-docs:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -28,6 +30,7 @@ jobs:
         run: sleep 2m
         if: github.event_name == 'push'
       - name: Run docs-scraper
+        timeout-minutes: 15
         env:
           HOST_URL: ${{ secrets.MEILISEARCH_HOST_URL }}
           API_KEY: ${{ secrets.MEILISEARCH_API_KEY }}

.github/workflows/format.yml

@@ -1,4 +1,4 @@
-name: format
+name: Format
 
 on:
   push:

.github/workflows/issue-command.yml

@@ -13,6 +13,9 @@ jobs:
     if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase') && github.event.comment.author_association == 'COLLABORATOR'
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout the latest code
         uses: actions/checkout@v4
@@ -32,7 +35,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: bdougie/[email protected]
+      - uses: bdougie/[email protected].1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           trigger: '/wip'
@@ -64,7 +67,7 @@ jobs:
         run: pnpm i && pnpm rb
 
       - name: Fetch affected routes
-        id: fetchRoute
+        id: fetch-route
         uses: actions/github-script@v6
         env:
           EVENT: ${{ toJson(github.event) }}
@@ -91,7 +94,7 @@ jobs:
         uses: actions/github-script@v6
         env:
           TEST_BASEURL: http://localhost:1200
-          TEST_ROUTES: ${{ steps.fetchRoute.outputs.result }}
+          TEST_ROUTES: ${{ steps.fetch-route.outputs.result }}
           EVENT: ${{ toJson(github.event) }}
         with:
           script: |

.github/workflows/pr-lint.yml → .github/workflows/lint.yml

@@ -1,26 +1,35 @@
 name: Linter
 
-on: [push, pull_request, pull_request_target]
+# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request
+# pull_request includes [opened, reopened, synchronize] events by default
+# 'edited' is required for title-lint
+on:
+  push: {}
+  pull_request:
+    types: [opened, reopened, synchronize, edited]
+  pull_request_target:
+    types: [opened, reopened, synchronize, edited]
 
 jobs:
-  eslint:
-    name: ESLint
-    if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 8
-      - uses: actions/setup-node@v3
-        with:
-          node-version: lts/*
-          cache: 'pnpm'
-      - run: pnpm i
-      - name: Lint
-        run: pnpm run lint
+  # eslint:
+  #   name: ESLint
+  #   if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
+  #   runs-on: ubuntu-latest
+  #   timeout-minutes: 5
+  #   steps:
+  #     - uses: actions/checkout@v4
+  #     - uses: pnpm/action-setup@v2
+  #       with:
+  #         version: 8
+  #     - uses: actions/setup-node@v3
+  #       with:
+  #         node-version: lts/*
+  #         cache: 'pnpm'
+  #     - run: pnpm i
+  #     - name: Lint
+  #       run: pnpm run lint
 
+# https://github.com/actions/starter-workflows/blob/main/code-scanning/eslint.yml
   eslint-warning:
     name: Lint
     if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
@@ -50,11 +59,14 @@ jobs:
           sarif_file: eslint-results.sarif
           wait-for-processing: true
 
-  titleLint:
+# https://github.com/amannn/action-semantic-pull-request
+  title-lint:
     if: ${{ github.event_name == 'pull_request_target' && github.repository == 'DIYgod/RSSHub' }}
     name: Validate PR title
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:
@@ -75,21 +87,3 @@ jobs:
       - uses: actions/labeler@v4
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-
-  chatgpt-review:
-    name: ChatGPT PR reviewer
-    if: ${{ github.event_name == 'pull_request_target' && false }}
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: fluxninja/openai-pr-reviewer@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        with:
-          openai_base_url: ${{ secrets.OPENAI_API_ENDPOINT }}
-          openai_model_temperature: '1.0'
-          disable_release_notes: true

.github/workflows/npm-publish.yml

@@ -1,4 +1,4 @@
-name: publish
+name: npm Publish
 
 on:
   push:

.github/workflows/semgrep.yml

@@ -1,26 +1,49 @@
+name: Semgrep
+
+# https://semgrep.dev/docs/semgrep-ci/sample-ci-configs/#sample-github-actions-configuration-file
 on:
   pull_request_target:
     branches:
-    - master
-    paths:
-    - .github/workflows/semgrep.yml
+      - master
   push:
     branches:
-    - master
-    paths:
-    - .github/workflows/semgrep.yml
+      - master
   schedule:
-  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
-  - cron: 21 20 * * *
-name: Semgrep
+    # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+    - cron: 21 20 * * *
+
+permissions:
+  contents: read
+
 jobs:
   semgrep:
     name: Scan
     runs-on: ubuntu-latest
-    env:
-      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
     container:
       image: returntocorp/semgrep
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+      - uses: actions/checkout@v4
+      - run: semgrep ci
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+
+  semgrep-github:
+    name: Scan
+    runs-on: ubuntu-latest
+    container:
+      image: returntocorp/semgrep
+    if: (github.actor != 'dependabot[bot]')
+    permissions:
+      contents: read
+      security-events: write
     steps:
-    - uses: actions/checkout@v4
-    - run: semgrep ci
+      - uses: actions/checkout@v4
+      - run: semgrep ci --sarif --output=semgrep.sarif
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+      - name: Upload SARIF file for GitHub Advanced Security Dashboard
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: semgrep.sarif
+        if: always()

.github/workflows/stale.yml

@@ -1,4 +1,5 @@
 name: 'Close stale issues and PRs'
+
 on:
   schedule:
     - cron: '31 23 * * *'
@@ -21,3 +22,6 @@ jobs:
             This PR is stale because it has been opened for more than 3 weeks with no activity. Comment or this will be closed in 7 days.
           close-issue-message: 'This issue was closed because it has been stalled for 7 days with no activity.'
           close-pr-message: 'This PR was closed because it has been stalled for 7 days with no activity.'
+          exempt-issue-labels: 'dependencies,wait for upstream'
+          exempt-pr-labels: 'dependencies,wait for upstream'
+          any-of-labels: 'more data required'

.github/workflows/test.yml

@@ -1,4 +1,4 @@
-name: test
+name: Test
 
 on:
   push:
@@ -13,7 +13,7 @@ on:
       - 'package.json'
       - 'pnpm-lock.yaml'
       - '.github/workflows/test.yml'
-  pull_request: ~
+  pull_request: {}
 
 permissions:
   contents: read

lib/maintainer.js

@@ -37,7 +37,7 @@ for (const dir in maintainerPath) {
     }
 
     for (const key in routes) {
-        maintainers['/' + dir + key] = routes[key];
+        maintainers['/' + dir + (key.endsWith('/') ? key.substring(0, key.length - 1) : key)] = routes[key];
     }
 }
 
@@ -49,4 +49,9 @@ router.stack.forEach((e) => {
     }
 });
 
-module.exports = maintainers;
+module.exports = Object.keys(maintainers)
+    .sort()
+    .reduce((obj, path) => {
+        obj[path] = maintainers[path];
+        return obj;
+    }, {});