chore(deps): bump untildify from 4.0.0 to 6.0.0

Bumps [untildify](https://github.com/sindresorhus/untildify) from 4.0.0 to 6.0.0. - [Release notes](https://github.com/sindresorhus/untildify/releases) - [Commits](https://github.com/sindresorhus/untildify/compare/v4.0.0...v6.0.0) --- updated-dependencies: - dependency-name: untildify dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
chore(ci): improve workflows & dependabot (#1928 )
2026-05-30 00:00:04 +08:00 · 2026-05-19 11:20:50 +00:00 · 2026-05-19 19:18:26 +09:00 · 2026-05-19 12:43:08 +09:00
7 changed files with 83 additions and 25 deletions
@@ -39,8 +39,21 @@ github:
    merge: false
    rebase: false

+  rulesets:
+    - name: "Default Branch Protection"
+      type: branch
+      branches:
+        includes:
+          - "~DEFAULT_BRANCH"
+          - "release/*"
+          - "rel/*"
+        excludes: []
+      bypass_teams:
+        - root
+      restrict_deletion: true
+      restrict_force_push: true
 notifications:
-  commits:              commits@cordova.apache.org
-  issues:               issues@cordova.apache.org
-  pullrequests_status:  issues@cordova.apache.org
+  commits: commits@cordova.apache.org
+  issues: issues@cordova.apache.org
+  pullrequests_status: issues@cordova.apache.org
  pullrequests_comment: issues@cordova.apache.org
@@ -0,0 +1,32 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    cooldown:
+      default-days: 4
+    schedule:
+      interval: "daily" # Every weekday, Monday to Friday
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    cooldown:
+      default-days: 4
+    schedule:
+      interval: "weekly" # By default on a Monday
@@ -41,12 +41,15 @@ jobs:
        os: [ubuntu-latest, windows-latest, macos-15]

    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}

-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'temurin'
          java-version: '17'
@@ -61,7 +64,7 @@ jobs:
      # It contains mixed content from the npm package "cordova-js" and "./cordova-js-src".
      # The report might not be resolvable because of the external package.
      # If the report is related to this repository, it would be detected when scanning "./cordova-js-src".
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
        with:
          languages: javascript, java-kotlin
          queries: security-and-quality
@@ -74,12 +77,11 @@ jobs:

      - name: npm install and test
        run: |
-          npm i
-          npm t
+          npm cit
        env:
          CI: true

-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5

      # v4.6.0
      - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
@@ -31,10 +31,15 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
+          package-manager-cache: false
+          cache: ''

      - name: Setup environment variables
        run: |
@@ -68,14 +73,14 @@ jobs:
      - name: Verify Target Release Version
        run: |
          PACKAGE_VERSION=$(jq -r '.version' package.json)
-          if [ $PACKAGE_VERSION != "$TARGET_RELEASE_VERSION" ]; then
+          if [ "$PACKAGE_VERSION" != "$TARGET_RELEASE_VERSION" ]; then
            echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and package version ($PACKAGE_VERSION)"
            exit 1
          fi

          if [ -f "plugin.xml" ]; then
-            PLUGIN_VERSION=$(yq -p=xml -o=json '.plugin.+@version' plugin.xml)
-            if [ $PLUGIN_VERSION != "$TARGET_RELEASE_VERSION" ]; then
+            PLUGIN_VERSION=$(yq -p=xml -o=json '.plugin.+@version' plugin.xml | jq -r .)
+            if [ "$PLUGIN_VERSION" != "$TARGET_RELEASE_VERSION" ]; then
              echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and plugin version ($PLUGIN_VERSION)"
              exit 1
            fi
@@ -83,7 +88,7 @@ jobs:

      - name: Generate "tgz" npm convenience package
        run: |-
-          npm install
+          npm ci
          NPM_PKG_NAME=$(npm pack --json | jq -r '.[0].filename')
          mv ./.asf-release/$NPM_PKG_NAME ./.asf-release/${NPM_PACKAGE_NAME}.tgz
        env:
@@ -142,7 +147,7 @@ jobs:
          CORDOVA_GPG_SECRET_KEY: ${{ secrets.CORDOVA_GPG_SECRET_KEY }}

      - name: Upload to Apache Trusted Release (ATR)
-        uses: apache/tooling-actions/upload-to-atr@b7e972c11790ee16eca101900af1b3c7fd1b106e
+        uses: apache/tooling-actions/upload-to-atr@f5f4c0e7ddfbde6b1f8288cef36324c6def68051
        with:
          project: ${{ env.REPO_NAME }}
          version: ${{ env.TARGET_RELEASE_VERSION }}
@@ -34,13 +34,16 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      # Checkout project
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 1

      # Check license headers (v2.0.0)
      - uses: erisu/apache-rat-action@46fb01ce7d8f76bdcd7ab10e7af46e1ea95ca01c

      # Setup environment with node
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

@@ -19,7 +19,7 @@
        "properties-parser": "^0.6.0",
        "semver": "^7.7.4",
        "string-argv": "^0.3.2",
-        "untildify": "^4.0.0",
+        "untildify": "^6.0.0",
        "which": "^6.0.1"
      },
      "devDependencies": {
@@ -4598,12 +4598,15 @@
      }
    },
    "node_modules/untildify": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/untildify/-/untildify-4.0.0.tgz",
-      "integrity": "sha512-KK8xQ1mkzZeg9inewmFVDNkg3l5LUhoq9kN6iWYB/CC9YMG8HA+c1Q8HwDe6dEX7kErrEVNVBO3fWsVq5iDgtw==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/untildify/-/untildify-6.0.0.tgz",
+      "integrity": "sha512-sA2YTBvW2F463GvSbiZtso+dpuQV+B7xX9saX30SGrR5Fyx4AUcvA/zN+ShAkABKUKVyDaHECsJrHv5ToTuHsQ==",
      "license": "MIT",
      "engines": {
-        "node": ">=8"
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
    "node_modules/uri-js": {
@@ -34,7 +34,7 @@
    "properties-parser": "^0.6.0",
    "semver": "^7.7.4",
    "string-argv": "^0.3.2",
-    "untildify": "^4.0.0",
+    "untildify": "^6.0.0",
    "which": "^6.0.1"
  },
  "devDependencies": {