Merge branch 'main' of github.com:sass/dart-sass into fix_operator_span

Author: nex3

.github/util/initialize/action.yml

@@ -5,6 +5,7 @@ inputs:
   node-version: {required: false, default: 'lts/*'}
   dart-sdk: {required: false, default: stable}
   architecture: {required: false}
+  for-npm-deploy: {required: false, default: false}
 runs:
   using: composite
   steps:
@@ -14,9 +15,22 @@ runs:
         architecture: "${{ inputs.architecture }}"
 
     - uses: actions/setup-node@v6
+      if: "inputs.for-npm-deploy != true"
       with:
         node-version: "${{ inputs.node-version }}"
 
+    - uses: actions/setup-node@v6
+      if: inputs.for-npm-deploy == true
+      with:
+        node-version: "${{ inputs.node-version }}"
+        check-latest: true
+        registry-url: 'https://registry.npmjs.org'
+
+    # npm trusted publisher infrastructure requires npm >=11.5.1
+    - run: npm install -g npm@latest
+      if: inputs.for-npm-deploy == true
+      shell: ${{ runner.os == 'Windows' && 'powershell' || 'bash' }}
+
     # See: https://github.com/dart-lang/sdk/issues/52266
     - run: Invoke-WebRequest https://pub.dev
       if: runner.os == 'Windows'
@@ -45,7 +59,7 @@ runs:
     # downloading repo via GitHub API.
     - name: Check out the language repo
       if: github.event_name != 'pull_request'
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with: {repository: sass/sass, path: build/language}
 
     - name: Generate Dart from protobuf

.github/workflows/build-linux.yml

@@ -56,7 +56,7 @@ jobs:
             target: android-riscv64
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
@@ -100,7 +100,7 @@ jobs:
           subject-path: build/*.tar.gz
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: build-${{ matrix.target }}
           path: build/*.tar.gz

.github/workflows/build-macos.yml

@@ -24,7 +24,7 @@ jobs:
             runner: macos-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
@@ -39,7 +39,7 @@ jobs:
           subject-path: build/*.tar.gz
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: build-macos-${{ matrix.arch }}
           path: build/*.tar.gz

.github/workflows/build-windows.yml

@@ -24,7 +24,7 @@ jobs:
             runner: windows-11-arm
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
@@ -39,7 +39,7 @@ jobs:
           subject-path: build/*.zip
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: build-windows-${{ matrix.arch }}
           path: build/*.zip

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     if: "github.ref_type == 'tag' && github.event.repository.fork == false"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
 

.github/workflows/release-sass-api.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
 

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
     needs: [build_linux, build_macos, build_windows]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
 
@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
 
       - name: Release
         run: gh release upload ${{ github.ref_name }} build-*/* --repo ${{ github.repository }}
@@ -63,22 +63,23 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
-        with: {github-token: "${{ github.token }}"}
+        with:
+          github-token: ${{ github.token }}
+          for-npm-deploy: true
 
       - name: Deploy
         run: dart run grinder pkg-npm-deploy
         env:
           UPDATE_SASS_SASS_REPO: false
-          NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
 
   deploy_pub:
     name: Deploy Pub
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           # We have to use this rather than the implicit GitHub token so that
           # pushing a new tag triggers another action.
@@ -104,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
       # Set up .npmrc file to publish to npm
@@ -113,11 +114,15 @@ jobs:
           node-version: 'lts/*'
           check-latest: true
           registry-url: 'https://registry.npmjs.org'
+
+      # npm trusted publisher infrastructure requires npm >=11.5.1
+      - run: npm install -g npm@latest
+
       - name: Get Dart Sass version
         id: dart-sass-version
         run: echo "version=${{ github.ref_name }}" | tee --append "$GITHUB_OUTPUT"
       - name: Check out the language repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with: {repository: sass/sass, path: build/language}
       - name: Copy types from the language repo
         run: cp -r build/language/js-api-doc pkg/sass-types/types
@@ -126,9 +131,7 @@ jobs:
       - name: Set the version of @sass/types
         run: npm pkg set version='${{ steps.dart-sass-version.outputs.version }}'
         working-directory: pkg/sass-types/
-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
+      - run: npm publish --provenance
         working-directory: pkg/sass-types/
 
   deploy_sass_parser:
@@ -137,7 +140,7 @@ jobs:
     needs: [deploy_npm]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN }}
       # Set up .npmrc file to publish to npm
@@ -147,8 +150,8 @@ jobs:
           check-latest: true
           registry-url: 'https://registry.npmjs.org'
 
-        # The repo package has a file dependency, but the released version needs
-        # a real dependency on the released version of Sass.
+      # The repo package has a file dependency, but the released version needs a
+      # real dependency on the released version of Sass.
       - name: Get Dart Sass version
         id: dart-sass-version
         run: echo "version=${{ github.ref_name }}" | tee --append "$GITHUB_OUTPUT"
@@ -157,9 +160,7 @@ jobs:
 
       - run: npm run compile
         working-directory: pkg/sass-parser/
-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
+      - run: npm publish --provenance
         working-directory: pkg/sass-parser/
 
       - name: Get Sass parser version
@@ -174,7 +175,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: dart-lang/setup-dart@v1
       - run: dart pub get
 
@@ -189,7 +190,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
 
@@ -203,7 +204,7 @@ jobs:
     needs: [deploy_npm]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           repository: sass/sass-site
           token: ${{ secrets.SASS_SITE_TOKEN }}
@@ -231,7 +232,7 @@ jobs:
     needs: [deploy_github]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           repository: sass/embedded-host-node
           token: ${{ secrets.GH_TOKEN }}

.github/workflows/test-vendor.yml

@@ -15,7 +15,7 @@ jobs:
         bootstrap_version: [4, 5]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
 
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
 
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}
 
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/util/initialize
         with: {github-token: "${{ github.token }}"}