Merge remote-tracking branch 'origin/main' into feat/vite-bundler-improvements

Author: NathanWalker

.github/workflows/codeql-advanced.yml

@@ -70,7 +70,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -98,6 +98,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -19,4 +19,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.3.0
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4.8.3
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

.github/workflows/npm_release_cli.yml

@@ -9,6 +9,17 @@ on:
     paths-ignore:
       - 'packages/**'
   workflow_dispatch:
+    inputs:
+      release_type:
+        description: 'Release type. "dev" publishes a -next prerelease without bumping package.json. patch/minor/major/prerelease bump package.json, commit + tag to main, then publish as a stable release.'
+        type: choice
+        options:
+          - dev
+          - patch
+          - minor
+          - major
+          - prerelease
+        default: patch
 
 permissions: read-all
 
@@ -19,19 +30,23 @@ jobs:
   build:
     name: Build
     runs-on: macos-latest
+    permissions:
+      contents: write
     outputs:
       npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
       npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
+      is_release: ${{ steps.npm_version_output.outputs.IS_RELEASE }}
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
@@ -46,8 +61,18 @@ jobs:
           NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
           echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
 
+      - name: Bump, commit and tag stable release (manual dispatch)
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != 'dev' }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          npm version ${{ inputs.release_type }} -m "chore: release v%s"
+          NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
+          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
+          git push origin HEAD:${GITHUB_REF_NAME} --follow-tags
+
       - name: Bump version for dev release
-        if: ${{ !contains(github.ref, 'refs/tags/') }}
+        if: ${{ !contains(github.ref, 'refs/tags/') && (github.event_name != 'workflow_dispatch' || inputs.release_type == 'dev') }}
         run: |
           NPM_VERSION=$(node ./scripts/get-next-version.js)
           echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
@@ -57,8 +82,14 @@ jobs:
         id: npm_version_output
         run: |
           NPM_TAG=$(node ./scripts/get-npm-tag.js)
+          if [[ "${GITHUB_REF}" == refs/tags/* ]] || [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.release_type }}" != "dev" ]]; then
+            IS_RELEASE=true
+          else
+            IS_RELEASE=false
+          fi
           echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
           echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
+          echo IS_RELEASE=$IS_RELEASE >> $GITHUB_OUTPUT
 
       - name: Build nativescript
         run: npm pack
@@ -82,7 +113,7 @@ jobs:
       NPM_TAG: ${{needs.build.outputs.npm_tag}}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 
@@ -91,7 +122,7 @@ jobs:
           node-version: 22.14.0
           registry-url: "https://registry.npmjs.org"
 
-      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: npm-package
           path: dist
@@ -123,8 +154,8 @@ jobs:
 
   github-release:
     runs-on: ubuntu-latest
-    # only runs on tagged commits
-    if: ${{ contains(github.ref, 'refs/tags/') }}
+    # runs for tag pushes and for manual dispatches that bumped a stable release
+    if: ${{ needs.build.outputs.is_release == 'true' }}
     permissions:
       contents: write
     needs:
@@ -133,13 +164,14 @@ jobs:
       NPM_VERSION: ${{needs.build.outputs.npm_version}}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
+          ref: v${{needs.build.outputs.npm_version}}
 
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
@@ -148,7 +180,7 @@ jobs:
       - name: Setup
         run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock
 
-      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: npm-package
           path: dist
@@ -167,8 +199,9 @@ jobs:
       - name: Partial Changelog
         run: npx conventional-changelog -p angular -r2 > body.md
 
-      - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
+      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
+          tag: v${{needs.build.outputs.npm_version}}
           artifacts: "dist/nativescript-*.tgz,dist/nativescript-*.intoto.jsonl"
           bodyFile: "body.md"
           prerelease: ${{needs.build.outputs.npm_tag != 'latest'}}

.github/workflows/npm_release_doctor.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
 
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
         with:
           egress-policy: audit
 

.github/workflows/scorecard.yml

@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           sarif_file: results.sarif

lib/common/services/net-service.ts

@@ -18,7 +18,7 @@ export class Net implements INet {
 		private $errors: IErrors,
 		private $childProcess: IChildProcess,
 		private $logger: ILogger,
-		private $osInfo: IOsInfo
+		private $osInfo: IOsInfo,
 	) {}
 
 	public async getFreePort(): Promise<number> {
@@ -82,7 +82,7 @@ export class Net implements INet {
 
 	public async getAvailablePortInRange(
 		startPort: number,
-		endPort?: number
+		endPort?: number,
 	): Promise<number> {
 		endPort = endPort || 65534;
 		while (!(await this.isPortAvailable(startPort))) {
@@ -96,7 +96,7 @@ export class Net implements INet {
 	}
 
 	public async waitForPortToListen(
-		waitForPortListenData: IWaitForPortListenData
+		waitForPortListenData: IWaitForPortListenData,
 	): Promise<boolean> {
 		if (!waitForPortListenData) {
 			this.$errors.fail("You must pass port and timeout for check.");
@@ -126,8 +126,8 @@ export class Net implements INet {
 		if (!currentPlatformData) {
 			this.$errors.fail(
 				`Unable to check for free ports on ${platform}. Supported platforms are: ${_.keys(
-					platformData
-				).join(", ")}`
+					platformData,
+				).join(", ")}`,
 			);
 		}
 

lib/device-sockets/ios/app-debug-socket-proxy-factory.ts

@@ -21,14 +21,14 @@ export class AppDebugSocketProxyFactory
 		private $lockService: ILockService,
 		private $options: IOptions,
 		private $tempService: ITempService,
-		private $net: INet
+		private $net: INet,
 	) {
 		super();
 	}
 
 	public getTCPSocketProxy(
 		deviceIdentifier: string,
-		appId: string
+		appId: string,
 	): net.Server {
 		return this.deviceTcpServers[`${deviceIdentifier}-${appId}`];
 	}
@@ -37,18 +37,18 @@ export class AppDebugSocketProxyFactory
 		device: Mobile.IiOSDevice,
 		appId: string,
 		projectName: string,
-		projectDir: string
+		projectDir: string,
 	): Promise<net.Server> {
 		const cacheKey = `${device.deviceInfo.identifier}-${appId}`;
 		const existingServer = this.deviceTcpServers[cacheKey];
 		if (existingServer) {
 			this.$errors.fail(
-				`TCP socket proxy is already running for device '${device.deviceInfo.identifier}' and app '${appId}'`
+				`TCP socket proxy is already running for device '${device.deviceInfo.identifier}' and app '${appId}'`,
 			);
 		}
 
 		this.$logger.info(
-			"\nSetting up proxy...\nPress Ctrl + C to terminate, or disconnect.\n"
+			"\nSetting up proxy...\nPress Ctrl + C to terminate, or disconnect.\n",
 		);
 
 		const server = net.createServer({
@@ -69,7 +69,7 @@ export class AppDebugSocketProxyFactory
 			const appDebugSocket = await device.getDebugSocket(
 				appId,
 				projectName,
-				projectDir
+				projectDir,
 			);
 			this.$logger.info("Backend socket created.");
 
@@ -112,7 +112,7 @@ export class AppDebugSocketProxyFactory
 		device: Mobile.IiOSDevice,
 		appId: string,
 		projectName: string,
-		projectDir: string
+		projectDir: string,
 	): Promise<ws.Server> {
 		const existingWebProxy =
 			this.deviceWebServers[`${device.deviceInfo.identifier}-${appId}`];
@@ -130,22 +130,22 @@ export class AppDebugSocketProxyFactory
 		device: Mobile.IiOSDevice,
 		appId: string,
 		projectName: string,
-		projectDir: string
+		projectDir: string,
 	): Promise<ws.Server> {
 		let clientConnectionLockRelease: () => void;
 		const cacheKey = `${device.deviceInfo.identifier}-${appId}`;
 		const existingServer = this.deviceWebServers[cacheKey];
 		if (existingServer) {
 			this.$errors.fail(
-				`Web socket proxy is already running for device '${device.deviceInfo.identifier}' and app '${appId}'`
+				`Web socket proxy is already running for device '${device.deviceInfo.identifier}' and app '${appId}'`,
 			);
 		}
 
 		// NOTE: We will try to provide command line options to select ports, at least on the localhost.
 		const localPort = await this.$net.getAvailablePortInRange(41000);
 
 		this.$logger.info(
-			"\nSetting up debugger proxy...\nPress Ctrl + C to terminate, or disconnect.\n"
+			"\nSetting up debugger proxy...\nPress Ctrl + C to terminate, or disconnect.\n",
 		);
 
 		// NB: When the inspector frontend connects we might not have connected to the inspector backend yet.
@@ -159,14 +159,14 @@ export class AppDebugSocketProxyFactory
 			port: localPort,
 			verifyClient: async (
 				info: any,
-				callback: (res: boolean, code?: number, message?: string) => void
+				callback: (res: boolean, code?: number, message?: string) => void,
 			) => {
 				let acceptHandshake = true;
 				clientConnectionLockRelease = null;
 
 				try {
 					clientConnectionLockRelease = await this.$lockService.lock(
-						`debug-connection-${device.deviceInfo.identifier}-${appId}.lock`
+						`debug-connection-${device.deviceInfo.identifier}-${appId}.lock`,
 					);
 
 					this.$logger.info("Frontend client connected.");
@@ -184,7 +184,7 @@ export class AppDebugSocketProxyFactory
 					appDebugSocket = await device.getDebugSocket(
 						appId,
 						projectName,
-						projectDir
+						projectDir,
 					);
 					currentAppSocket = appDebugSocket;
 					this.$logger.info("Backend socket created.");
@@ -198,7 +198,7 @@ export class AppDebugSocketProxyFactory
 					this.emit(CONNECTION_ERROR_EVENT_NAME, err);
 					acceptHandshake = false;
 					this.$logger.warn(
-						`Cannot connect to device socket. The error message is '${err.message}'.`
+						`Cannot connect to device socket. The error message is '${err.message}'.`,
 					);
 				}
 
@@ -225,7 +225,7 @@ export class AppDebugSocketProxyFactory
 					webSocket.send(message);
 				} else {
 					this.$logger.trace(
-						`Received message ${message}, but unable to send it to webSocket as its state is: ${webSocket.readyState}`
+						`Received message ${message}, but unable to send it to webSocket as its state is: ${webSocket.readyState}`,
 					);
 				}
 			});