1
0
Fork 0
mirror of https://github.com/mozilla/pdf.js.git synced 2025-04-25 01:28:06 +02:00
Commit graph

69 commits

Author SHA1 Message Date
Jonas Jenwald
4f01cdef18 [api-minor] Update the minimum supported Node.js version to 20
This patch updates the minimum supported environments as follows:
 - Node.js 20, which was released on 2023-04-18 and has now entered the "Maintenance"-phase; see https://github.com/nodejs/release#release-schedule

Furthermore, note also that Node.js 18 will fairly soon reach EOL.
2024-11-03 16:13:55 +01:00
Jonas Jenwald
a809461738 Try to discourage "unrelated" information under Attach (recommended) or Link to PDF file in the bug report template (PR 18535 follow-up)
Unfortunately it turns out to be somewhat common for users to provide a bunch of "unrelated" information in this field, or even stating their entire problem there, rather than placing it under the appropriate headings further down in the template.
2024-10-22 09:23:32 +02:00
Jonas Jenwald
6604adb5ff Run CI tests in Node.js version 23
Node.js version 23 was recently released, see https://github.com/nodejs/release#release-schedule, hence it cannot hurt to start testing in that environment.
2024-10-20 13:50:48 +02:00
Jonas Jenwald
6ae13fac9b [api-minor] Update the canvas package to version 3
This allows us to run the Node.js unit-tests in version 22, which is good since it'll very soon become the active LTS release; see https://github.com/nodejs/release#release-schedule.
2024-10-20 12:39:08 +02:00
Jonas Jenwald
4caa309fda Link to official releases and the demo viewer in the bug report template
Hopefully this might lead to *more* users actually testing the latest version before reporting a bug.
2024-08-15 09:25:21 +02:00
Jonas Jenwald
adb6548d38 Link to the list of supported browsers in the bug report template
Given that users fairly often report issues with unsupported browsers/environments it cannot hurt to provide a link to the relevant section in the FAQ.
2024-08-02 10:40:50 +02:00
Jonas Jenwald
12c3f251a1 Further emphasize the importance of Attach (recommended) or Link to PDF file in the bug report template
Unfortunately it turns out (perhaps unsurprisingly) that even the new bug report template isn't stopping users from leaving out the single most important part, i.e. `Attach (recommended) or Link to PDF file`, despite it now being marked as a required field.
2024-08-01 12:01:39 +02:00
Jonas Jenwald
70bc136ea6 Stop testing in Node.js 21 since it's reached end-of-life
According to https://github.com/nodejs/release?tab=readme-ov-file#end-of-life-releases Node.js 21 stopped being supported on 2024-06-01, which is almost two months ago now, hence it seems pointless to keep testing in that environment.
2024-07-28 13:15:43 +02:00
Tim van der Meij
7114796430
Merge pull request #18352 from wojtekmaj/provenance
Generate provenance statements on npm publish
2024-07-01 17:42:16 +02:00
Wojciech Maj
aaa65bf3fc
Generate provenance statements on npm publish
This PR adds [Provenance statements](https://docs.npmjs.com/generating-provenance-statements) on `npm publish`, increasing supply-chain security.
2024-07-01 15:37:25 +02:00
Wojciech Maj
6b449d8884
Use npm ci, not npm install, on CI
This PR switches from `npm install` to `npm ci` on CI. This enables some additional checks to ensure repo integrity when using CI/CD.

Read more: https://docs.npmjs.com/cli/v10/commands/npm-ci
2024-07-01 13:46:23 +02:00
Tim van der Meij
a5f2b9faeb
Introduce a GitHub Actions workflow for publishing a release
This commit migrates this functionality away from the bots. Note that
the NPM token must be configured as a repository secret before this
workflow can execute.

The following resources are relevant for this patch:

- Publishing packages to the NPM registry:
  https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry
- Creating secrets for a repository:
  https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository
2024-06-30 16:03:52 +02:00
Tim van der Meij
4033913acc
Improve the security policy
This commit fixes two issues that have been found after commit 2beae7a
landed, namely:

- The security checkbox image is not rendering at
  https://github.com/mozilla/pdf.js/security/policy because the
  `SECURITY.md` file is apparently served differently there (because it
  does work as expected at
  https://github.com/mozilla/pdf.js/blob/master/.github/SECURITY.md),
  which causes the relative link not to work. We switch to an absolute
  link to fix the issue.
- If a security policy is defined it turns out that GitHub automatically
  adds a row to the "New issue" page; see
  https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
  where it states "When someone creates an issue in your repository, they
  will see a link to your project's security policy". Since we now have
  two rows at https://github.com/mozilla/pdf.js/issues/new/choose about
  the security policy, we remove our own version in favor of the
  standard GitHub-provided one.
2024-06-24 15:54:06 +02:00
Tim van der Meij
2beae7aad6
Include a security policy for PDF.js
This makes sure that security researchers can find the required
information for reporting security vulnerabilities in a standardized
manner across GitHub repositories. Please refer to
https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
for more information.
2024-06-23 21:35:33 +02:00
Nicolò Ribaudo
1480e6778b
Use the new formatted issue templates 2024-06-21 15:42:31 +02:00
Nicolò Ribaudo
e561a4af3c
Pin GitHub actions to Node.js 21
Node.js 22 was just released, and it seems like it's not compatible
with the `canvas` package. This commit pins the version on GitHub
actions to Node.js 21 as a temporary workaround.

This commit should be reverted once
https://github.com/Automattic/node-canvas/issues/2377
is fixed.
2024-04-26 19:23:16 +02:00
Tim van der Meij
92de2b7b15
Don't install gulp-cli globally in the GitHub Actions workflows
It's recommended to always install dependencies locally in the project
folder because global dependencies can easily conflict with other
projects and, because they are not managed by the project, diverge from
versions defined in e.g. `package.json`. Previously we installed
`gulp-cli` globally because at the time we lacked a convenient mechanism
to use Gulp otherwise, but nowadays NPM provides the `npx` command for
that purpose and recommends using it over global installations (see
https://docs.npmjs.com/downloading-and-installing-packages-globally
and PR #17489 that provided the ground work for using it).

This commit therefore updates our GitHub Actions workflows to no longer
install `gulp-cli` globally but instead install it locally from the
already existing entries in `package.json` like all other dependencies
we use. Not only does this remove the special-casing for `gulp-cli`
which simplifies the workflow definitions, it also ensures that the
version ranges provided in `package.json` are respected. This makes the
local and workflow setups more similar, but is also relevant for the
upcoming upgrade to Gulp 5 which from a quick try is a bit involved and
having `package.json` be the single source of truth for the dependency
versions we use is therefore important.
2024-04-09 14:52:00 +02:00
Tim van der Meij
afa65dc766
Merge pull request #17461 from mozilla/dependabot/github_actions/actions/deploy-pages-4
Bump actions/deploy-pages from 3 to 4
2023-12-29 12:27:35 +01:00
dependabot[bot]
4e786f68bc
Bump actions/deploy-pages from 3 to 4
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages) from 3 to 4.
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](https://github.com/actions/deploy-pages/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/deploy-pages
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-25 12:11:47 +00:00
dependabot[bot]
f56d6802ad
Bump actions/upload-artifact from 3 to 4
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-25 12:11:44 +00:00
Jonas Jenwald
933e107073
Revert "Bump actions/upload-artifact from 3 to 4" 2023-12-18 15:01:19 +01:00
Jonas Jenwald
6fc3b438f7
Merge pull request #17434 from mozilla/dependabot/github_actions/github/codeql-action-3
Bump github/codeql-action from 2 to 3
2023-12-18 14:54:11 +01:00
dependabot[bot]
25a0a68def
Bump actions/upload-artifact from 3 to 4
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-18 12:39:30 +00:00
dependabot[bot]
2e82d947a6
Bump github/codeql-action from 2 to 3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-18 12:39:26 +00:00
Tim van der Meij
27d4fff5f2
Merge pull request #17412 from mozilla/dependabot/github_actions/actions/deploy-pages-3
Bump actions/deploy-pages from 2 to 3
2023-12-11 22:24:13 +01:00
dependabot[bot]
b388d407a8
Bump actions/deploy-pages from 2 to 3
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages) from 2 to 3.
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](https://github.com/actions/deploy-pages/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/deploy-pages
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-11 12:14:23 +00:00
dependabot[bot]
93143c03fa
Bump actions/setup-python from 4 to 5
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 5.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-11 12:14:19 +00:00
Tim van der Meij
8157f39c62
Introduce a GitHub Actions workflow for running the font tests
This commit migrates the font tests away from the bots. Not only are the
font tests broken on the Windows bot since some time, they also run on
Python 2 (end of life since January 2020) and `ttx` 3.19.0 (released in
November 2017). The latter is installed via a submodule, which requires
more complicated logic for finding and running `ttx`.

We solve the issues by implementing a modern workflow that installs the
most recent stable Python and `ttx` (`fonttools` package) versions. This
simplifies the `ttx` driver code as well because it can now assume `ttx`
is available on the path (just like we do for e.g. `node` invocations).
GitHub Actions takes care of creating a virtual environment with
`fonttools` in it so that the `ttx`  entrypoint is available. Locally
the font tests can be run in a similar way by creating and sourcing a
virtual environment with `fonttools` in it before running the font
tests, and a README file is included with instructions for doing so.
2023-11-12 17:48:04 +01:00
Jonas Jenwald
5687326046 Clean-up the CI workflow a bit
After recent PRs the size and scope of the CI workflow is now reduced, and this patch tries to simplify things further. More specifically we can directly specify the gulp-tasks in the workflow, and thus clean-up the `gulpfile` a tiny bit.

Note that this will technically be slower, since the tests are now run in series (rather than in parallel), however `gulp externaltest` runs so quickly that it really won't matter in practice.
2023-11-12 13:48:02 +01:00
Jonas Jenwald
d89ca97887 Move gulp typestest to a separate GitHub Actions workflow
This way we introduce more parallelism in the GitHub Actions tests, which should reduce overall runtime and thus cannot hurt.
2023-11-12 13:27:29 +01:00
Jonas Jenwald
2f70369d02 Move linting to a separate GitHub Actions workflow
This way we introduce more parallelism in the GitHub Actions tests, which should reduce overall runtime and thus cannot hurt.
2023-11-12 10:21:29 +01:00
Jonas Jenwald
99522c3201 Also test the latest Node.js version in GitHub Actions
Hopefully this will allow us to catch bugs in new Node.js versions earlier, rather than having to wait for bug reports.

Given that `CompressionStream` is (currently) only potentially used when saving a *modified* PDF document, which is unlikely to be a common use-case in Node.js environments, let's just disable the affected unit-test for now.
2023-11-02 16:58:03 +01:00
Jonas Jenwald
d00c7d5cdc Update the GitHub Actions workflows to use the current Node.js LTS version
The active LTS version is now based on Node.js version 20, hence let's update the relevant workflows to use that one instead; see https://en.wikipedia.org/wiki/Node.js#Releases

Given that we still support Node.js version 18, i.e. the maintenance LTS version, in the PDF.js library we'll keep testing both versions in GitHub Actions to prevent regressions.
2023-10-29 12:42:11 +01:00
Tim van der Meij
6dff90ac1f
Upgrade setup-node to version 4 in the GitHub Actions workflows
This major version mainly involves not using Node.js 16 internally
anymore, which will be end of life on September 11th. This prevents the
workflows from using an unsupported version of Node.js as well as
deprecation warnings getting printed in the workflow logs.

For more information please refer to
https://github.com/actions/setup-node/releases/tag/v4.0.0 and
https://github.com/actions/setup-node/issues/850.
2023-10-28 21:08:02 +02:00
Tim van der Meij
4845d35c50
Fix the configuration path in the GitHub Actions workflow for the Fluent linter
I noticed the following warning in the GitHub Actions workflow logs:

`Configuration file not found: .github/linter_config.yml`

The configuration file is called `fluent_linter_config.yml` instead, so
this commit fixes the path so it points to the correct file.

Fixes 487816b.
2023-10-28 20:15:25 +02:00
Tim van der Meij
9d6cdf216d
Use Python 3.12 in the GitHub Actions workflow for the Fluent linter
The current stable version of Python is Python 3.12, see
https://www.python.org/downloads, so we should switch to that since
Python 3.10 is older and only receives security updates.
2023-10-28 20:10:15 +02:00
Tim van der Meij
4be44a370e
Improve consistency in the GitHub Actions workflow for the Fluent linter
This commit tweaks the Fluent linter workflow to match the other
workflow files we have, so we make sure the steps have a newline between
them for better readability and align names and descriptions of steps
with how they are called in the other workflow files we have.
2023-10-28 20:02:39 +02:00
Francesco Lodolo
487816bd68
Add workflow to lint Fluent en-US files 2023-10-26 17:27:42 +02:00
Calixte Denizet
66982a2a11 [api-minor] Move to Fluent for the localization (bug 1858715)
- For the generic viewer we use @fluent/dom and @fluent/bundle
- For the builtin pdf viewer in Firefox, we set a localization url
  and then we rely on document.l10n which is a DOMLocalization object.
2023-10-19 11:20:41 +02:00
dependabot[bot]
48a2c29f98
Bump actions/checkout from 3 to 4
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-09-04 12:51:59 +00:00
Tim van der Meij
797f8d3dca
Merge pull request #16370 from Snuffleupagus/publish-website-only-master
Limit the `publish_website.yml` work-flow to only the `master` branch (issue 16369)
2023-04-29 11:36:33 +02:00
Jonas Jenwald
7c1e505f6a Include the entire git history in the work-flows (issue 16366)
Without this change we're not able to correctly determine the version number, please refer to https://github.com/actions/checkout#fetch-all-history-for-all-tags-and-branches
2023-04-29 10:50:37 +02:00
Jonas Jenwald
09edd6657f Limit the publish_website.yml work-flow to only the master branch (issue 16369)
This is a tentative patch, based on https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#using-filters
2023-04-28 10:31:52 +02:00
Tim van der Meij
30ca27ac48
Introduce a GitHub Actions workflow for publishing the website
This commit migrates this functionality away from the bots. Nowadays
it's possible to build and deploy the website to GitHub Pages directly
through the GitHub Actions, which provides a nice simplication of the
process. Not only does this remove the requirement to have a `gh-pages`
branch in the repository, it also avoids the complexity of having to
configure the workflow to commit to Git branches and allows us to remove
the Git committing code from the Gulpfile.

Note that deploying directly though GitHub Actions workflows needs to be
enabled in the repository settings, but this is easy and well documented
on the link below.

The following resources are relevant for this patch:

- Enabling deployment to GitHub Pages directly through GitHub Actions:
  https://docs.github.com/en/pages/getting-started-with-github-pages/configuring-a-publishing-source-for-your-github-pages-site#publishing-with-a-custom-github-actions-workflow
- Uploading GitHub Pages artifacts example:
  https://github.com/actions/upload-pages-artifact#usage
- Deploying GitHub Pages artifacts example:
  https://github.com/actions/deploy-pages#usage
2023-04-27 19:18:03 +02:00
Tim van der Meij
43d390759b
Don't force-install packages in the CI job anymore
In PR #16327 the `eslint-plugin-mozilla` package was updated so we no
longer have to force-install packages, and the force-install flags for
`npm install` were removed. However, the CI job was missing from this
commit, which we fix here. In general force-installing packages
shouldn't be necessary unless there are problems with dependencies,
which we would like to know about, so especially in the CI job it seems
like a good idea to not force-install packages to catch upcoming defects
early on.

Extends 19526d2322.
2023-04-23 12:45:29 +02:00
Calixte Denizet
be93a2a7d4 Set up automated l10n review for new English strings 2023-01-22 19:39:31 +01:00
Tim van der Meij
588447aa90
Upgrade Node.js to version 18 in the CI workflow
Version 16 that we used before is now in maintenance mode, so we should
upgrade to the most recent LTS version. For more information on the
Node.js release schedule please refer to
https://github.com/nodejs/release#release-schedule.
2023-01-08 17:35:08 +01:00
Jonas Jenwald
26883c0d7e Stop Dependabot from creating its own, otherwise unused, labels
Currently all Dependabot update PRs get tagged with a "javascript" label, which is annoying since we don't actually use that one.
To try and avoid this we specify the labels explicitly, please see https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#labels
2022-11-14 15:07:55 +01:00
neilnaveen
83ecc3f46c
chore: Set permissions for GitHub actions
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com>
2022-06-25 15:32:33 +02:00
Tim van der Meij
8403bafbfc
Merge pull request #15100 from turrisxyz/Dependabot-GitHub-Actions
chore: Included githubactions in the dependabot config
2022-06-25 15:18:11 +02:00