chore: update to upstream@v4

Author: paulswartz

.eslintignore

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      day: "saturday"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "saturday"

.github/dependabot.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  security_hardening:
+    name: Check security hardening
+    runs-on: ubuntu-latest
+    steps:
+    - name: Clone the repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+    - name: Ensure SHA pinned actions
+      uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ed00f72a3ca5b6eff8ad4d3ffdcacedb67a21db1
+
+  build_test:
+    name: Build & Test
+    needs: security_hardening
+    runs-on: ubuntu-latest
+    steps:
+    - name: Clone the repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+        ref: ${{ github.head_ref }} # https://github.com/stefanzweifel/git-auto-commit-action#checkout-the-correct-branch
+    - name: Get runs.using version
+      id: get-runs-using-version
+      uses: zgosalvez/github-actions-get-action-runs-using-version@49044afc8bfe8dfccd7840b828a7cc4019f08717
+    - name: Set up Node
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+      with:
+        node-version: v${{ steps.get-runs-using-version.outputs.version }}
+    - name: Cache Node Packages
+      id: node-cache
+      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a
+      with:
+        path: ~/.npm
+        key: node-cache-${{ steps.get-runs-using-version.outputs.prop }}-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          node-cache-${{ steps.get-runs-using-version.outputs.prop }}-
+          node-cache-
+    - name: Get Node packages
+      run: npm ci
+    - name: Run linter tool
+      run: npm run lint
+    - name: Prepare
+      run: npm run prepare
+    - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842
+      with:
+        commit_message: Apply `npm run prepare` changes

.github/workflows/ci.yml

@@ -0,0 +1,13 @@
+name: Update Major Version Tag
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  update-majorver:
+    name: Update Major Version Tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: nowactions/update-majorver@f2014bbbba95b635e990ce512c5653bd0f4753fb

.github/workflows/version.yml

@@ -13,13 +13,16 @@ Create a workflow `.yml` file in your `.github/workflows` directory. An [example
 For more information on these inputs, see the [Workflow syntax for GitHub Actions](https://docs.github.com/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepswith)
 
 - `coverage-files`: The coverage files to scan. For example, `coverage/lcov.*.info`
-- `artifact-name`: The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory
+- `artifact-name`: The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory. Optional. Default: `` (Skips uploading of artifacts)
 - `minimum-coverage`: The minimum coverage to pass the check. Optional. Default: `0` (always passes)
 - `github-token`: Set the `${{ secrets.GITHUB_TOKEN }}` token to have the action comment the coverage summary in the pull request. This token is provided by Actions, you do not need to create your own token. Optional. Default: ``
 - `working-directory`: The working directory containing the source files referenced in the LCOV files. Optional. Default: `./`
+- `title-prefix`: A prefix before the title "LCOV of commit...". Optional. Default: ``
+- `additional-message`: Custom text appended to the code coverage comment in the pull request. Optional. Default: ``
+- `update-comment`: Set to `true` to update the previous code coverage comment if such exists. When set to `false`, a new comment is always created. Optional. Default: `false`
 
 ### Outputs
-None.
+- `total-coverage`: The total coverage from scanned files.
 
 Sample comment:
 ![Screenshot](assets/comment.png)
@@ -40,15 +43,23 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v2
     # ... Generate LCOV files or download it from a different job
+    - name: Setup LCOV
+      uses: hrishikesh-kadam/setup-lcov@v1
     - name: Report code coverage
-      uses: mbta/github-actions-report-lcov@v1
+      uses: zgosalvez/github-actions-report-lcov@v3
       with:
         coverage-files: coverage/lcov.*.info
         minimum-coverage: 90
         artifact-name: code-coverage-report
         github-token: ${{ secrets.GITHUB_TOKEN }}
         working-directory: apps/my-first-app
+        update-comment: true
 ```
+*Note:* Only the `pull_request` and `pull_request_target` events are supported. This action does nothing when triggered by other event types.
+
+### Flutter Workflows
+
+This is used in my opinionated [GitHub Actions: Flutter Workflows](https://github.com/zgosalvez/github-actions-flutter-workflows) repository along with other actions for a complete end-to-end DevOps experience.
 
 ## License
-The scripts and documentation in this project are released under the [MIT License](LICENSE)
+The scripts and documentation in this project are released under the [MIT License](LICENSE.md)

README.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions of the project are currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 4.0.x   | :white_check_mark: |
+| < 4     | :x:                |
+
+## Reporting a Vulnerability
+
+Please file an issue.

SECURITY.md

@@ -8,19 +8,32 @@ inputs:
     description: 'The coverage files to scan. For example, `coverage/lcov.*.info`'
     required: true
   artifact-name:
-    description: 'The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory'
-    required: true
+    description: 'The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory. Optional. Default: `` (Skips uploading of artifacts)'
   minimum-coverage:
     description: 'The minimum coverage to pass the check. Optional. Default: `0` (always passes)'
     default: 0
   github-token:
     description: 'Set the GitHub token to have the action comment the coverage summary in the pull request. This token is provided by Actions, you do not need to create your own token. Optional. Default: ``'
   working-directory:
     description: 'The working directory containing the source files referenced in the LCOV files. Optional. Default: `./`'
+  title-prefix:
+    description: 'A prefix before the title "LCOV of commit...". Optional. Default: ``'
+    required: false
+  additional-message:
+    description: 'Custom text appended to the code coverage comment in the pull request. Optional. Default: ``'
+    required: false
+  update-comment:
+    description: 'Set to `true` to update the previous code coverage comment if such exists. When set to `false`, a new comment is always created. Optional. Default: `false`'
+    required: false
+    default: "false"
+outputs:
+  total-coverage:
+      description: 'The total coverage from scanned files.'
+
 runs:
-  using: 'node12'
+  using: 'node20'
   main: 'dist/main/index.js'
   post: 'dist/post/index.js'
 branding:
   icon: umbrella
-  color: purple
+  color: purple