77 Commits

Author SHA1 Message Date
Tim van der Meij
8d4151cfbb Fix Python caching in the GitHub Actions workflows
For the Python-based workflows we were already using `pip` caching [1],
but sadly this isn't fully functional at the moment because the caching
functionality uses `requirements.txt` to determine when to create or
invalidate the cache. However, we have two different `pip` install
commands but only a `requirements.txt` for one of them (the Fluent
linter), which means that the other job (the font tests) will not
populate the cache with its dependencies.

This can be seen by opening any font tests or Fluent linting build and
noticing that they report the exact same cache key even though their
dependencies are different. In the installation step the dependencies
are reported as "Downloading [package].whl" instead of the expected
"Using cached [package].whl".

This commit fixes the issue by explicitly defining a `requirements.txt`
file for both jobs and pointing the caching functionality to the
specific file paths to make sure that unique caches with the correct
package data are used. While we're here we also align the syntax and
step titles in the files for consistency.

[1] https://github.com/actions/setup-python?tab=readme-ov-file#caching-packages-dependencies
2026-03-22 20:01:32 +01:00
Tim van der Meij
a3b19875ec Implement Node.js caching in the GitHub Actions workflows
The `setup-node` action contains built-in support for caching [1], so
this commit makes sure we use it for all Node.js-based workflows to
reduce workflow execution time.

Note that, contrary what one might expect [2], the `node_modules`
directory is deliberately not cached because it can conflict with
differing Node.js versions and because it's not useful in combination
with `npm ci` usage which wipes the `node_modules` folder
unconditionally. Therefore, the action instead caches the global `npm`
cache directory instead which does not suffer from these problems and
still provides a speed-up at installation time.

[1] https://github.com/actions/setup-node?tab=readme-ov-file#caching-global-packages-data
[2] https://github.com/actions/setup-node/issues/416
[3] https://github.com/actions/cache/issues/67
2026-03-22 19:40:10 +01:00
Tim van der Meij
921e258d35 Revert "Avoid to have stuck actions when running update_locales task"
This reverts commit d618a2bc7e.
Unfortunately it did not fix the hanging actions for the locale update
job; fixing the issue is tracked in #20813.
2026-03-22 15:38:25 +01:00
calixteman
60de323514 Make persist-credentials: true in the update_locale action 2026-03-21 22:08:02 +01:00
Calixte Denizet
b6634dddd8 Fix the error in gh actions found by zizmor
To install zizmor: https://docs.zizmor.sh/installation/
and just run `zizmor .`
2026-03-18 17:42:12 +01:00
calixteman
d618a2bc7e Avoid to have stuck actions when running update_locales task
The task update_locales is using the GITHUB_TOKEN to push the changes to
the update-locales branch, but this token doesn't trigger other workflows (see [1]),
so we need to explicitly dispatch the required ones.

[1] https://github.com/orgs/community/discussions/26970#discussioncomment-3254152
2026-03-06 14:51:45 +01:00
dependabot[bot]
d939a3dedc Bump actions/upload-artifact from 6 to 7
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02 12:59:39 +00:00
calixteman
aa5abda419 Add a gh action in order to create a PR containing a m-c l10n update 2026-02-26 22:13:00 +01:00
calixteman
e2af2b83c3 Add code coverage for font tests 2026-02-18 22:00:45 +01:00
calixteman
07dbda2d80 Add code coverage for unit tests running in node
It's a first step to add code coverage.
In order to get the code coverage report locally, you can run the following command:
```bash
npx gulp unittestcli --coverage
```
The code coverage report will be generated in the `./build/coverage` directory.
And the report can be consulted by opening:
  http://localhost:8888/build/coverage/index.html

A GitHub workflow has also been added to run the unit tests with code coverage
on each push and pull request. The report will be uploaded to Codecov.
2026-02-14 15:22:35 +01:00
calixteman
45c7805daf Fix types to make "gulp typestest" succeeding 2026-02-13 22:34:04 +01:00
Jonas Jenwald
aa4d0f7c07 Temporarily disable typestest in GitHub Actions 2026-02-01 17:56:07 +01:00
Jonas Jenwald
5d02076313 Add tests (and CI) to ensure that preference generation works correctly for all relevant build-targets
Given that previous patches reduced that number of build-targets running this code, ensure that it's still tested sufficiently.
2026-01-30 13:31:13 +01:00
Jonas Jenwald
35e78f7f11 Generate the preferences_schema.json file, for the Chromium addon, during building
This avoids the hassle of having to manually update that file when adding/modifying preferences in the viewer.
Updating the preferences-metadata should now only be something that the Chromium addon maintainer has to do.
2026-01-30 13:26:16 +01:00
Tim van der Meij
b92f742a26 Run the CI tests in Node.js version 25 too
Node.js version 25 is the current (non-LTS) release, see
https://github.com/nodejs/release#release-schedule, so we should run the
tests with that version too to help catch any possible issues sooner.
2025-12-21 18:19:29 +01:00
dependabot[bot]
0b60e9c213 Bump actions/upload-artifact from 5 to 6
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-12-15 12:05:28 +00:00
Calixte Denizet
4bf759404c Add a new linting task in order to detect unused/unknown css variables in the Firefox build
The goal is to be able to catch the errors before making a release.
And fix some css issues (especially the missing css code for the newly added menu.css)
2025-12-08 09:44:33 +01:00
Tim van der Meij
8eb747663a Use OIDC trusted publishing in the GitHub Actions release workflow
This commit updates the release pipeline to use OIDC trusted publishing
now that we have configured it between GitHub Actions and NPM. This
solution allows us to remove the token variable (because there is no
longer a fixed token) and provenance flag (because provenance
attestations are generated by default with this approach); refer to
https://docs.npmjs.com/trusted-publishers for more information.
2025-11-28 21:01:13 +01:00
dependabot[bot]
f6ad1a5610 Bump actions/checkout from 5 to 6
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-11-24 12:42:52 +00:00
dependabot[bot]
deb74b9062 Bump actions/upload-artifact from 4 to 5
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-10-27 13:01:42 +00:00
dependabot[bot]
6268f930ca Bump actions/setup-node from 5 to 6
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-10-20 12:57:45 +00:00
Tim van der Meij
0528885029 Use Python 3.14 in the GitHub workflows
Python 3.14 is the current stable version, released on October 7th. The
dependencies we use also support Python 3.14 now, most importantly
`fonttools` for which the OS-specific builds have been published (see
the `cp314` wheels on https://pypi.org/project/fonttools/#files).
2025-10-14 21:48:21 +02:00
dependabot[bot]
a3b5fcfa9d Bump github/codeql-action from 3 to 4
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-10-13 12:41:18 +00:00
Tim van der Meij
5382c54803 Merge pull request #20243 from mozilla/dependabot/github_actions/actions/setup-node-5
Bump actions/setup-node from 4 to 5
2025-09-08 20:43:01 +02:00
dependabot[bot]
f9be06a8c1 Bump actions/setup-node from 4 to 5
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 5.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-09-08 12:31:52 +00:00
dependabot[bot]
a5ef8ca828 Bump actions/setup-python from 5 to 6
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-09-08 12:26:36 +00:00
dependabot[bot]
e38fb68724 Bump actions/checkout from 4 to 5
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-08-11 17:13:51 +00:00
Jonas Jenwald
384a09113c Run CI tests in Node.js version 24
Node.js version 24 was just released, see https://github.com/nodejs/release#release-schedule, hence we should run tests in that version in order to help catch any possible issues as soon as possible.
Also, since version 23 will reach EOL (end-of-life) in less than a month we stop running tests in that version.
2025-05-06 18:43:02 +02:00
Tim van der Meij
913738644a Use Python 3.13 in the GitHub workflows
Python 3.13 is the current version and was released over a month ago
(see https://devguide.python.org/versions). The dependencies we use now
support Python 3.13, most importantly `fonttools` which uses OS-specific
builds and for which compatibility got introduced in
https://github.com/fonttools/fonttools/pull/3656 and the corresponding
`cp313` wheels for all distributions are published on
https://pypi.org/project/fonttools/#files.

Moreover, we fix forgotten `npx` usage in the font tests README which
was encountered while testing this patch.
2024-11-12 20:59:01 +01:00
Jonas Jenwald
4f01cdef18 [api-minor] Update the minimum supported Node.js version to 20
This patch updates the minimum supported environments as follows:
 - Node.js 20, which was released on 2023-04-18 and has now entered the "Maintenance"-phase; see https://github.com/nodejs/release#release-schedule

Furthermore, note also that Node.js 18 will fairly soon reach EOL.
2024-11-03 16:13:55 +01:00
Jonas Jenwald
6604adb5ff Run CI tests in Node.js version 23
Node.js version 23 was recently released, see https://github.com/nodejs/release#release-schedule, hence it cannot hurt to start testing in that environment.
2024-10-20 13:50:48 +02:00
Jonas Jenwald
6ae13fac9b [api-minor] Update the canvas package to version 3
This allows us to run the Node.js unit-tests in version 22, which is good since it'll very soon become the active LTS release; see https://github.com/nodejs/release#release-schedule.
2024-10-20 12:39:08 +02:00
Jonas Jenwald
70bc136ea6 Stop testing in Node.js 21 since it's reached end-of-life
According to https://github.com/nodejs/release?tab=readme-ov-file#end-of-life-releases Node.js 21 stopped being supported on 2024-06-01, which is almost two months ago now, hence it seems pointless to keep testing in that environment.
2024-07-28 13:15:43 +02:00
Tim van der Meij
7114796430 Merge pull request #18352 from wojtekmaj/provenance
Generate provenance statements on npm publish
2024-07-01 17:42:16 +02:00
Wojciech Maj
aaa65bf3fc Generate provenance statements on npm publish
This PR adds [Provenance statements](https://docs.npmjs.com/generating-provenance-statements) on `npm publish`, increasing supply-chain security.
2024-07-01 15:37:25 +02:00
Wojciech Maj
6b449d8884 Use npm ci, not npm install, on CI
This PR switches from `npm install` to `npm ci` on CI. This enables some additional checks to ensure repo integrity when using CI/CD.

Read more: https://docs.npmjs.com/cli/v10/commands/npm-ci
2024-07-01 13:46:23 +02:00
Tim van der Meij
a5f2b9faeb Introduce a GitHub Actions workflow for publishing a release
This commit migrates this functionality away from the bots. Note that
the NPM token must be configured as a repository secret before this
workflow can execute.

The following resources are relevant for this patch:

- Publishing packages to the NPM registry:
  https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry
- Creating secrets for a repository:
  https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository
2024-06-30 16:03:52 +02:00
Nicolò Ribaudo
e561a4af3c Pin GitHub actions to Node.js 21
Node.js 22 was just released, and it seems like it's not compatible
with the `canvas` package. This commit pins the version on GitHub
actions to Node.js 21 as a temporary workaround.

This commit should be reverted once
https://github.com/Automattic/node-canvas/issues/2377
is fixed.
2024-04-26 19:23:16 +02:00
Tim van der Meij
92de2b7b15 Don't install gulp-cli globally in the GitHub Actions workflows
It's recommended to always install dependencies locally in the project
folder because global dependencies can easily conflict with other
projects and, because they are not managed by the project, diverge from
versions defined in e.g. `package.json`. Previously we installed
`gulp-cli` globally because at the time we lacked a convenient mechanism
to use Gulp otherwise, but nowadays NPM provides the `npx` command for
that purpose and recommends using it over global installations (see
https://docs.npmjs.com/downloading-and-installing-packages-globally
and PR #17489 that provided the ground work for using it).

This commit therefore updates our GitHub Actions workflows to no longer
install `gulp-cli` globally but instead install it locally from the
already existing entries in `package.json` like all other dependencies
we use. Not only does this remove the special-casing for `gulp-cli`
which simplifies the workflow definitions, it also ensures that the
version ranges provided in `package.json` are respected. This makes the
local and workflow setups more similar, but is also relevant for the
upcoming upgrade to Gulp 5 which from a quick try is a bit involved and
having `package.json` be the single source of truth for the dependency
versions we use is therefore important.
2024-04-09 14:52:00 +02:00
Tim van der Meij
afa65dc766 Merge pull request #17461 from mozilla/dependabot/github_actions/actions/deploy-pages-4
Bump actions/deploy-pages from 3 to 4
2023-12-29 12:27:35 +01:00
dependabot[bot]
4e786f68bc Bump actions/deploy-pages from 3 to 4
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages) from 3 to 4.
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](https://github.com/actions/deploy-pages/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/deploy-pages
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-25 12:11:47 +00:00
dependabot[bot]
f56d6802ad Bump actions/upload-artifact from 3 to 4
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-25 12:11:44 +00:00
Jonas Jenwald
933e107073 Revert "Bump actions/upload-artifact from 3 to 4" 2023-12-18 15:01:19 +01:00
Jonas Jenwald
6fc3b438f7 Merge pull request #17434 from mozilla/dependabot/github_actions/github/codeql-action-3
Bump github/codeql-action from 2 to 3
2023-12-18 14:54:11 +01:00
dependabot[bot]
25a0a68def Bump actions/upload-artifact from 3 to 4
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-18 12:39:30 +00:00
dependabot[bot]
2e82d947a6 Bump github/codeql-action from 2 to 3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-18 12:39:26 +00:00
Tim van der Meij
27d4fff5f2 Merge pull request #17412 from mozilla/dependabot/github_actions/actions/deploy-pages-3
Bump actions/deploy-pages from 2 to 3
2023-12-11 22:24:13 +01:00
dependabot[bot]
b388d407a8 Bump actions/deploy-pages from 2 to 3
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages) from 2 to 3.
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](https://github.com/actions/deploy-pages/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/deploy-pages
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-11 12:14:23 +00:00
dependabot[bot]
93143c03fa Bump actions/setup-python from 4 to 5
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 5.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-11 12:14:19 +00:00
Tim van der Meij
8157f39c62 Introduce a GitHub Actions workflow for running the font tests
This commit migrates the font tests away from the bots. Not only are the
font tests broken on the Windows bot since some time, they also run on
Python 2 (end of life since January 2020) and `ttx` 3.19.0 (released in
November 2017). The latter is installed via a submodule, which requires
more complicated logic for finding and running `ttx`.

We solve the issues by implementing a modern workflow that installs the
most recent stable Python and `ttx` (`fonttools` package) versions. This
simplifies the `ttx` driver code as well because it can now assume `ttx`
is available on the path (just like we do for e.g. `node` invocations).
GitHub Actions takes care of creating a virtual environment with
`fonttools` in it so that the `ttx`  entrypoint is available. Locally
the font tests can be run in a similar way by creating and sourcing a
virtual environment with `fonttools` in it before running the font
tests, and a README file is included with instructions for doing so.
2023-11-12 17:48:04 +01:00