twbs/bootstrap

name: BrowserStack

on:
  push:
    branches:
      - "**"
      - "!dependabot/**"
  workflow_dispatch:

env:
  FORCE_COLOR: 2
  NODE: 22

permissions:
  contents: read

jobs:
  browserstack:
    runs-on: ubuntu-latest
    if: github.repository == 'twbs/bootstrap'
    timeout-minutes: 30

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "${{ env.NODE }}"
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      - name: Run dist
        run: npm run dist

      - name: Run BrowserStack tests
        run: npm run js-test-cloud
        env:
          BROWSER_STACK_ACCESS_KEY: "${{ secrets.BROWSER_STACK_ACCESS_KEY }}"
          BROWSER_STACK_USERNAME: "${{ secrets.BROWSER_STACK_USERNAME }}"
          GITHUB_SHA: "${{ github.sha }}"

name: Bundlewatch

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: 2
  NODE: 22

permissions:
  contents: read

jobs:
  bundlewatch:
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "${{ env.NODE }}"
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      - name: Run dist
        run: npm run dist

      - name: Run bundlewatch
        run: npm run bundlewatch
        env:
          BUNDLEWATCH_GITHUB_TOKEN: "${{ secrets.BUNDLEWATCH_GITHUB_TOKEN }}"
          CI_BRANCH_BASE: main

name: Compress Images

on:
  pull_request:
    paths:
      - '**.jpg'
      - '**.jpeg'
      - '**.png'
      - '**.webp'

permissions:
  contents: read

jobs:
  build:
    # Only run on Pull Requests within the same repository, and not from forks.
    if: github.event.pull_request.head.repo.full_name == github.repository
    name: calibreapp/image-actions
    runs-on: ubuntu-latest
    permissions:
      # allow calibreapp/image-actions to update PRs
      pull-requests: write
    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Compress Images
        uses: calibreapp/image-actions@f32575787d333b0579f0b7d506ff03be63a669d1 # v1.4.1
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

name: "CodeQL"

on:
  push:
    branches:
      - main
      - v4-dev
      - "!dependabot/**"
  pull_request:
    branches:
      - main
      - v4-dev
      - "!dependabot/**"
  schedule:
    - cron: "0 2 * * 4"
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
        with:
          config-file: ./.github/codeql/codeql-config.yml
          languages: "javascript"
          queries: +security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
        with:
          category: "/language:javascript"

name: cspell

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: 2

permissions:
  contents: read

jobs:
  cspell:
    permissions:
      # allow streetsidesoftware/cspell-action to fetch files for commits and PRs
      contents: read
      pull-requests: read
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run cspell
        uses: streetsidesoftware/cspell-action@9cd41bb518a24fefdafd9880cbab8f0ceba04d28 # v8.3.0
        with:
          config: ".cspell.json"
          files: "**/*.{md,mdx}"
          inline: error
          incremental_files_only: false

name: CSS

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: 2
  NODE: 22

permissions:
  contents: read

jobs:
  css:
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "${{ env.NODE }}"
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      - name: Build CSS
        run: npm run css

      - name: Run CSS tests
        run: npm run css-test

name: Docs

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: 2
  NODE: 22

permissions:
  contents: read

jobs:
  docs:
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "${{ env.NODE }}"
          cache: npm

      - run: java -version

      - name: Install npm dependencies
        run: npm ci

      - name: Build docs
        run: npm run docs-build

      - name: Validate HTML
        run: npm run docs-vnu

      - name: Run linkinator
        uses: JustinBeckwith/linkinator-action@f62ba0c110a76effb2ee6022cc6ce4ab161085e3 # v2.4
        with:
          paths: _site
          recurse: true
          verbosity: error
          skip: "^http://localhost"

name: Close Issue Awaiting Reply

on:
  schedule:
    - cron: "0 0 * * *"

permissions:
  contents: read

jobs:
  issue-close-require:
    permissions:
      # allow actions-cool/issues-helper to update issues and PRs
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    if: github.repository == 'twbs/bootstrap'
    steps:
      - name: awaiting reply
        uses: actions-cool/issues-helper@71b62d7da76e59ff7b193904feb6e77d4dbb2777 # v3.7.6
        with:
          actions: "close-issues"
          labels: "awaiting-reply"
          inactive-day: 14
          body: |
            As the issue was labeled with `awaiting-reply`, but there has been no response in 14 days, this issue will be closed. If you have any questions, you can comment/reply.

name: Issue Labeled

on:
  issues:
    types: [labeled]

permissions:
  contents: read

jobs:
  issue-labeled:
    permissions:
      # allow actions-cool/issues-helper to update issues and PRs
      issues: write
      pull-requests: write
    if: github.repository == 'twbs/bootstrap'
    runs-on: ubuntu-latest
    steps:
      - name: awaiting reply
        if: github.event.label.name == 'needs-example'
        uses: actions-cool/issues-helper@71b62d7da76e59ff7b193904feb6e77d4dbb2777 # v3.7.6
        with:
          actions: "create-comment"
          token: ${{ secrets.GITHUB_TOKEN }}
          body: |
            Hello @${{ github.event.issue.user.login }}. Bug reports must include a **live demo** of the issue. Per our [contributing guidelines](https://github.com/twbs/bootstrap/blob/main/.github/CONTRIBUTING.md), please create a reduced test case on [CodePen](https://codepen.io/) or [StackBlitz](https://stackblitz.com/) and report back with your link, Bootstrap version, and specific browser and Operating System details.

name: JS Tests

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: 2
  NODE: 22

permissions:
  contents: read

jobs:
  run:
    permissions:
      # allow coverallsapp/github-action to create new checks issues and fetch code
      checks: write
      contents: read
    name: JS Tests
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: ${{ env.NODE }}
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      - name: Run dist
        run: npm run js

      - name: Run JS tests
        run: npm run js-test

      - name: Run Coveralls
        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
        if: ${{ !github.event.repository.fork }}
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
          path-to-lcov: "./js/coverage/lcov.info"

name: Lint

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: 2
  NODE: 22

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "${{ env.NODE }}"
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

name: CSS (node-sass)

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  FORCE_COLOR: 2
  NODE: 22

permissions:
  contents: read

jobs:
  css:
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "${{ env.NODE }}"

      - name: Build CSS with node-sass
        run: |
          npx --package node-sass@latest node-sass --version
          npx --package node-sass@latest node-sass --output-style expanded --source-map true --source-map-contents true --precision 6 scss/ -o dist-sass/css/
          ls -Al dist-sass/css

      - name: Check built CSS files for Sass variables
        shell: bash
        run: |
          SASS_VARS_FOUND=$(find "dist-sass/css/" -type f -name "*.css" -print0 | xargs -0 --no-run-if-empty grep -F "\$" || true)
          if [[ -z "$SASS_VARS_FOUND" ]]; then
            echo "All good, no Sass variables found!"
            exit 0
          else
            echo "Found $(echo "$SASS_VARS_FOUND" | wc -l | bc) Sass variables:"
            echo "$SASS_VARS_FOUND"
            exit 1
          fi

name: Publish NuGet Packages

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  package-nuget:
    runs-on: windows-latest
    if: ${{ github.repository == 'twbs/bootstrap' && startsWith(github.event.release.tag_name, 'v') }}
    env:
      GITHUB_REF_NAME: ${{ github.ref_name }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up NuGet
        uses: nuget/setup-nuget@d105a947828025cd7a980103c35ba2bfae586d0f # v2.0.2
        with:
          nuget-api-key: ${{ secrets.NuGetAPIKey }}
          nuget-version: '5.x'

      - name: Pack NuGet packages
        shell: pwsh
        run: |
          $bsversion = $env:GITHUB_REF_NAME.Substring(1)
          nuget pack "nuget\bootstrap.nuspec" -Verbosity detailed -NonInteractive -BasePath . -Version $bsversion
          nuget pack "nuget\bootstrap.sass.nuspec" -Verbosity detailed -NonInteractive -BasePath . -Version $bsversion
          nuget push "bootstrap.$bsversion.nupkg" -Verbosity detailed -NonInteractive -Source "https://api.nuget.org/v3/index.json"
          nuget push "bootstrap.sass.$bsversion.nupkg" -Verbosity detailed -NonInteractive -Source "https://api.nuget.org/v3/index.json"

name: Release notes

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

jobs:
  update_release_draft:
    permissions:
      # allow release-drafter/release-drafter to create GitHub releases and add labels to PRs
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    if: github.repository == 'twbs/bootstrap'
    steps:
      - uses: release-drafter/release-drafter@3a7fb5c85b80b1dda66e1ccb94009adbbd32fce3 # v7.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# This workflow uses actions that are not certified by GitHub. They are provided
# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '27 12 * * 2'
  push:
    branches: [ "main" ]

# Declare default permissions as read only.
permissions: read-all

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      # Needed to publish results and get a badge (see publish_results below).
      id-token: write
      # Uncomment the permissions below if installing in a private repository.
      # contents: read
      # actions: read

    steps:
      - name: "Checkout code"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: "Run analysis"
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
          # - you want to enable the Branch-Protection check on a *public* repository, or
          # - you are installing Scorecard on a *private* repository
          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
          # repo_token: ${{ secrets.SCORECARD_TOKEN }}

          # Public repositories:
          #   - Publish results to OpenSSF REST API for easy access by consumers
          #   - Allows the repository to include the Scorecard badge.
          #   - See https://github.com/ossf/scorecard-action#publishing-results.
          # For private repositories:
          #   - `publish_results` will always be set to `false`, regardless
          #     of the value entered here.
          publish_results: true

          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
          # file_mode: git

      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      # Upload the results to GitHub's code scanning dashboard (optional).
      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
      - name: "Upload to code-scanning"
        uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
        with:
          sarif_file: results.sarif