chore(deps): update https://gitea.t000-n.de/t.behrendt/trivy-actions action to v1.3.7

.editorconfig

@@ -1,8 +0,0 @@
-[*]
-end_of_line = lf
-insert_final_newline = true
-indent_style = space
-indent_size = 2
-charset = utf-8
-trim_trailing_whitespace = true
-max_line_length = 80

.gitea/workflows/cd.yaml

@@ -6,7 +6,6 @@ on:
       - main
     paths:
       - action.yml
-      - dist/**
   workflow_dispatch:
 
 jobs:
@@ -14,14 +13,14 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@3ab82e6aa1db388a34562f5ce6eedb598651d916 # 0.1.42
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@af46017d0af5fd6af4425f8e6961f14280a1acd1 # 0.1.26
         with:
           token: ${{ secrets.GITEA_TOKEN }}
-      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3f772d0a80a510b0f06762be110276c9c8a7b7b8 # 0.2.12
+      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@1b8fe65eda1ea0a7586a5fd552ef8f4a639b154f # 0.1.3
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/ci.yaml

@@ -8,61 +8,8 @@ jobs:
     name: Dry-Run
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Validate Renovate Config
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Validate JSON
         uses: ./
         with:
           json-file: renovate.json
-
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache dependencies
-        id: cache-deps
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            node_modules
-          key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
-      - name: Install dependencies
-        if: steps.cache-deps.outputs.cache-hit != 'true'
-        run: npm ci
-      - name: Typecheck
-        run: npm run typecheck
-      - name: Format code
-        run: npm run format:check
-      - name: Run test
-        run: npm run test
-
-  check-dist:
-    name: Check Dist
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: .nvmrc
-      - name: Cache dependencies
-        id: cache-deps
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            node_modules
-          key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
-      - name: Install dependencies
-        if: steps.cache-deps.outputs.cache-hit != 'true'
-        run: npm ci
-      - run: mv dist dist_orig
-      - run: npm run build
-      - run: |
-          original_hash=$(sha256sum dist_orig/index.js | cut -d' ' -f1)
-          new_hash=$(sha256sum dist/index.js | cut -d' ' -f1)
-          if [ "$original_hash" != "$new_hash" ]; then
-            echo "Build is not up to date. Original hash: $original_hash, new hash: $new_hash"
-            exit 1
-          fi

.gitea/workflows/prerelease.yaml

@@ -8,15 +8,15 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@3ab82e6aa1db388a34562f5ce6eedb598651d916 # 0.1.42
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@af46017d0af5fd6af4425f8e6961f14280a1acd1 # 0.1.26
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           prerelease: true
-      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3f772d0a80a510b0f06762be110276c9c8a7b7b8 # 0.2.12
+      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@1b8fe65eda1ea0a7586a5fd552ef8f4a639b154f # 0.1.3
         with:
-          tag: ${{ steps.tag.outputs.new-tag }}
+          tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/run-tas.yaml

@@ -0,0 +1,31 @@
+name: Run TAS
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "The branch to run TAS on"
+        required: true
+        default: "main"
+  schedule:
+    - cron: "0 6 * * 5"
+
+jobs:
+  run-tas:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@09fb31ca3a203eaa78d4139d94b3aee3ff5d2388 # 1.3.7
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@09fb31ca3a203eaa78d4139d94b3aee3ff5d2388 # 1.3.7
+      - env:
+          TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
+        run: |
+          trivy config --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output sarif.json .
+      - uses: https://gitea.t000-n.de/t.behrendt/tas-actions/tas-upload-sarif@5e1031a9eff4a83fc17d0893332ad896386c082f # 0.0.3
+        with:
+          tas-base-url: ${{ vars.TAS_BASE_URL }}
+          sarif-file: sarif.json
+          owner: t.behrendt
+          repo: validate-json-by-json-schema-action
+          branch: ${{ inputs.branch || github.head_ref || 'main' }}

.gitignore

@@ -1,2 +1,138 @@
-node_modules
+# ---> Node
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+.pnpm-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
 coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# Snowpack dependency directory (https://snowpack.dev/)
+web_modules/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional stylelint cache
+.stylelintcache
+
+# Microbundle cache
+.rpt2_cache/
+.rts2_cache_cjs/
+.rts2_cache_es/
+.rts2_cache_umd/
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variable files
+.env
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+.parcel-cache
+
+# Next.js build output
+.next
+out
+
+# Nuxt.js build / generate output
+.nuxt
+dist
+
+# Gatsby files
+.cache/
+# Comment in the public line in if your project uses Gatsby and not Next.js
+# https://nextjs.org/blog/next-9-1#public-directory-support
+# public
+
+# vuepress build output
+.vuepress/dist
+
+# vuepress v2.x temp and cache directory
+.temp
+.cache
+
+# vitepress build output
+**/.vitepress/dist
+
+# vitepress cache directory
+**/.vitepress/cache
+
+# Docusaurus cache and generated files
+.docusaurus
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# TernJS port file
+.tern-port
+
+# Stores VSCode versions used for testing VSCode extensions
+.vscode-test
+
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*
+

.npmrc

@@ -1 +0,0 @@
-min-release-age=7

.nvmrc

@@ -1,2 +0,0 @@
-24
-

.oxfmtrc.json

@@ -1,4 +0,0 @@
-{
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "ignorePatterns": ["dist/**", "node_modules/**", "coverage/**"]
-}

LICENSE

@@ -2,17 +2,17 @@ MIT License
 
 Copyright (c) 2025 t.behrendt
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
-associated documentation files (the "Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and 
+associated documentation files (the "Software"), to deal in the Software without restriction, including 
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the 
 following conditions:
 
-The above copyright notice and this permission notice shall be included in all copies or substantial
+The above copyright notice and this permission notice shall be included in all copies or substantial 
 portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
-LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
-EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT 
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO 
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE 
 USE OR OTHER DEALINGS IN THE SOFTWARE.

action.yml

@@ -8,5 +8,26 @@ inputs:
     required: true
 
 runs:
-  using: "node24"
-  main: "dist/index.js"
+  using: "composite"
+  steps:
+    - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      with:
+        node-version: "latest"
+    - name: Extract schema
+      shell: bash
+      run: |
+        schema=$(jq -r '.["$schema"]' < ${{ inputs.json-file }})
+        if [ -n "$schema" ]; then
+          curl -s $schema > schema.json
+        else
+          echo "No schema found"
+          exit 0
+        fi
+    - name: Update the schema to the latest version
+      shell: bash
+      run: |
+        npx ajv-cli migrate -s schema.json -o schema.json
+    - name: Validate JSON
+      shell: bash
+      run: |
+        npx ajv-cli validate -s schema.json -d ${{ inputs.json-file }} --strict=false

package.json

@@ -1,25 +0,0 @@
-{
-  "name": "validate-json-by-json-schema-action",
-  "version": "1.0.0",
-  "type": "commonjs",
-  "main": "src/index.ts",
-  "scripts": {
-    "test": "vitest --config vitext.config.ts",
-    "format": "oxfmt",
-    "format:check": "oxfmt --check",
-    "build": "rolldown -c",
-    "typecheck": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@actions/core": "3.0.1",
-    "ajv": "8.20.0"
-  },
-  "devDependencies": {
-    "@types/node": "24.13.3",
-    "@vitest/coverage-v8": "4.1.10",
-    "oxfmt": "0.61.0",
-    "rolldown": "1.2.0",
-    "typescript": "7.0.2",
-    "vitest": "4.1.10"
-  }
-}

renovate.json

@@ -1,12 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>t.behrendt/renovate-configs:action",
-    "local>t.behrendt/renovate-configs:bun-npm"
-  ],
-  "postUpgradeTasks": {
-    "commands": ["npm ci", "npm run build"],
-    "fileFilters": ["dist/**"],
-    "executionMode": "update"
-  }
+    "local>t.behrendt/renovate-configs:common",
+    "local>t.behrendt/renovate-configs:action"
+  ]
 }

rolldown.config.ts

@@ -1,11 +0,0 @@
-import { defineConfig } from "rolldown";
-
-export default defineConfig({
-  input: "src/index.ts",
-  platform: "node",
-  tsconfig: "./tsconfig.json",
-  output: {
-    file: "dist/index.js",
-    format: "cjs",
-  },
-});

src/index.ts

@@ -1,3 +0,0 @@
-import { run } from "./main";
-
-run();

src/main.ts

@@ -1,18 +0,0 @@
-import * as core from "@actions/core";
-import { readFileSync } from "node:fs";
-import { validateJson } from "./validation";
-
-export async function run(): Promise<void> {
-  try {
-    const jsonFilePath = core.getInput("json-file");
-    core.info(`Validating JSON file: ${jsonFilePath}`);
-
-    const json = readFileSync(jsonFilePath, "utf8");
-
-    await validateJson(json);
-
-    core.info("JSON file is valid");
-  } catch (error) {
-    core.setFailed(`Error validating JSON file: ${error}`);
-  }
-}

src/validation.test.ts

@@ -1,109 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { validateJson } from "./validation";
-
-global.fetch = vi.fn();
-
-const validSchema = JSON.stringify({
-  $id: "https://t00n.de/schema.json",
-  title:
-    "JSON schema for Renovate 43.244.4 config files (https://renovatebot.com/)",
-  $schema: "http://json-schema.org/draft-07/schema#",
-  type: "object",
-  properties: {
-    $schema: {
-      type: "string",
-    },
-    name: {
-      type: "string",
-    },
-  },
-  required: ["name"],
-  additionalProperties: false,
-});
-
-describe("validateJson()", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("throws an error if the JSON file is not valid JSON", async () => {
-    const jsonFile = {
-      despiteThisBeingValidJson: "toString() breaks it, making it invalid",
-    }.toString();
-    await expect(validateJson(jsonFile)).rejects.toThrow(
-      '"[object Object]" is not valid JSON',
-    );
-  });
-
-  it("throws an error if the JSON file does not contain a $schema property", async () => {
-    const jsonFile = JSON.stringify({
-      validJson: true,
-    });
-    await expect(validateJson(jsonFile)).rejects.toThrow(
-      "No schema found in JSON file.",
-    );
-  });
-
-  it("throws an error if the schema cannot be fetched", async () => {
-    vi.mocked(fetch).mockRejectedValue(new Error("Failed to fetch schema"));
-    const jsonFile = JSON.stringify({ $schema: "http://t00n.de/404.json" });
-    await expect(validateJson(jsonFile)).rejects.toThrow(
-      "Failed to fetch schema",
-    );
-  });
-
-  it("throws an error if the schema file is not valid", async () => {
-    vi.mocked(fetch).mockResolvedValue(
-      // @ts-expect-error - mock response
-      {
-        ok: true,
-        text: async () =>
-          ({
-            despiteThisBeingValidJson:
-              "toString() breaks it, making it invalid",
-          }).toString(),
-      },
-    );
-
-    const jsonFile = JSON.stringify({
-      $schema: "https://json-schema.org/draft-07/schema",
-    });
-    await expect(validateJson(jsonFile)).rejects.toThrow(
-      '"[object Object]" is not valid JSON',
-    );
-  });
-
-  it("throws an error if the JSON file does not match the schema", async () => {
-    vi.mocked(fetch).mockResolvedValue(
-      // @ts-expect-error - mock response
-      {
-        ok: true,
-        text: async () => validSchema,
-      },
-    );
-
-    const jsonFile = JSON.stringify({
-      $schema: "https://json-schema.org/draft-07/schema",
-      notTheExpectedField: 42,
-    });
-    await expect(validateJson(jsonFile)).rejects.toThrow(
-      "JSON file is not valid: No errors",
-    );
-  });
-
-  it("does not throw an error if the JSON file is valid", async () => {
-    vi.mocked(fetch).mockResolvedValue(
-      // @ts-expect-error - mock response
-      {
-        ok: true,
-        text: async () => validSchema,
-      },
-    );
-
-    const jsonFile = JSON.stringify({
-      $schema: "https://t00n.de/schema.json",
-      name: "John Doe",
-    });
-    await expect(validateJson(jsonFile)).resolves.toBeUndefined();
-  });
-});

src/validation.ts

@@ -1,25 +0,0 @@
-import Ajv from "ajv";
-
-export const validateJson = async (jsonFileContent: string): Promise<void> => {
-  const jsonObject = JSON.parse(jsonFileContent);
-
-  const schema = jsonObject["$schema"];
-  if (!schema) {
-    throw new Error("No schema found in JSON file.");
-  }
-
-  const schemaUrl = new URL(schema);
-
-  const schemaContent = await fetch(schemaUrl.toString());
-  const schemaText = await schemaContent.text();
-  const schemaObject = JSON.parse(schemaText);
-
-  const validator = new Ajv({
-    strict: false,
-  });
-  const validate = validator.compile(schemaObject);
-  const isValid = validate(jsonObject);
-  if (!isValid) {
-    throw new Error(`JSON file is not valid: ${validator.errorsText()}`);
-  }
-};

tsconfig.json

@@ -1,22 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "commonjs",
-    "lib": ["ES2022"],
-    "types": ["node"],
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "removeComments": false,
-    "noImplicitAny": true,
-    "noImplicitReturns": true,
-    "noImplicitThis": true,
-    "noUnusedLocals": true,
-    "noUnusedParameters": true,
-    "exactOptionalPropertyTypes": true,
-    "noImplicitOverride": true
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/*.spec.ts"]
-}

vitext.config.ts

@@ -1,11 +0,0 @@
-import { defineConfig } from "vitest/config";
-
-export default defineConfig({
-  test: {
-    coverage: {
-      enabled: true,
-      provider: "v8",
-      reporter: ["lcov"],
-    },
-  },
-});