chore: add license headers and CI by cabljac · Pull Request #2929 · firebase/extensions

cabljac · 2026-07-30T09:35:14Z

No description provided.

…y with 12 updates Bumps the version-minor-and-patch group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.9` | `29.4.11` | | [@genkit-ai/google-genai](https://github.com/genkit-ai/genkit/tree/HEAD/js/plugins/google-genai) | `1.37.0` | `1.39.0` | | [@types/express-serve-static-core](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express-serve-static-core) | `4.19.8` | `4.19.9` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.39` | `20.19.43` | | [genkit](https://github.com/genkit-ai/genkit/tree/HEAD/js/genkit) | `1.33.0` | `1.39.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.1` | `9.0.3` | | [smtp-server](https://github.com/nodemailer/smtp-server) | `3.19.1` | `3.19.2` | | [@types/node-fetch](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node-fetch) | `2.6.4` | `2.6.13` | | [@genkit-ai/vertexai](https://github.com/genkit-ai/genkit/tree/HEAD/js/plugins/vertexai) | `1.37.0` | `1.39.0` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` | | [nanoid](https://github.com/ai/nanoid) | `5.1.9` | `5.1.16` | Updates `ts-jest` from 29.4.9 to 29.4.11 - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](kulshekhar/ts-jest@v29.4.9...v29.4.11) Updates `@genkit-ai/google-genai` from 1.37.0 to 1.39.0 - [Release notes](https://github.com/genkit-ai/genkit/releases) - [Commits](https://github.com/genkit-ai/genkit/commits/@genkit-ai/google-genai@1.39.0/js/plugins/google-genai) Updates `@types/express-serve-static-core` from 4.19.8 to 4.19.9 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express-serve-static-core) Updates `@types/node` from 20.19.39 to 20.19.43 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `genkit` from 1.33.0 to 1.39.0 - [Release notes](https://github.com/genkit-ai/genkit/releases) - [Commits](https://github.com/genkit-ai/genkit/commits/genkit@1.39.0/js/genkit) Updates `js-yaml` from 3.14.2 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.0) Updates `nodemailer` from 9.0.1 to 9.0.3 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v9.0.1...v9.0.3) Updates `smtp-server` from 3.19.1 to 3.19.2 - [Release notes](https://github.com/nodemailer/smtp-server/releases) - [Changelog](https://github.com/nodemailer/smtp-server/blob/master/CHANGELOG.md) - [Commits](nodemailer/smtp-server@v3.19.1...v3.19.2) Updates `@types/node-fetch` from 2.6.4 to 2.6.13 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node-fetch) Updates `@genkit-ai/vertexai` from 1.37.0 to 1.39.0 - [Release notes](https://github.com/genkit-ai/genkit/releases) - [Commits](https://github.com/genkit-ai/genkit/commits/@genkit-ai/vertexai@1.39.0/js/plugins/vertexai) Updates `sharp` from 0.34.5 to 0.35.3 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.3) Updates `nanoid` from 5.1.9 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.1.9...5.1.16) --- updated-dependencies: - dependency-name: ts-jest dependency-version: 29.4.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-minor-and-patch - dependency-name: "@genkit-ai/google-genai" dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-minor-and-patch - dependency-name: "@types/express-serve-static-core" dependency-version: 4.19.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-minor-and-patch - dependency-name: "@types/node" dependency-version: 20.19.43 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-minor-and-patch - dependency-name: genkit dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-minor-and-patch - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: version-minor-and-patch - dependency-name: nodemailer dependency-version: 9.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-minor-and-patch - dependency-name: smtp-server dependency-version: 3.19.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-minor-and-patch - dependency-name: "@types/node-fetch" dependency-version: 2.6.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: version-minor-and-patch - dependency-name: "@genkit-ai/vertexai" dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-minor-and-patch - dependency-name: sharp dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-minor-and-patch - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: version-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…n-minor-and-patch-5f24554eda chore(deps): bump the version-minor-and-patch group across 1 directory with 12 updates

* chore: backfill Apache license headers in ts/js files Claude-Session: https://claude.ai/code/session_013dz9GhC3metut6HFswPavu * ci: enforce Apache license headers with addlicense Adds a license job to the Validate workflow that runs google/addlicense in check mode over tracked ts/js files. Run npm run license:fix locally to add missing headers. Claude-Session: https://claude.ai/code/session_013dz9GhC3metut6HFswPavu * ci: pin validate workflow actions to commit SHAs Required by zizmor unpinned-uses mandatory policy. Claude-Session: https://claude.ai/code/session_013dz9GhC3metut6HFswPavu * ci: restrict validate workflow to read-only permissions Resolves zizmor excessive-permissions finding. Claude-Session: https://claude.ai/code/session_013dz9GhC3metut6HFswPavu * chore: harden addlicense script NUL-separated file list for filenames with special characters, and reject unknown modes instead of defaulting to fix. Claude-Session: https://claude.ai/code/session_013dz9GhC3metut6HFswPavu

wiz-9635d3485b · 2026-07-30T09:36:13Z

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	9
Sensitive Data	-
Secrets	-
IaC Misconfigurations	2
SAST Findings	-
Software Management Findings	-

Total	9 2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

gemini-code-assist

Code Review

This pull request primarily adds Apache 2.0 license headers to various source files across the repository and updates several dependencies, including @types/node, ts-jest, and sharp. The review identified a few areas for improvement: the license check script should be updated to include shell scripts, and there is a version mismatch between the @types/node dependency and the Node.js engine target in delete-user-data/functions/package.json.

gemini-code-assist · 2026-07-30T09:38:50Z

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Checks (default) or adds Apache license headers on tracked .ts/.js files


Update the comment to reflect that .sh files are also checked.

Suggested change

# Checks (default) or adds Apache license headers on tracked .ts/.js files

# Checks (default) or adds Apache license headers on tracked .ts/.js/.sh files

gemini-code-assist · 2026-07-30T09:38:50Z

+  exit 1
+fi
+
+git ls-files -z -- '*.ts' '*.js' \


Since scripts/addlicense.sh itself is a shell script and contains a license header, it is recommended to include *.sh files in the addlicense check to ensure all script files are covered.

Suggested change

git ls-files -z -- '*.ts' '*.js' \

git ls-files -z -- '*.ts' '*.js' '*.sh' \

gemini-code-assist · 2026-07-30T09:38:50Z

-    "@types/express-serve-static-core": "4.19.8",
-    "@types/node": "^22.0.0",
+    "@types/express-serve-static-core": "4.19.9",
+    "@types/node": "^20.19.43",


Downgrading @types/node to ^20.19.43 while the engine target is set to 22 (line 34) creates a version mismatch. It is recommended to keep @types/node aligned with the major version of the target Node.js runtime to prevent missing type definitions for newer APIs.

github-advanced-security · 2026-07-30T14:41:25Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-advanced-security · 2026-07-30T14:41:25Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-advanced-security · 2026-07-30T14:41:25Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-advanced-security · 2026-07-30T14:41:25Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

…icts

Add release workflow

Fix release kit action

+
+      - name: Install Dependencies & Run Tests
+        working-directory: ${{ inputs.target_kit }}
+        run: |


Kits should be published from the kits branch

Use NPM provenance instead of wombat

This helps debug action failures when several releases are happening at once and they fail early

Print inputs as the first step of release-kits

## Summary `npm publish --provenance` requires `repository.url` to resolve to the GitHub repo that built the package. Two BigQuery script packages declared a bare `github.com/firebase/extensions.git` — no scheme, so npm can't normalise it and provenance fails. Prefixed both with `git+https://`, matching `firestore-bigquery-change-tracker`, which already publishes fine: - `@firebaseextensions/fs-bq-schema-views` - `@firebaseextensions/fs-bq-import-collection` Broken since `--provenance` was added in March 2026. No other `package.json` on `next` is affected.

Syncs release-kit.yaml byte-for-byte with the version that landed on kits in #2990. This copy never executes (Release Kit is always dispatched from kits; next has no kits/ directories); it only lists the workflow in the Actions UI, and it had drifted to show the old broken versioning logic. No behavior change. Will need re-syncing if #2991 lands on kits.

Syncs release-kit.yaml byte-for-byte with the #2993 version on kits (trusted publishing, checkout/push/release pinned to kits). The #2992 copy on next authenticated via the removed NPM_TOKEN and checked out the dispatched ref, so dispatching from next failed at the test job. The #2993 file is dispatch-ref-agnostic, making the two copies safely identical. No behavior change beyond fixing dispatch-from-next.

+          # version ever published (even after unpublish), and package.json on the
+          # branch can lag behind what was actually released.
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org
+        run: |


dependabot Bot and others added 3 commits July 20, 2026 20:50

Merge pull request #2914 from firebase/dependabot/npm_and_yarn/versio…

cd84656

…n-minor-and-patch-5f24554eda chore(deps): bump the version-minor-and-patch group across 1 directory with 12 updates

gemini-code-assist Bot reviewed Jul 30, 2026

View reviewed changes

inlined and others added 14 commits August 12, 2026 14:51

Add release workflow

71a28ea

Fix zizmore findings in new file only (existing errors still present)

cd30b83

Another attempt to fix zizmor

0384dc3

More zizmor fixes. Trusted publishing seems incompatible with Google

b2e181c

Apparently I have to fix ALL zizmore issues if I touch any action

95834dc

Merge origin/next into inlined.kit-release-pipeline and resolve confl…

fdab1cf

…icts

Fix credential persistence finding in validate.yml license job

8a6bb32

Fix incorrect actions/cache commit hash in readmes-updated.yml

69233e0

Merge pull request #2940 from firebase/inlined.kit-release-pipeline

8fc5d09

Add release workflow

fix(ci): remove workspace flags and support target_branch parameter

f97c164

fix(ci): use public registry for npm ci during build step

b1c5c19

fix(ci): pass target_branch via env to resolve zizmor template-injection

6fcc767

chore(ci): remove target_branch parameter in favor of github.ref_name

587c3a0

Merge pull request #2944 from firebase/inlined.kit-release-pipeline

cc4c613

Fix release kit action

github-advanced-security Bot found potential problems Aug 14, 2026

View reviewed changes

Comment thread .github/workflows/release-kit.yaml Fixed

Comment thread .github/workflows/release-kit.yaml Fixed

github-advanced-security Bot found potential problems Aug 14, 2026

View reviewed changes

Comment thread .github/workflows/release-kit.yaml Fixed

Comment thread .github/workflows/release-kit.yaml

- name: Install Dependencies & Run Tests

working-directory: ${{ inputs.target_kit }}

run: |

inlined and others added 5 commits August 18, 2026 09:59

Kits should be published from the kits branch

6ed7c12

Merge pull request #2950 from firebase/release-kit-always-kits-branch

09ada4f

Kits should be published from the kits branch

Trying out trusted publishing

bcc9445

Fix YAML

c0d6361

chore(ci): clean up setup-node in release-kit workflow

6615b41

inlined and others added 7 commits August 19, 2026 18:15

Remove node token

c2b8086

Merge pull request #2959 from firebase/inlined.provenance

3799a59

Use NPM provenance instead of wombat

Print inputs as the first step of release-kits

3911782

This helps debug action failures when several releases are happening at once and they fail early

Merge pull request #2965 from inlined/print-inputs-release-kit

8c16d23

Print inputs as the first step of release-kits

github-advanced-security Bot found potential problems Aug 28, 2026

View reviewed changes

Comment thread .github/workflows/release-kit.yaml Fixed

github-advanced-security Bot found potential problems Aug 28, 2026

View reviewed changes

Comment thread .github/workflows/release-kit.yaml

# version ever published (even after unpublish), and package.json on the

# branch can lag behind what was actually released.

NPM_CONFIG_REGISTRY: https://registry.npmjs.org

run: |

Navigation Menu

Uh oh!

chore: add license headers and CI - #2929

chore: add license headers and CI#2929
cabljac wants to merge 29 commits into
masterfrom
next

cabljac commented Jul 30, 2026

Uh oh!

wiz-9635d3485b Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jul 30, 2026

Uh oh!

gemini-code-assist Bot Jul 30, 2026

Uh oh!

gemini-code-assist Bot Jul 30, 2026

Uh oh!

github-advanced-security AI commented Jul 30, 2026

Uh oh!

github-advanced-security AI commented Jul 30, 2026

Uh oh!

github-advanced-security AI commented Jul 30, 2026

Uh oh!

github-advanced-security AI commented Jul 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1,23 @@
		#!/usr/bin/env bash
		# Checks (default) or adds Apache license headers on tracked .ts/.js files

	git ls-files -z -- '.ts' '.js' \
	git ls-files -z -- '.ts' '.js' '*.sh' \

Uh oh!

Conversation

cabljac commented Jul 30, 2026

Uh oh!

wiz-9635d3485b Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI commented Jul 30, 2026

What Enabling Code Scanning Means:

Uh oh!

github-advanced-security AI commented Jul 30, 2026

What Enabling Code Scanning Means:

Uh oh!

github-advanced-security AI commented Jul 30, 2026

What Enabling Code Scanning Means:

Uh oh!

github-advanced-security AI commented Jul 30, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

wiz-9635d3485b Bot commented Jul 30, 2026 •

edited

Loading