chore: refresh project maintenance

Author: ClaudiuCeia

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/workflows/ci.yml

@@ -6,24 +6,41 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
+        with:
+          deno-version: v2.6.8
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          deno-version: v2.x
+          node-version: 24
+
+      - name: Run checks
+        run: deno task check
 
-      - name: Verify formatting
-        run: deno fmt --check
+      - name: Build npm package
+        run: deno task build:npm
 
-      - name: Run linter
-        run: deno lint
+      - name: Smoke test npm entry points
+        run: >-
+          node --input-type=module -e
+          'await Promise.all([
+            import("./npm/esm/mod.js"),
+            import("./npm/esm/src/nondeterministic.js"),
+            import("./npm/esm/src/perf.js")
+          ])'
 
-      - name: Run tests
-        run: deno test
+      - name: Verify npm package contents
+        run: npm pack ./npm --dry-run

.github/workflows/publish.yml

@@ -4,46 +4,112 @@ on:
     tags:
       - "v*"
 
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  preflight:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Setup Deno
+        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
+        with:
+          deno-version: v2.6.8
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+
+      - name: Verify tag matches deno.json version
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          if [[ ! "${tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Tag '${tag}' is not a stable semantic version."
+            exit 1
+          fi
+          deno_version="$(deno eval 'console.log(JSON.parse(Deno.readTextFileSync("deno.json")).version)')"
+          if [[ "${tag}" != "v${deno_version}" ]]; then
+            echo "Tag '${tag}' does not match deno.json version '${deno_version}'."
+            exit 1
+          fi
+
+      - name: Run checks
+        run: deno task check
+
+      - name: Verify JSR package
+        run: deno publish --dry-run
+
+      - name: Build npm package
+        run: deno task build:npm
+
+      - name: Smoke test npm entry points
+        run: >-
+          node --input-type=module -e
+          'await Promise.all([
+            import("./npm/esm/mod.js"),
+            import("./npm/esm/src/nondeterministic.js"),
+            import("./npm/esm/src/perf.js")
+          ])'
+
+      - name: Verify npm package contents
+        run: npm pack ./npm --dry-run
+
   publish-jsr:
     runs-on: ubuntu-latest
+    needs: preflight
 
     permissions:
       contents: read
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Setup Deno
+        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
+        with:
+          deno-version: v2.6.8
 
       - name: Publish to JSR
-        run: npx jsr publish
+        run: deno publish
 
   publish-npm:
     runs-on: ubuntu-latest
     needs: publish-jsr
 
     permissions:
       contents: read
+      id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
         with:
-          deno-version: v2.x
+          deno-version: v2.6.8
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 20
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
 
       - name: Build npm package
         run: deno task build:npm
 
       - name: Publish to npm
-        run: npm publish ./npm --access public
+        run: npm publish ./npm --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -55,22 +121,10 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
-      - name: Verify tag matches deno.json version
-        shell: bash
-        run: |
-          set -euo pipefail
-          tag="${GITHUB_REF_NAME}"
-          version="${tag#v}"
-          deno_version="$(node -p "require('./deno.json').version")"
-          if [[ "${deno_version}" != "${version}" ]]; then
-            echo "Tag '${tag}' does not match deno.json version '${deno_version}'."
-            exit 1
-          fi
-
       - name: Generate changelog
         shell: bash
         run: |
@@ -99,7 +153,7 @@ jobs:
           } > RELEASE_NOTES.md
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           name: ${{ github.ref_name }}
           tag_name: ${{ github.ref_name }}

.gitignore

@@ -1,5 +1,4 @@
 .vscode
 .coverage
 .notes
-npm
-npm/
+/npm/

AGENTS.md

@@ -16,8 +16,8 @@
 
 Run these from the repo root:
 
-- `deno task check`: Formats, lints, and runs tests
-  (`deno fmt && deno lint && deno test --ignore=npm`).
+- `deno task check`: Checks formatting, lints, and runs tests
+  (`deno fmt --check && deno lint && deno test --ignore=npm`).
 - `deno test`: Run the test suite.
 - `deno fmt`: Auto-format code and Markdown.
 - `deno lint`: Static analysis for TS/JS.

README.md

@@ -12,7 +12,7 @@ compose them into a grammar.
 ### Deno (JSR)
 
 ```ts
-import { seq, str } from "jsr:@claudiu-ceia/combine@^0.2.6";
+import { seq, str } from "jsr:@claudiu-ceia/combine@^0.3.0";
 ```
 
 Subpath imports are also supported:
@@ -37,7 +37,10 @@ import { seq, str } from "@claudiu-ceia/combine";
 If you're in a CommonJS project, use a dynamic import:
 
 ```js
-const { seq, str } = await import("@claudiu-ceia/combine");
+(async () => {
+  const { seq, str } = await import("@claudiu-ceia/combine");
+  // Use seq and str here.
+})();
 ```
 
 ## Quickstart

deno.json

@@ -7,17 +7,25 @@
     "./perf": "./src/perf.ts"
   },
   "publish": {
-    "exclude": ["bench/", "tests/", "npm/"]
+    "exclude": [
+      ".github/",
+      "AGENTS.md",
+      "bench/",
+      "deno.lock",
+      "npm/",
+      "scripts/",
+      "tests/"
+    ]
   },
   "tasks": {
-    "check": "deno fmt && deno lint && deno test --ignore=npm",
+    "check": "deno fmt --check && deno lint && deno test --ignore=npm",
     "coverage": "deno test --ignore=npm --clean --coverage=.coverage && deno coverage --detailed --html .coverage",
     "build:npm": "deno run -A scripts/build-npm.ts",
     "hooks:install": "ln -sf ../../scripts/pre-commit .git/hooks/pre-commit && chmod +x scripts/pre-commit",
     "hooks:uninstall": "rm -f .git/hooks/pre-commit"
   },
   "imports": {
-    "@std/assert": "jsr:@std/assert@^1.0.17",
+    "@std/assert": "jsr:@std/assert@^1.0.19",
     "@deno/dnt": "jsr:@deno/dnt@^0.41.3",
     "parsimmon": "npm:parsimmon@1.18.1"
   }