chore: align the toolchain on pnpm 12, TypeScript 7, Biome 2.6 and Vitest 5

.changeset/typescript-7-build.md

@@ -0,0 +1,5 @@
+---
+"@variablelab/theme-toggle": patch
+---
+
+Build `dist/` with tsdown 0.23 and TypeScript 7. The API is unchanged: the bundle's comments and the type declarations' layout differ.

.github/workflows/ci.yml

@@ -6,26 +6,28 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  test:
-    name: Test
+  checks:
+    name: Check, test and build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: 🛠️ Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3
         with:
+          version: 2026.10.19
           install: true
           cache: true
 
@@ -43,3 +45,42 @@ jobs:
 
       - name: 🔨 Build
         run: pnpm rr pack
+
+  secrets:
+    name: Scan for secrets
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: 🛠️ Setup mise
+        uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3
+        with:
+          version: 2026.10.19
+          install_args: gitleaks
+          cache: true
+
+      - name: 🔐 Scan the new commits
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: gitleaks git --redact --verbose --log-opts="$BASE_SHA..$HEAD_SHA"
+
+  # The ruleset requires a check named "Test": this job reports the checks and the secret scan under that name.
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: [checks, secrets]
+    if: ${{ always() }}
+    permissions: {}
+    steps:
+      - name: ✅ The checks passed and no secret leaked
+        env:
+          CHECKS: ${{ needs.checks.result }}
+          SECRETS: ${{ needs.secrets.result }}
+        run: test "$CHECKS" = "success" && test "$SECRETS" = "success"

.github/workflows/dependency-audit.yml

@@ -29,8 +29,9 @@ jobs:
           persist-credentials: false
 
       - name: 🛠️ Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3
         with:
+          version: 2026.10.19
           install: true
           cache: true
 

.github/workflows/release.yml

@@ -30,8 +30,9 @@ jobs:
           persist-credentials: false
 
       - name: 🛠️ Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3
         with:
+          version: 2026.10.19
           install: true
           cache: true
 
@@ -83,8 +84,9 @@ jobs:
           persist-credentials: false
 
       - name: 🛠️ Setup mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3
         with:
+          version: 2026.10.19
           install: true
           cache: true
 

.github/workflows/workflow-audit.yml

@@ -6,8 +6,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -17,6 +16,8 @@ jobs:
   audit-workflows:
     name: Audit workflows
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -28,4 +29,4 @@ jobs:
         env:
           # Enables zizmor's online audits.
           GH_TOKEN: ${{ github.token }}
-        run: pipx run --spec zizmor==1.30.1 zizmor --format=github .
+        run: pipx run --spec zizmor==1.31.1 zizmor --format=github .

.gitignore

@@ -11,3 +11,7 @@ __screenshots__
 .vscode/*
 !.vscode/extensions.json
 !.vscode/settings.json
+
+# mise
+.mise/*
+!.mise/locks/

biome.json

@@ -1,4 +1,7 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
-  "extends": ["@rrlab/biome-config"]
+  "$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
+  "extends": ["@rrlab/biome-config"],
+  "files": {
+    "includes": ["**", "!.mise/locks", "!.changeset/*.md", "!CHANGELOG.md", "!.github/workflows/pullfrog.yml"]
+  }
 }

brand/README.md

@@ -2,10 +2,10 @@
 
 The Sign of theme-toggle: an edge and a block, with a gap between them. It isn't a sun and a moon.
 
-| File | Use |
-| --- | --- |
-| `sign.svg` | The Sign, 24×24, in `currentColor`. Sites and images use this file. |
-| `sign-readme.svg` | The Sign on a `ground` square, for READMEs. |
+| File              | Use                                                                 |
+| ----------------- | ------------------------------------------------------------------- |
+| `sign.svg`        | The Sign, 24×24, in `currentColor`. Sites and images use this file. |
+| `sign-readme.svg` | The Sign on a `ground` square, for READMEs.                         |
 
 How a Sign is drawn and used: [vlab-brand › Project brand](https://github.com/withvariablelab/brand/blob/main/skills/vlab-brand/project-brand.md).
 

docs/development.md

@@ -4,15 +4,15 @@ How to work on theme-toggle in a clone. The [contributing guide](contributing.md
 
 ## Setup
 
-[mise](https://mise.jdx.dev) pins Node 24 and pnpm in `mise.toml`, with checksums in `mise.lock`, and puts `node_modules/.bin` on the `PATH`, so the tools run by name:
+[mise](https://mise.jdx.dev) 2026.10.19 or later pins Node 24, pnpm 12 and [gitleaks](https://github.com/gitleaks/gitleaks) in `mise.toml`, with checksums in `mise.lock`, and puts `node_modules/.bin` on the `PATH`, so the tools run by name:
 
 ```sh
 mise install
 pnpm install
 playwright install chromium   # the browser the tests run in
 ```
 
-`pnpm install` also installs the git hooks in `lefthook.yml`, because `pnpm-workspace.yaml` allows lefthook's install script. After changing a version in `mise.toml`, run `mise lock` and commit both files.
+`pnpm install` also installs the git hooks in `lefthook.yml`, because `pnpm-workspace.yaml` allows lefthook's install script. With `CI` set, that script skips them, so after a `CI=1 pnpm install` run `pnpm lefthook install` to add them. After changing a version in `mise.toml`, run `mise lock` and commit both files.
 
 ## Tasks
 
@@ -27,6 +27,6 @@ The suite in `test/functional` runs in Vitest Browser Mode with Playwright. It c
 
 ## CI
 
-- **On each pull request to `main`:** `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack` (CI), and zizmor on the workflows (Workflow audit).
-- **Git hooks** ([lefthook](https://lefthook.dev)): on commit, Biome's fixes on the staged files and the type check; on push, the tests.
+- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools, then runs `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack`. Beside them, gitleaks scans the pull request's commits for secrets, and the required `Test` check passes when both do. Workflow audit runs zizmor on the workflows.
+- **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends `lefthook/base.yml` from `@rrlab/cli`, whose jobs are listed in [its README](https://github.com/withvariablelab/dx/blob/main/run-run/cli/README.md#git-hooks), and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when that file is missing from `node_modules`. On commit, in parallel: Biome's fixes on the staged files, the type check when a TypeScript file or a tsconfig changes, and gitleaks on the staged changes. On push, the tests.
 - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit).

lefthook.yml

@@ -1,13 +1,14 @@
+extends:
+  - node_modules/@rrlab/cli/lefthook/base.yml
+
 pre-commit:
-  parallel: true
   jobs:
-    - name: jsc
-      run: pnpm rr jsc --fix-staged
-      stage_fixed: true
-
-    - name: tsc
-      glob: "*.{ts,tsx,json}"
-      run: pnpm rr tsc
+    - name: shared-hooks
+      run: |
+        if [ ! -f node_modules/@rrlab/cli/lefthook/base.yml ]; then
+          echo "@rrlab/cli's git hooks are missing from node_modules: run pnpm install, then commit again."
+          exit 1
+        fi
 
 pre-push:
   jobs:

mise.toml

@@ -1,9 +1,12 @@
+min_version = "2026.10.19"
+
 [env]
 _.path = ["{{config_root}}/node_modules/.bin"]
 
 [tools]
+gitleaks = "8.30.1"
 node = "24"
-pnpm = "10.30.3"
+pnpm = "12.16.1"
 
 [settings]
 lockfile = true