Shared workflows v4.0.1

Shared GitHub Actions workflows. Add one job per workflow to a caller in
.github/workflows/, pinned to this commit:

uses: zemd/js/.github/workflows/shared-benchmarks.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4.0.1
uses: zemd/js/.github/workflows/shared-ci.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4.0.1
uses: zemd/js/.github/workflows/shared-codeql.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4.0.1
uses: zemd/js/.github/workflows/shared-release.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4.0.1
uses: zemd/js/.github/workflows/shared-scorecard.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4.0.1
uses: zemd/js/.github/workflows/shared-zizmor.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4.0.1

Ready-to-copy callers: .github/workflows-examples.

Re-resolve this commit at any time:

gh api repos/zemd/js/git/ref/tags/v4 --jq .object.sha

Changes

Patch Changes

• Allow shared CI to succeed when tests produce no LCOV coverage files.

• Allow benchmark runs to succeed without publishing when the Bencher API key is missing.

---

What's Changed

• Allow shared CI to succeed when tests produce no LCOV coverage files by @zemd in #51
• Bump turbo from 2.10.8 to 2.10.9 in the development-dependencies group across 1 directory by @dependabot[bot] in #49
• Bump @types/node from 26.1.2 to 26.2.0 in the production-dependencies group across 1 directory by @dependabot[bot] in #48
• Allow benchmark runs to succeed without publishing when the Bencher API key is missing by @zemd in #50
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #52

Full Changelog: v4.0.0...v4.0.1

release-2026-08-16-1626

Packages staged on npm

These versions require maintainer approval with 2FA before they become available from npm.
Rejecting one does not roll back this release or make its version reusable; release changes under a new version instead.

Package	Version
@zemd/nestjs-pino-logger	2.0.0

Changelogs

@zemd/nestjs-pino-logger@2.0.0

Major Changes

• Migrate the NestJS Pino logger to the zemd/js monorepo. Align it with standard
  Pino levels, preserve structured fields for serializers and redaction, and
  harden the optional pretty transport against terminal log injection. Match
  NestJS multi-message and error-parameter semantics, with formatLogMessage as
  the explicit opt-in helper for formatted single-message output.

---

What's Changed

• Improve release workflow by @zemd in #46
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #47
• Allow shared CI to succeed when tests produce no LCOV coverage files by @zemd in #51
• Bump turbo from 2.10.8 to 2.10.9 in the development-dependencies group across 1 directory by @dependabot[bot] in #49
• Bump @types/node from 26.1.2 to 26.2.0 in the production-dependencies group across 1 directory by @dependabot[bot] in #48
• Allow benchmark runs to succeed without publishing when the Bencher API key is missing by @zemd in #50
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #52
• Update pnpm by @zemd in #53
• Move nest.js pino logger integration by @zemd in #54
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #55

Full Changelog: release-2026-08-14-0924...release-2026-08-16-1626

Shared workflows v4.0.0

Shared GitHub Actions workflows. Add one job per workflow to a caller in
.github/workflows/, pinned to this commit:

uses: zemd/js/.github/workflows/shared-benchmarks.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4.0.0
uses: zemd/js/.github/workflows/shared-ci.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4.0.0
uses: zemd/js/.github/workflows/shared-codeql.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4.0.0
uses: zemd/js/.github/workflows/shared-release.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4.0.0
uses: zemd/js/.github/workflows/shared-scorecard.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4.0.0
uses: zemd/js/.github/workflows/shared-zizmor.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4.0.0

Ready-to-copy callers: .github/workflows-examples.

Re-resolve this commit at any time:

gh api repos/zemd/js/git/ref/tags/v4 --jq .object.sha

Changes

Major Changes

• Remove the shared-tooling-repository and shared-tooling-ref release inputs; shared release jobs now resolve tooling from the called workflow's own pinned revision.

Patch Changes

• Allow shared release workflows to process private workspace packages without versions.

---

What's Changed

• Improve release workflow by @zemd in #46
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #47

Full Changelog: v3.0.1...v4.0.0

Shared workflows v3.0.1

Shared GitHub Actions workflows. Add one job per workflow to a caller in
.github/workflows/, pinned to this commit:

uses: zemd/js/.github/workflows/shared-benchmarks.yml@7a3e058a84bf059a8f9afa810ca4faec8fb71282 # v3.0.1
uses: zemd/js/.github/workflows/shared-ci.yml@7a3e058a84bf059a8f9afa810ca4faec8fb71282 # v3.0.1
uses: zemd/js/.github/workflows/shared-codeql.yml@7a3e058a84bf059a8f9afa810ca4faec8fb71282 # v3.0.1
uses: zemd/js/.github/workflows/shared-release.yml@7a3e058a84bf059a8f9afa810ca4faec8fb71282 # v3.0.1
uses: zemd/js/.github/workflows/shared-scorecard.yml@7a3e058a84bf059a8f9afa810ca4faec8fb71282 # v3.0.1
uses: zemd/js/.github/workflows/shared-zizmor.yml@7a3e058a84bf059a8f9afa810ca4faec8fb71282 # v3.0.1

Ready-to-copy callers: .github/workflows-examples.

Re-resolve this commit at any time:

gh api repos/zemd/js/git/ref/tags/v3 --jq .object.sha

Changes

Patch Changes

• Fix checkout-free release jobs to install pnpm from the pinned shared tooling manifest.

---

What's Changed

• Refactoring by @zemd in #41
• Add comprehensive tests for GitHub Actions workflows by @zemd in #42
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #43
• Fix release workflow by @zemd in #44
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #45

New Contributors

• @zemd-release-branchkeeper[bot] made their first contribution in #43

Full Changelog: v2.1.1...v3.0.1

release-2026-08-14-0924

Packages staged on npm

These versions require maintainer approval with 2FA before they become available from npm.
Rejecting one does not roll back this release or make its version reusable; release changes under a new version instead.

Package	Version
@logtown/hono	5.0.2
@zemd/color	1.0.2
@zemd/figma-rest-api	3.0.26
@zemd/flickr-rest-api	2.0.2
@zemd/http-client	6.0.0
@zemd/std-modules	0.1.2

Changelogs

@logtown/hono@5.0.2

Patch Changes

• Parse custom HTTP log formats without dynamic JavaScript evaluation.

@zemd/color@1.0.2

Patch Changes

• Updated dependencies:
  • @zemd/std-modules@0.1.2

@zemd/figma-rest-api@3.0.26

Patch Changes

• Encode every generated path identifier and refuse to forward Figma tokens outside api.figma.com.

• Updated dependencies:

  • @zemd/http-client@6.0.0

@zemd/flickr-rest-api@2.0.2

Patch Changes

• Prevent debug logging from exposing Flickr API keys.

• Updated dependencies:

  • @zemd/http-client@6.0.0

@zemd/http-client@6.0.0

Major Changes

• Encode untrusted URL path segments and replace raw debug payloads with redacted metadata that never includes request bodies.

@zemd/std-modules@0.1.2

Patch Changes

• Require npm provenance metadata for published artifacts.

---

What's Changed

• Fix benchmark workflow by @zemd in #39
• chore(release): version packages by @github-actions[bot] in #40
• Refactoring by @zemd in #41
• Add comprehensive tests for GitHub Actions workflows by @zemd in #42
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #43
• Fix release workflow by @zemd in #44
• chore(release): version packages by @zemd-release-branchkeeper[bot] in #45

New Contributors

• @zemd-release-branchkeeper[bot] made their first contribution in #43

Full Changelog: release-2026-08-12-0917...release-2026-08-14-0924

Shared workflows v2.1.1

Shared GitHub Actions workflows. Add one job per workflow to a caller in
.github/workflows/, pinned to this commit:

uses: zemd/js/.github/workflows/shared-benchmarks.yml@bbc45ffa5ad42491dc7252ef798ecf1e78e9998b # v2.1.1
uses: zemd/js/.github/workflows/shared-ci.yml@bbc45ffa5ad42491dc7252ef798ecf1e78e9998b # v2.1.1
uses: zemd/js/.github/workflows/shared-codeql.yml@bbc45ffa5ad42491dc7252ef798ecf1e78e9998b # v2.1.1
uses: zemd/js/.github/workflows/shared-release.yml@bbc45ffa5ad42491dc7252ef798ecf1e78e9998b # v2.1.1
uses: zemd/js/.github/workflows/shared-scorecard.yml@bbc45ffa5ad42491dc7252ef798ecf1e78e9998b # v2.1.1
uses: zemd/js/.github/workflows/shared-zizmor.yml@bbc45ffa5ad42491dc7252ef798ecf1e78e9998b # v2.1.1

Ready-to-copy callers: .github/workflows-examples.

Re-resolve this commit at any time:

gh api repos/zemd/js/git/ref/tags/v2 --jq .object.sha

Changes

Patch Changes

• Isolate benchmark execution from authenticated Bencher publishing

---

What's Changed

• Fix benchmark workflow by @zemd in #39
• chore(release): version packages by @github-actions[bot] in #40

Full Changelog: v2.1.0...v2.1.1

Shared workflows v2.1.0

Shared GitHub Actions workflows. Add one job per workflow to a caller in
.github/workflows/, pinned to this commit:

uses: zemd/js/.github/workflows/shared-benchmarks.yml@c8435ab29c330d04888b3b5a49b577a7ed891389 # v2.1.0
uses: zemd/js/.github/workflows/shared-ci.yml@c8435ab29c330d04888b3b5a49b577a7ed891389 # v2.1.0
uses: zemd/js/.github/workflows/shared-codeql.yml@c8435ab29c330d04888b3b5a49b577a7ed891389 # v2.1.0
uses: zemd/js/.github/workflows/shared-release.yml@c8435ab29c330d04888b3b5a49b577a7ed891389 # v2.1.0
uses: zemd/js/.github/workflows/shared-scorecard.yml@c8435ab29c330d04888b3b5a49b577a7ed891389 # v2.1.0
uses: zemd/js/.github/workflows/shared-zizmor.yml@c8435ab29c330d04888b3b5a49b577a7ed891389 # v2.1.0

Ready-to-copy callers: .github/workflows-examples.

Re-resolve this commit at any time:

gh api repos/zemd/js/git/ref/tags/v2 --jq .object.sha

Changes

Minor Changes

• Add a reusable Bencher workflow for continuous benchmark history and pull-request comparisons.

---

What's Changed

• Add Bencher integration by @zemd in #37
• chore(release): version packages by @github-actions[bot] in #38

Full Changelog: v2.0.4...v2.1.0

release-2026-08-12-0917

Packages staged on npm

These versions require maintainer approval with 2FA before they become available from npm.
Rejecting one does not roll back this release or make its version reusable; release changes under a new version instead.

Package	Version
@zemd/testing	1.1.0

Changelogs

@zemd/testing@1.1.0

Minor Changes

• Add lightweight Node.js performance benchmark helpers with readable output, variation reporting, informational performance budgets, and Bencher metric formatting.

---

What's Changed

• Add harden-runner integration by @zemd in #28
• chore(release): version packages by @github-actions[bot] in #29
• Add .devcontainer/ by @zemd in #27
• Bump the development-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #31
• Bump step-security/harden-runner from 2.20.0 to 2.20.1 in the github-actions group by @dependabot[bot] in #30
• chore(release): version packages by @github-actions[bot] in #32
• Rename repo workflows by @zemd in #33
• chore(release): version packages by @github-actions[bot] in #34
• Replace husky with native githooks by @zemd in #35
• chore(release): version packages by @github-actions[bot] in #36
• Add Bencher integration by @zemd in #37
• chore(release): version packages by @github-actions[bot] in #38

Full Changelog: release-2026-08-10-1930...release-2026-08-12-0917

Shared workflows v2.0.4

Shared GitHub Actions workflows. Add one job per workflow to a caller in
.github/workflows/, pinned to this commit:

uses: zemd/js/.github/workflows/shared-ci.yml@2bbd18b9bd71218a62529acd0b690286c0dbddea # v2.0.4
uses: zemd/js/.github/workflows/shared-codeql.yml@2bbd18b9bd71218a62529acd0b690286c0dbddea # v2.0.4
uses: zemd/js/.github/workflows/shared-release.yml@2bbd18b9bd71218a62529acd0b690286c0dbddea # v2.0.4
uses: zemd/js/.github/workflows/shared-scorecard.yml@2bbd18b9bd71218a62529acd0b690286c0dbddea # v2.0.4
uses: zemd/js/.github/workflows/shared-zizmor.yml@2bbd18b9bd71218a62529acd0b690286c0dbddea # v2.0.4

Ready-to-copy callers: .github/workflows-examples.

Re-resolve this commit at any time:

gh api repos/zemd/js/git/ref/tags/v2 --jq .object.sha

Changes

Patch Changes

• Separate GHA builds from committed bundle synchronization.

---

What's Changed

• Replace husky with native githooks by @zemd in #35
• chore(release): version packages by @github-actions[bot] in #36

Full Changelog: v2.0.3...v2.0.4

Shared workflows v2.0.3

Shared GitHub Actions workflows. Add one job per workflow to a caller in
.github/workflows/, pinned to this commit:

uses: zemd/js/.github/workflows/shared-ci.yml@12b8a926bbed22453a925b0dc92f718c9156a28f # v2.0.3
uses: zemd/js/.github/workflows/shared-codeql.yml@12b8a926bbed22453a925b0dc92f718c9156a28f # v2.0.3
uses: zemd/js/.github/workflows/shared-release.yml@12b8a926bbed22453a925b0dc92f718c9156a28f # v2.0.3
uses: zemd/js/.github/workflows/shared-scorecard.yml@12b8a926bbed22453a925b0dc92f718c9156a28f # v2.0.3
uses: zemd/js/.github/workflows/shared-zizmor.yml@12b8a926bbed22453a925b0dc92f718c9156a28f # v2.0.3

Ready-to-copy callers: .github/workflows-examples.

Re-resolve this commit at any time:

gh api repos/zemd/js/git/ref/tags/v2 --jq .object.sha

Changes

Patch Changes

• Standardize reusable workflow caller example filenames.

---

What's Changed

• Rename repo workflows by @zemd in #33
• chore(release): version packages by @github-actions[bot] in #34

Full Changelog: v2.0.2...v2.0.3