fix(security): use unbiased cryptographic randomness

.github/copilot-instructions.md

@@ -0,0 +1,20 @@
+# Copilot Instructions
+
+Follow AGENTS.md and the repository's existing patterns.
+
+- Use pnpm 12.17.0 and the scripts declared in package.json.
+- Keep library source in src/ and regression tests with the existing test files.
+- Preserve ESM and CommonJS runtime exports and their matching TypeScript declarations.
+- Preserve the documented security defaults and Node.js runtime requirement.
+- Keep the Vite playground importing the workspace package, not private source files.
+- Update Readme.md when changing the public API or user-facing behavior.
+- Keep generated output in dist/; do not commit build artifacts or publish a release.
+
+Helpful commands:
+- pnpm test
+- pnpm typecheck
+- pnpm lint
+- pnpm format:check
+- pnpm audit
+- pnpm run dev:playground
+

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 1
 
@@ -18,45 +18,34 @@ jobs:
         echo "Head ref: ${{ github.head_ref }}"
         echo "Base ref: ${{ github.base_ref }}"
 
-    - name: Setup Node.js
-      uses: actions/setup-node@v3
+    - name: Setup pnpm, Node.js, and dependencies
+      uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
       with:
-        node-version: "18"
+        runtime: node
+        node-version-file: .nvmrc
+        cache: true
+        require-lockfile: true
 
-    - name: Cache dependencies
-      uses: actions/cache@v3
-      with:
-        path: |
-          **/node_modules
-        key: ${{ runner.os }}-node-18-yarn-${{ hashFiles('**/yarn.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-node-18-yarn-
-
-    - name: Install dependencies
-      run: yarn install
+    - name: Run Tests
+      run: pnpm run test
 
     - name: Type check
-      run: yarn typecheck
+      run: pnpm run typecheck
 
     - name: Check code quality
       run: |
-        yarn lint
-        yarn format:check
-        yarn run --if-present generate
-
-    - name: Security Audit
-      run: yarn audit --level moderate || true
-      continue-on-error: true
+        pnpm run lint
+        pnpm run format:check
+        pnpm run --if-present generate
 
-    - name: Security Audit Summary
-      if: success() || failure()
-      run: yarn audit --summary
+    - name: Security audit
+      run: pnpm audit
 
     - name: Archive production artifacts
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: build-artifacts
-        path: ./build/
+        path: ./dist/
 
     - name: Error handling
       if: failure()

.github/workflows/npm-publish.yml

@@ -1,74 +1,34 @@
-name: "@smakss/react-scroll-direction"
+name: Release @smakss/random-string
 
 on:
-  release:
-    types: [created]
+  push:
+    branches: [master]
 
 jobs:
-  build:
+  release:
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18
-      - run: yarn
-      - run: yarn generate
-      - uses: actions/upload-artifact@v3
-        with:
-          name: built-package
-          path: |
-            ./path-to-your-build-folder
-            package.json
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
 
-  publish-npm:
-    needs: build
-    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/download-artifact@v3
-        with:
-          name: built-package
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-          scope: "@smakss"
-      - run: yarn install
-      - run: yarn generate
-      - run: |
-          if grep -q "beta" package.json; then
-            echo "Publishing Beta to npm"
-            npm publish --tag beta
-          else
-            echo "Publishing Release to npm"
-            npm publish
-          fi
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+          fetch-depth: 0
 
-  publish-gpr:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/download-artifact@v3
+      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
         with:
-          name: built-package
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18
-          registry-url: https://npm.pkg.github.com/
-          scope: "@smakss"
-      - run: yarn install
-      - run: yarn generate
-      - run: |
-          if grep -q "beta" package.json; then
-            echo "Publishing Beta to GitHub Package Registry"
-            npm publish --tag beta
-          else
-            echo "Publishing Release to GitHub Package Registry"
-            npm publish
-          fi
+          runtime: node
+          node-version-file: .nvmrc
+          cache: true
+          require-lockfile: true
+
+      - name: Build package
+        run: pnpm run generate
+
+      - name: Run semantic release
+        run: pnpm run release
         env:
-          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/publish-github-packages.yml

@@ -0,0 +1,95 @@
+name: Publish @smakss/random-string to GitHub Packages
+
+on:
+  workflow_run:
+    workflows: ['Release @smakss/random-string']
+    types: [completed]
+    branches: [master]
+
+concurrency:
+  group: github-packages-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+
+      - name: Find semantic-release tag
+        id: release
+        env:
+          RELEASE_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          tag="$(git describe --tags --exact-match "$RELEASE_SHA" 2>/dev/null || true)"
+          case "$tag" in
+            v[0-9]*)
+              echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "version=" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
+
+      - name: Configure GitHub Packages registry
+        if: steps.release.outputs.version != ''
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .nvmrc
+          registry-url: https://npm.pkg.github.com/
+          scope: "@smakss"
+
+      - name: Setup pnpm and dependencies
+        if: steps.release.outputs.version != ''
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          node-version-file: false
+          cache: true
+          require-lockfile: true
+
+      - name: Set package version from release tag
+        if: steps.release.outputs.version != ''
+        env:
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          node -e '
+            const fs = require("node:fs");
+            const packageJson = JSON.parse(fs.readFileSync("package.json", "utf8"));
+            packageJson.version = process.env.RELEASE_VERSION;
+            fs.writeFileSync("package.json", `${JSON.stringify(packageJson, null, 2)}\n`);
+          '
+
+      - name: Build package
+        if: steps.release.outputs.version != ''
+        run: pnpm run generate
+
+      - name: Check if version is already published
+        id: registry
+        if: steps.release.outputs.version != ''
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PACKAGE_NAME: "@smakss/random-string"
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          if npm view "${PACKAGE_NAME}@${RELEASE_VERSION}" version --registry=https://npm.pkg.github.com/ >"$RUNNER_TEMP/npm-view.log" 2>&1; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+          elif grep -Eq 'E404|404 Not Found' "$RUNNER_TEMP/npm-view.log"; then
+            echo "published=false" >> "$GITHUB_OUTPUT"
+          else
+            cat "$RUNNER_TEMP/npm-view.log" >&2
+            exit 1
+          fi
+
+      - name: Publish to GitHub Packages
+        if: steps.release.outputs.version != '' && steps.registry.outputs.published != 'true'
+        run: pnpm publish --no-git-checks --registry=https://npm.pkg.github.com/
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.husky/commit-msg

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-yarn commitlint --edit ${1}
+pnpm exec commitlint --edit "${1}"

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-yarn lint-staged
+pnpm exec lint-staged

.nvmrc

@@ -0,0 +1 @@
+26

.oxfmtrc.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "ignorePatterns": [
+    ".cache",
+    ".shadowenv.d",
+    ".vscode",
+    "build",
+    "dist",
+    "coverage",
+    "node_modules",
+    "public",
+    ".github",
+    "tmp",
+    "*.yml",
+    "pnpm-lock.yaml"
+  ],
+  "singleQuote": true,
+  "printWidth": 80,
+  "tabWidth": 2,
+  "trailingComma": "none",
+  "semi": true
+}