From e67b0ce12dd0646fafec6ba50323ba0bf81b56f1 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Mon, 15 Jul 2024 23:24:31 +0200
Subject: [PATCH 01/19] ci: use `npm ci` consistently

---
 .github/workflows/ci.yml    | 2 +-
 .github/workflows/mocha.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 31e3b3d9f9..5613111385 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-      - run: npm install --ignore-scripts
+      - run: npm ci --ignore-scripts
       - run: npm run lint
 
 name: CI
diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 33e357fd9a..574f4598e6 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '${{ matrix.node }}'
-      - run: npm install --production
+      - run: npm ci --production
       - run: npm run test:smoke
 
   lint:

From ef5e4538545ec60cc8cc4a1f7ffdcf595b554f39 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Mon, 15 Jul 2024 23:32:27 +0200
Subject: [PATCH 02/19] ci: use `actions/setup-node` cache mechanism

---
 .github/workflows/browser-test.yml | 10 ++----
 .github/workflows/ci.yml           |  3 ++
 .github/workflows/mocha.yml        | 50 ++++++++----------------------
 3 files changed, 19 insertions(+), 44 deletions(-)

diff --git a/.github/workflows/browser-test.yml b/.github/workflows/browser-test.yml
index f9535b1669..2250051343 100644
--- a/.github/workflows/browser-test.yml
+++ b/.github/workflows/browser-test.yml
@@ -17,18 +17,14 @@ jobs:
     runs-on: ubuntu-latest
     if: contains(github.event.pull_request.labels.*.name, 'run-browser-test')
     steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
+      - uses: actions/setup-node@v4
         with:
-          path: '~/.npm'
-          key: "ubuntu-latest-node-full-lts-${{ hashFiles('**/package-lock.json') }}"
+          node-version: lts/*
+          cache: 'npm'
       - name: Install Dependencies
         run: npm ci
       - name: Run Browser Tests
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5613111385..e26443c0f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: 'npm'
       - run: npm ci --ignore-scripts
       - run: npm run lint
 
diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 574f4598e6..762b2b6d79 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -55,6 +55,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '${{ matrix.node }}'
+          cache: 'npm'
       - run: npm ci --production
       - run: npm run test:smoke
 
@@ -63,17 +64,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: smoke
     steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
+      - uses: actions/setup-node@v4
         with:
-          path: '~/.npm'
-          key: "ubuntu-latest-node-lts-${{ hashFiles('**/package-lock.json') }}"
+          node-version: lts/*
+          cache: 'npm'
       - name: Install Dependencies
         run: npm ci --ignore-scripts
       - name: 'Check lint'
@@ -101,22 +98,13 @@ jobs:
             env:
               COVERAGE: 1
     steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '${{ matrix.node }}'
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - name: Get npm cache directory in Windows
-        id: npm-cache
-        if: ${{ matrix.os == 'windows-2019' }}
-        run: |
-          echo "dir=$(npm config get cache)" >> $env:GITHUB_OUTPUT
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
+      - uses: actions/setup-node@v4
         with:
-          path: ${{ matrix.os == 'ubuntu-latest' && '~/.npm' || steps.npm-cache.outputs.dir }}
-          key: "${{ matrix.os }}-node-v${{ matrix.node }}-${{ hashFiles('**/package-lock.json') }}"
+          node-version: '${{ matrix.node }}'
+          cache: 'npm'
       - name: Install Dependencies
         run: npm ci --ignore-scripts
       - name: Install Annotation Support
@@ -145,19 +133,13 @@ jobs:
     # Don't run forked 'pull_request' without saucelabs token
     if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
+      - uses: actions/setup-node@v4
         with:
-          path: '~/.npm'
-          # this key is different than above, since we are running scripts
-          # (builds, postinstall lifecycle hooks, etc.)
-          key: "ubuntu-latest-node-full-lts-${{ hashFiles('**/package-lock.json') }}"
+          node-version: lts/*
+          cache: 'npm'
       - name: Install Dependencies
         run: npm ci
       - name: Run Browser Tests
@@ -182,19 +164,13 @@ jobs:
     # Don't run forked 'pull_request' without saucelabs token
     if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
+      - uses: actions/setup-node@v4
         with:
-          path: '~/.npm'
-          # this key is different than above, since we are running scripts
-          # (builds, postinstall lifecycle hooks, etc.)
-          key: "ubuntu-latest-node-full-lts-${{ hashFiles('**/package-lock.json') }}"
+          node-version: lts/*
+          cache: 'npm'
       - name: Install Dependencies
         run: npm ci
       - name: Run Browser Tests

From 8e1a419ce75495050e03501c0c5cb29b46098cd5 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:05:54 +0200
Subject: [PATCH 03/19] ci: reusable workflow for DRY:er setup

---
 .github/workflows/browser-test.yml |  28 ++----
 .github/workflows/ci.yml           |  19 ----
 .github/workflows/mocha.yml        | 148 ++++++-----------------------
 .github/workflows/npm-script.yml   |  72 ++++++++++++++
 4 files changed, 111 insertions(+), 156 deletions(-)
 delete mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/npm-script.yml

diff --git a/.github/workflows/browser-test.yml b/.github/workflows/browser-test.yml
index 2250051343..d662700a62 100644
--- a/.github/workflows/browser-test.yml
+++ b/.github/workflows/browser-test.yml
@@ -11,30 +11,20 @@ permissions:
 
 jobs:
   test-browser:
-    # TODO: configure to retain build artifacts in `.karma/` dir
     name: 'Browser Tests'
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
     if: contains(github.event.pull_request.labels.*.name, 'run-browser-test')
+    uses: ./.github/workflows/npm-script.yml
+    secrets: inherit
+    with:
+      npm-script: test.browser
+
+  remove-label:
+    needs: test-browser
+    if: always()
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          cache: 'npm'
-      - name: Install Dependencies
-        run: npm ci
-      - name: Run Browser Tests
-        run: npm start test.browser
-        env:
-          SAUCE_USERNAME: '${{secrets.SAUCE_USERNAME}}'
-          SAUCE_ACCESS_KEY: '${{secrets.SAUCE_ACCESS_KEY}}'
       - name: remove 'run-browser-test' label
         uses: buildsville/add-remove-label@v2.0.1
-        if: ${{ always() }}
         with:
           token: ${{secrets.GITHUB_TOKEN}}
           label: run-browser-test
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index e26443c0f4..0000000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          cache: 'npm'
-      - run: npm ci --ignore-scripts
-      - run: npm run lint
-
-name: CI
-
-on:
-  pull_request: ~
-  push:
-    branches:
-      - main
diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 762b2b6d79..03fe0a0dd8 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -1,80 +1,47 @@
 name: Tests
+
 on:
   push:
     branches:
-      - '**'
-      - '!mochajs.org'
+      - main
     paths-ignore: ['*.md', 'docs/**']
-    tags-ignore:
-      - '**'
   pull_request:
+    branches:
+      - main
     types: [opened, synchronize, reopened]
     paths-ignore: ['*.md', 'docs/**']
 
 jobs:
-  prevent-double-run:
-    # skip 'push' event when an open PR exists
-    name: Prevent double run
-    runs-on: ubuntu-latest
-    outputs:
-      pr-id: ${{ steps.findPr.outputs.number }}
-    steps:
-      - name: Check event pull_request
-        if: github.event_name == 'pull_request'
-        run: 'echo pull_request: run workflow'
-      - uses: actions/checkout@v4
-        if: github.event_name == 'push'
-        with:
-          persist-credentials: false
-      - name: Check event push
-        id: findPr
-        if: github.event_name == 'push'
-        uses: jwalton/gh-find-current-pr@v1
-        with:
-          state: open
-
   smoke:
-    name: 'Smoke [Node.js v${{ matrix.node }} / ${{ matrix.os }}]'
-    needs: prevent-double-run
-    if: needs.prevent-double-run.outputs.pr-id == ''
-    runs-on: '${{ matrix.os }}'
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-2019
-        node:
-          - 14
-          - 16
-          - 18
-          - 20
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '${{ matrix.node }}'
-          cache: 'npm'
-      - run: npm ci --production
-      - run: npm run test:smoke
+    uses: ./.github/workflows/npm-script.yml
+    with:
+      os: 'ubuntu-latest,windows-2019'
+      node-versions: '14,16,18,20,22'
+      npm-script: test:smoke
 
   lint:
-    name: Linting code and markdown
-    runs-on: ubuntu-latest
+    uses: ./.github/workflows/npm-script.yml
+    with:
+      npm-script: lint
+
+  test-browser-local:
     needs: smoke
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          cache: 'npm'
-      - name: Install Dependencies
-        run: npm ci --ignore-scripts
-      - name: 'Check lint'
-        run: npm start lint
+    uses: ./.github/workflows/npm-script.yml
+    with:
+      browsers: ChromeHeadless
+      npm-script: test.browser
+
+  test-browser-saucelabs:
+    # Don't run forked 'pull_request' without saucelabs token
+    if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
+    needs:
+      - smoke
+      - test-browser-local
+    uses: ./.github/workflows/npm-script.yml
+    secrets: inherit
+    with:
+      browsers: 'firefox@latest,chrome@latest,MicrosoftEdge@latest,safari@latest'
+      npm-script: test.browser
 
   test-node:
     name: 'Node.js [v${{ matrix.node }} / ${{ matrix.os }}]'
@@ -124,58 +91,3 @@ jobs:
         uses: coverallsapp/github-action@master
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
-
-  test-browser-local:
-    name: Browser Test [ChromeHeadless]
-    needs: smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    # Don't run forked 'pull_request' without saucelabs token
-    if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          cache: 'npm'
-      - name: Install Dependencies
-        run: npm ci
-      - name: Run Browser Tests
-        run: npm start test.browser
-        env:
-          BROWSER: ChromeHeadless
-
-  test-browser-saucelabs:
-    name: Browser Tests on SauceLabs [${{ matrix.browser }}]
-    needs:
-      - smoke
-      - test-browser-local
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      matrix:
-        browser:
-          - firefox@latest
-          - chrome@latest
-          - MicrosoftEdge@latest
-          - safari@latest
-    # Don't run forked 'pull_request' without saucelabs token
-    if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          cache: 'npm'
-      - name: Install Dependencies
-        run: npm ci
-      - name: Run Browser Tests
-        run: npm start test.browser
-        env:
-          SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
-          SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
-          BROWSER: ${{ matrix.browser }}
diff --git a/.github/workflows/npm-script.yml b/.github/workflows/npm-script.yml
new file mode 100644
index 0000000000..82379f81e7
--- /dev/null
+++ b/.github/workflows/npm-script.yml
@@ -0,0 +1,72 @@
+name: Reusable npm script runner
+
+on:
+  workflow_call:
+    inputs:
+      npm-script:
+        description: 'npm script'
+        required: true
+        type: string
+      browsers:
+        description: 'A comma separated list of browser names to test with.'
+        required: false
+        type: string
+      node-versions:
+        description: 'A comma separated list of Node versions to test with.'
+        required: false
+        type: string
+      os:
+        description: 'A comma separated list of operating systems to test on.'
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  resolve_inputs:
+    name: Resolving inputs
+    runs-on: ubuntu-latest
+    outputs:
+      browsers: ${{ steps.split-browsers.outputs.splitted }}
+      nodeVersions: ${{ steps.split-node-versions.outputs.splitted }}
+      os: ${{ steps.split-os.outputs.splitted }}
+    steps:
+      - id: split-browsers
+        if: inputs.browsers
+        run: echo "splitted=$(echo '${{ inputs.browsers }}' | jq -R -c 'split(",")')" >> $GITHUB_OUTPUT
+      - id: split-node-versions
+        if: inputs.node-versions
+        run: echo "splitted=$(echo '${{ inputs.node-versions }}' | jq -R -c 'split(",")')" >> $GITHUB_OUTPUT
+      - id: split-os
+        if: inputs.os
+        run: echo "splitted=$(echo '${{ inputs.os }}' | jq -R -c 'split(",")')" >> $GITHUB_OUTPUT
+
+  script:
+    name: ${{ needs.resolve_inputs.outputs.browsers && format('[{0}]', matrix.browser) }}${{ inputs.npm-script }}${{ needs.resolve_inputs.outputs.nodeVersions && format(' with node.js {0}', matrix.node_version) }}${{ needs.resolve_inputs.outputs.os && format(' on {0}', matrix.os) }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    needs:
+      - resolve_inputs
+    strategy:
+      fail-fast: false
+      matrix:
+        node_version: ${{ needs.resolve_inputs.outputs.nodeVersions && fromJson(needs.resolve_inputs.outputs.nodeVersions) || 'lts/*' }}
+        os: ${{ needs.resolve_inputs.outputs.os && fromJson(needs.resolve_inputs.outputs.os) || 'ubuntu-latest' }}
+        browser: ${{ needs.resolve_inputs.outputs.browsers && fromJson(needs.resolve_inputs.outputs.browsers) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node_version }}
+          cache: 'npm'
+      - run: npm ci --ignore-scripts
+      - run: npm start ${{ inputs.npm-script }}
+        env:
+          BROWSER: ${{ matrix.browser }}
+          SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
+          SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+
+

From 567c963982e58395b2cccb37880c3f0a547d4d27 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:06:30 +0200
Subject: [PATCH 04/19] ci: remove unused `delete-runs.yml`

---
 .github/workflows/delete-runs.yml | 21 ---------------------
 1 file changed, 21 deletions(-)
 delete mode 100644 .github/workflows/delete-runs.yml

diff --git a/.github/workflows/delete-runs.yml b/.github/workflows/delete-runs.yml
deleted file mode 100644
index 326f8424b7..0000000000
--- a/.github/workflows/delete-runs.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: Delete workflow runs
-on:
-  workflow_dispatch:
-    inputs:
-      days:
-        description: 'Number of days'
-        type: number
-        required: true
-        default: 180
-
-jobs:
-  del_runs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete workflow runs
-        uses: Mattraks/delete-workflow-runs@main
-        with:
-          token: ${{ github.token }}
-          repository: ${{ github.repository }}
-          retain_days: ${{ github.event.inputs.days }}
-          keep_minimum_runs: 10

From caa164005789da8363a31af9e00dd897295a291d Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:18:27 +0200
Subject: [PATCH 05/19] ci: fix matrix definitions

---
 .github/workflows/npm-script.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/npm-script.yml b/.github/workflows/npm-script.yml
index 82379f81e7..8c17439813 100644
--- a/.github/workflows/npm-script.yml
+++ b/.github/workflows/npm-script.yml
@@ -51,9 +51,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node_version: ${{ needs.resolve_inputs.outputs.nodeVersions && fromJson(needs.resolve_inputs.outputs.nodeVersions) || 'lts/*' }}
-        os: ${{ needs.resolve_inputs.outputs.os && fromJson(needs.resolve_inputs.outputs.os) || 'ubuntu-latest' }}
-        browser: ${{ needs.resolve_inputs.outputs.browsers && fromJson(needs.resolve_inputs.outputs.browsers) }}
+        node_version: ${{ fromJson(needs.resolve_inputs.outputs.nodeVersions || '["lts/*"]') }}
+        os: ${{ fromJson(needs.resolve_inputs.outputs.os || '["ubuntu-latest"]') }}
+        browser: ${{ fromJson(needs.resolve_inputs.outputs.browsers || '[]') }}
     steps:
       - uses: actions/checkout@v4
         with:

From 3544febe8c5f769a29847855c753427532cd4d86 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:19:24 +0200
Subject: [PATCH 06/19] ci: fix matrix definitions, take 2

---
 .github/workflows/npm-script.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/npm-script.yml b/.github/workflows/npm-script.yml
index 8c17439813..495bcd427c 100644
--- a/.github/workflows/npm-script.yml
+++ b/.github/workflows/npm-script.yml
@@ -53,7 +53,7 @@ jobs:
       matrix:
         node_version: ${{ fromJson(needs.resolve_inputs.outputs.nodeVersions || '["lts/*"]') }}
         os: ${{ fromJson(needs.resolve_inputs.outputs.os || '["ubuntu-latest"]') }}
-        browser: ${{ fromJson(needs.resolve_inputs.outputs.browsers || '[]') }}
+        browser: ${{ fromJson(needs.resolve_inputs.outputs.browsers || '[""]') }}
     steps:
       - uses: actions/checkout@v4
         with:

From 00e7681d329ed1270b2a49c74c26ebe091fb9c07 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:23:40 +0200
Subject: [PATCH 07/19] ci: ensure they all scripts can use `npm run`

See also #5128
---
 .github/workflows/mocha.yml      | 4 ++--
 .github/workflows/npm-script.yml | 2 +-
 package.json                     | 1 +
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 03fe0a0dd8..847d0032b6 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -29,7 +29,7 @@ jobs:
     uses: ./.github/workflows/npm-script.yml
     with:
       browsers: ChromeHeadless
-      npm-script: test.browser
+      npm-script: test:browser
 
   test-browser-saucelabs:
     # Don't run forked 'pull_request' without saucelabs token
@@ -41,7 +41,7 @@ jobs:
     secrets: inherit
     with:
       browsers: 'firefox@latest,chrome@latest,MicrosoftEdge@latest,safari@latest'
-      npm-script: test.browser
+      npm-script: test:browser
 
   test-node:
     name: 'Node.js [v${{ matrix.node }} / ${{ matrix.os }}]'
diff --git a/.github/workflows/npm-script.yml b/.github/workflows/npm-script.yml
index 495bcd427c..dc78823f21 100644
--- a/.github/workflows/npm-script.yml
+++ b/.github/workflows/npm-script.yml
@@ -63,7 +63,7 @@ jobs:
           node-version: ${{ matrix.node_version }}
           cache: 'npm'
       - run: npm ci --ignore-scripts
-      - run: npm start ${{ inputs.npm-script }}
+      - run: npm run ${{ inputs.npm-script }}
         env:
           BROWSER: ${{ matrix.browser }}
           SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
diff --git a/package.json b/package.json
index 887c775a5e..8904232dbc 100644
--- a/package.json
+++ b/package.json
@@ -48,6 +48,7 @@
     "start": "nps",
     "test": "nps test",
     "version": "nps version",
+    "test:browser": "nps test.browser",
     "test:smoke": "node ./bin/mocha --no-config test/smoke/smoke.spec.js"
   },
   "dependencies": {

From 4621ada44570af30a885aacf1353e17be780296f Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:27:44 +0200
Subject: [PATCH 08/19] ci: add node 22 to `test-node`

---
 .github/workflows/mocha.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 847d0032b6..4df5443c62 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -59,6 +59,7 @@ jobs:
           - 16
           - 18
           - 20
+          - 22
         include:
           - os: ubuntu-latest
             node: 16

From 70f580d664f16471fbc5cc52d73b8c317e8cc88b Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:28:06 +0200
Subject: [PATCH 09/19] ci: have the coverage run always happen on `lts/*`

---
 .github/workflows/mocha.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 4df5443c62..855fa8784e 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -62,7 +62,7 @@ jobs:
           - 22
         include:
           - os: ubuntu-latest
-            node: 16
+            node: lts/*
             env:
               COVERAGE: 1
     steps:

From 94886ffd8b8cc90fbcb1b581a21e8391f1f82331 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:33:46 +0200
Subject: [PATCH 10/19] ci: set permissions

---
 .github/workflows/mocha.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 855fa8784e..f95ce64437 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -11,6 +11,9 @@ on:
     types: [opened, synchronize, reopened]
     paths-ignore: ['*.md', 'docs/**']
 
+permissions:
+  contents: read
+
 jobs:
   smoke:
     uses: ./.github/workflows/npm-script.yml

From 68c039180dd4a0a699dc0d3380dbc59267103a92 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:43:36 +0200
Subject: [PATCH 11/19] ci: lock down all non-github actions by hash

---
 .github/workflows/browser-test.yml        | 2 +-
 .github/workflows/compliance.yml          | 2 +-
 .github/workflows/mocha.yml               | 2 +-
 .github/workflows/nightly-site-deploy.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/browser-test.yml b/.github/workflows/browser-test.yml
index d662700a62..54bbc6b2db 100644
--- a/.github/workflows/browser-test.yml
+++ b/.github/workflows/browser-test.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: remove 'run-browser-test' label
-        uses: buildsville/add-remove-label@v2.0.1
+        uses: buildsville/add-remove-label@ac59c9f
         with:
           token: ${{secrets.GITHUB_TOKEN}}
           label: run-browser-test
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index 99afe754fa..c6933c49d5 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -2,7 +2,7 @@ jobs:
   compliance:
     runs-on: ubuntu-latest
     steps:
-      - uses: mtfoley/pr-compliance-action@main
+      - uses: mtfoley/pr-compliance-action@11b664f
         with:
           body-auto-close: false
           ignore-team-members: false
diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index f95ce64437..436ca5998d 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -92,6 +92,6 @@ jobs:
         run: npm start coverage-report-lcov
       - name: Upload Coverage to Coveralls (Linux + Node.js latest)
         if: ${{ matrix.env.COVERAGE }}
-        uses: coverallsapp/github-action@master
+        uses: coverallsapp/github-action@643bc37
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
diff --git a/.github/workflows/nightly-site-deploy.yml b/.github/workflows/nightly-site-deploy.yml
index bd1ac0e3af..fd6c0e3bf4 100644
--- a/.github/workflows/nightly-site-deploy.yml
+++ b/.github/workflows/nightly-site-deploy.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Webhook Action
-        uses: joelwmale/webhook-action@2.3.2
+        uses: joelwmale/webhook-action@448a17b
         env:
           data: ''
           WEBHOOK_URL: ${{ secrets.NETLIFY_NIGHTLY_DEPLOY_URL }}

From efa597d0a7f8f173d3ddbb6d80471e0912d48b27 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:56:04 +0200
Subject: [PATCH 12/19] ci: use reusable workflow for full tests as well

---
 .github/workflows/mocha.yml      | 54 +++++---------------------------
 .github/workflows/npm-script.yml | 27 ++++++++++++++--
 package.json                     |  1 +
 3 files changed, 33 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 436ca5998d..76e8d18a91 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -47,51 +47,11 @@ jobs:
       npm-script: test:browser
 
   test-node:
-    name: 'Node.js [v${{ matrix.node }} / ${{ matrix.os }}]'
+    # TODO: Restore "mocha-github-actions-reporter" style reporting without relying on third party module
+    uses: ./.github/workflows/npm-script.yml
     needs: smoke
-    runs-on: '${{ matrix.os }}'
-    env:
-      NODE_OPTIONS: '--trace-warnings'
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-2019
-        node:
-          - 14
-          - 16
-          - 18
-          - 20
-          - 22
-        include:
-          - os: ubuntu-latest
-            node: lts/*
-            env:
-              COVERAGE: 1
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '${{ matrix.node }}'
-          cache: 'npm'
-      - name: Install Dependencies
-        run: npm ci --ignore-scripts
-      - name: Install Annotation Support
-        run: npm install mocha-github-actions-reporter
-      - name: Run All Node.js Tests
-        run: npm start test.node
-        env:
-          COVERAGE: '${{ matrix.env.COVERAGE }}'
-          MOCHA_REPORTER: mocha-github-actions-reporter
-          # this is so mocha-github-actions-reporter can find mocha
-          NODE_PATH: lib
-      - name: Generate Coverage Report (Linux + Node.js latest)
-        if: ${{ matrix.env.COVERAGE }}
-        run: npm start coverage-report-lcov
-      - name: Upload Coverage to Coveralls (Linux + Node.js latest)
-        if: ${{ matrix.env.COVERAGE }}
-        uses: coverallsapp/github-action@643bc37
-        with:
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
+    with:
+      os: 'ubuntu-latest,windows-2019'
+      node-versions: '14,16,18,20,22'
+      npm-script: test:node
+      coverage: true
diff --git a/.github/workflows/npm-script.yml b/.github/workflows/npm-script.yml
index dc78823f21..9f2aaf451a 100644
--- a/.github/workflows/npm-script.yml
+++ b/.github/workflows/npm-script.yml
@@ -19,6 +19,10 @@ on:
         description: 'A comma separated list of operating systems to test on.'
         required: false
         type: string
+      coverage:
+        description: 'Whether to set up coverage reporting or not'
+        required: false
+        type: boolean
 
 permissions:
   contents: read
@@ -43,7 +47,7 @@ jobs:
         run: echo "splitted=$(echo '${{ inputs.os }}' | jq -R -c 'split(",")')" >> $GITHUB_OUTPUT
 
   script:
-    name: ${{ needs.resolve_inputs.outputs.browsers && format('[{0}]', matrix.browser) }}${{ inputs.npm-script }}${{ needs.resolve_inputs.outputs.nodeVersions && format(' with node.js {0}', matrix.node_version) }}${{ needs.resolve_inputs.outputs.os && format(' on {0}', matrix.os) }}
+    name: ${{ inputs.npm-script }}${{ needs.resolve_inputs.outputs.browsers && format('[{0}]', matrix.browser) }}${{ needs.resolve_inputs.outputs.nodeVersions && format(' with node.js {0}', matrix.node_version) }}${{ needs.resolve_inputs.outputs.os && format(' on {0}', matrix.os) }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
     needs:
@@ -66,7 +70,26 @@ jobs:
       - run: npm run ${{ inputs.npm-script }}
         env:
           BROWSER: ${{ matrix.browser }}
+          COVERAGE: ${{ inputs.coverage && '1'}}
+          NODE_OPTIONS: '--trace-warnings'
           SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
           SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+      - name: Generate coverage report
+        if: always() && inputs.coverage
+        run: npx --no nyc report --reporter=lcov
+      - name: Coveralls Parallel
+        if: always() && inputs.coverage
+        uses: coverallsapp/github-action@v2
+        with:
+          flag-name: run-${{ join(matrix.*, '-') }}
+          parallel: true
 
-
+  upload-coverage:
+    needs: script
+    if: always() && inputs.coverage
+    runs-on: ubuntu-latest
+    steps:
+    - name: Coveralls Finished
+      uses: coverallsapp/github-action@v2
+      with:
+        parallel-finished: true
diff --git a/package.json b/package.json
index 8904232dbc..064caa5c20 100644
--- a/package.json
+++ b/package.json
@@ -49,6 +49,7 @@
     "test": "nps test",
     "version": "nps version",
     "test:browser": "nps test.browser",
+    "test:node": "nps test.node",
     "test:smoke": "node ./bin/mocha --no-config test/smoke/smoke.spec.js"
   },
   "dependencies": {

From 8af936e90c3a8afa1b114e0085f18fa37932f30b Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:57:44 +0200
Subject: [PATCH 13/19] ci: remove redundant activity types

---
 .github/workflows/mocha.yml | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 76e8d18a91..56aa4cfe44 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -8,13 +8,17 @@ on:
   pull_request:
     branches:
       - main
-    types: [opened, synchronize, reopened]
     paths-ignore: ['*.md', 'docs/**']
 
 permissions:
   contents: read
 
 jobs:
+  lint:
+    uses: ./.github/workflows/npm-script.yml
+    with:
+      npm-script: lint
+
   smoke:
     uses: ./.github/workflows/npm-script.yml
     with:
@@ -22,10 +26,15 @@ jobs:
       node-versions: '14,16,18,20,22'
       npm-script: test:smoke
 
-  lint:
+  test-node:
+    # TODO: Restore "mocha-github-actions-reporter" style reporting without relying on third party module
     uses: ./.github/workflows/npm-script.yml
+    needs: smoke
     with:
-      npm-script: lint
+      os: 'ubuntu-latest,windows-2019'
+      node-versions: '14,16,18,20,22'
+      npm-script: test:node
+      coverage: true
 
   test-browser-local:
     needs: smoke
@@ -45,13 +54,3 @@ jobs:
     with:
       browsers: 'firefox@latest,chrome@latest,MicrosoftEdge@latest,safari@latest'
       npm-script: test:browser
-
-  test-node:
-    # TODO: Restore "mocha-github-actions-reporter" style reporting without relying on third party module
-    uses: ./.github/workflows/npm-script.yml
-    needs: smoke
-    with:
-      os: 'ubuntu-latest,windows-2019'
-      node-versions: '14,16,18,20,22'
-      npm-script: test:node
-      coverage: true

From 69b1340fe3faa4ea022f50e2f24043885a09854b Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 00:58:33 +0200
Subject: [PATCH 14/19] ci: add one more permissions

---
 .github/workflows/nightly-site-deploy.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/nightly-site-deploy.yml b/.github/workflows/nightly-site-deploy.yml
index fd6c0e3bf4..706836b277 100644
--- a/.github/workflows/nightly-site-deploy.yml
+++ b/.github/workflows/nightly-site-deploy.yml
@@ -2,9 +2,14 @@
 # This updates the list of supporters
 
 name: Nightly mochajs.org Deploy
+
 on:
   schedule:
     - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest

From 939a6cc1b4571f02eb7201cafae8f9fcf7c0d592 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 01:00:06 +0200
Subject: [PATCH 15/19] ci: use full sha hashes for third party workflows

---
 .github/workflows/browser-test.yml        | 2 +-
 .github/workflows/compliance.yml          | 2 +-
 .github/workflows/nightly-site-deploy.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/browser-test.yml b/.github/workflows/browser-test.yml
index 54bbc6b2db..9e7db64ee7 100644
--- a/.github/workflows/browser-test.yml
+++ b/.github/workflows/browser-test.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: remove 'run-browser-test' label
-        uses: buildsville/add-remove-label@ac59c9f
+        uses: buildsville/add-remove-label@ac59c9f0aeb66eb12d6366eb1d69ec1906e9ef9a
         with:
           token: ${{secrets.GITHUB_TOKEN}}
           label: run-browser-test
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index c6933c49d5..cf346a3898 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -2,7 +2,7 @@ jobs:
   compliance:
     runs-on: ubuntu-latest
     steps:
-      - uses: mtfoley/pr-compliance-action@11b664f
+      - uses: mtfoley/pr-compliance-action@11b664f0fcf2c4ce954f05ccfcaab6e52b529f86
         with:
           body-auto-close: false
           ignore-team-members: false
diff --git a/.github/workflows/nightly-site-deploy.yml b/.github/workflows/nightly-site-deploy.yml
index 706836b277..f81d2fc814 100644
--- a/.github/workflows/nightly-site-deploy.yml
+++ b/.github/workflows/nightly-site-deploy.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Webhook Action
-        uses: joelwmale/webhook-action@448a17b
+        uses: joelwmale/webhook-action@448a17bf857ead98546cfbdbe3b9d4cf979dda95
         env:
           data: ''
           WEBHOOK_URL: ${{ secrets.NETLIFY_NIGHTLY_DEPLOY_URL }}

From 10eb758279938f909d706e1235d11627fcd32fc1 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 01:03:47 +0200
Subject: [PATCH 16/19] ci: be consistent in naming

---
 .github/workflows/npm-script.yml | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/npm-script.yml b/.github/workflows/npm-script.yml
index 9f2aaf451a..f29db9224c 100644
--- a/.github/workflows/npm-script.yml
+++ b/.github/workflows/npm-script.yml
@@ -28,8 +28,7 @@ permissions:
   contents: read
 
 jobs:
-  resolve_inputs:
-    name: Resolving inputs
+  resolve-inputs:
     runs-on: ubuntu-latest
     outputs:
       browsers: ${{ steps.split-browsers.outputs.splitted }}
@@ -47,17 +46,17 @@ jobs:
         run: echo "splitted=$(echo '${{ inputs.os }}' | jq -R -c 'split(",")')" >> $GITHUB_OUTPUT
 
   script:
-    name: ${{ inputs.npm-script }}${{ needs.resolve_inputs.outputs.browsers && format('[{0}]', matrix.browser) }}${{ needs.resolve_inputs.outputs.nodeVersions && format(' with node.js {0}', matrix.node_version) }}${{ needs.resolve_inputs.outputs.os && format(' on {0}', matrix.os) }}
+    name: ${{ inputs.npm-script }}${{ needs.resolve-inputs.outputs.browsers && format('[{0}]', matrix.browser) }}${{ needs.resolve-inputs.outputs.nodeVersions && format(' with node.js {0}', matrix.node_version) }}${{ needs.resolve-inputs.outputs.os && format(' on {0}', matrix.os) }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
     needs:
-      - resolve_inputs
+      - resolve-inputs
     strategy:
       fail-fast: false
       matrix:
-        node_version: ${{ fromJson(needs.resolve_inputs.outputs.nodeVersions || '["lts/*"]') }}
-        os: ${{ fromJson(needs.resolve_inputs.outputs.os || '["ubuntu-latest"]') }}
-        browser: ${{ fromJson(needs.resolve_inputs.outputs.browsers || '[""]') }}
+        node_version: ${{ fromJson(needs.resolve-inputs.outputs.nodeVersions || '["lts/*"]') }}
+        os: ${{ fromJson(needs.resolve-inputs.outputs.os || '["ubuntu-latest"]') }}
+        browser: ${{ fromJson(needs.resolve-inputs.outputs.browsers || '[""]') }}
     steps:
       - uses: actions/checkout@v4
         with:

From e769953966c9acdf8256c32a3554c25c997dc897 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 01:06:18 +0200
Subject: [PATCH 17/19] ci: generate the coverage report using nps for now

See #5126
---
 .github/workflows/npm-script.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/npm-script.yml b/.github/workflows/npm-script.yml
index f29db9224c..bed511cf60 100644
--- a/.github/workflows/npm-script.yml
+++ b/.github/workflows/npm-script.yml
@@ -75,7 +75,7 @@ jobs:
           SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
       - name: Generate coverage report
         if: always() && inputs.coverage
-        run: npx --no nyc report --reporter=lcov
+        run: npm start coverage-report-lcov
       - name: Coveralls Parallel
         if: always() && inputs.coverage
         uses: coverallsapp/github-action@v2

From d7078843732e2e939a9aeee1c6ce5dc6ce6510e5 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 16:01:10 +0200
Subject: [PATCH 18/19] ci: parallelize, run local browser test right away

---
 .github/workflows/mocha.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 56aa4cfe44..8609839f3f 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -37,7 +37,6 @@ jobs:
       coverage: true
 
   test-browser-local:
-    needs: smoke
     uses: ./.github/workflows/npm-script.yml
     with:
       browsers: ChromeHeadless
@@ -47,6 +46,7 @@ jobs:
     # Don't run forked 'pull_request' without saucelabs token
     if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
     needs:
+      - lint
       - smoke
       - test-browser-local
     uses: ./.github/workflows/npm-script.yml

From 3b5845ffb11846789ba75d75d49601bb6cfbd238 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Tue, 16 Jul 2024 16:12:50 +0200
Subject: [PATCH 19/19] ci: disable saucelabs for now, too noisy

---
 .github/workflows/mocha.yml | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/mocha.yml b/.github/workflows/mocha.yml
index 8609839f3f..3897f1dac2 100644
--- a/.github/workflows/mocha.yml
+++ b/.github/workflows/mocha.yml
@@ -42,15 +42,15 @@ jobs:
       browsers: ChromeHeadless
       npm-script: test:browser
 
-  test-browser-saucelabs:
-    # Don't run forked 'pull_request' without saucelabs token
-    if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
-    needs:
-      - lint
-      - smoke
-      - test-browser-local
-    uses: ./.github/workflows/npm-script.yml
-    secrets: inherit
-    with:
-      browsers: 'firefox@latest,chrome@latest,MicrosoftEdge@latest,safari@latest'
-      npm-script: test:browser
+  # test-browser-saucelabs:
+  #   # Don't run forked 'pull_request' without saucelabs token
+  #   if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
+  #   needs:
+  #     - lint
+  #     - smoke
+  #     - test-browser-local
+  #   uses: ./.github/workflows/npm-script.yml
+  #   secrets: inherit
+  #   with:
+  #     browsers: 'firefox@latest,chrome@latest,MicrosoftEdge@latest,safari@latest'
+  #     npm-script: test:browser