feat: add npm package provenance

Ref: https://github.blog/2023-04-19-introducing-npm-package-provenance/

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 <!-- Please first discuss the change you wish to make via issue before making a change. It might avoid a waste of your time. -->
 
-## What changes this PR introduce?
+# What changes this PR introduce?
 
 ## List any relevant issue numbers
 

.github/workflows/lint.yml

@@ -10,16 +10,16 @@ jobs:
   lint:
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: 'actions/checkout@v3.0.0'
+      - uses: 'actions/checkout@v3.5.2'
 
-      - name: 'Use Node.js'
+      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v3.1.0'
+        uses: 'actions/setup-node@v3.6.0'
         with:
           node-version: 'lts/*'
           cache: 'npm'
 
-      - name: 'Install'
+      - name: 'Install dependencies'
-        run: 'npm install'
+        run: 'npm clean-install'
 
       - run: 'npm run lint:commit -- --to "${{ github.sha }}"'
       - run: 'npm run lint:editorconfig'

.github/workflows/release.yml

@@ -7,20 +7,28 @@ on:
 jobs:
   release:
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      issues: 'write'
+      pull-requests: 'write'
+      id-token: 'write'
     steps:
-      - uses: 'actions/checkout@v3.0.0'
+      - uses: 'actions/checkout@v3.5.2'
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: 'Use Node.js'
+      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v3.1.0'
+        uses: 'actions/setup-node@v3.6.0'
         with:
           node-version: 'lts/*'
           cache: 'npm'
 
-      - name: 'Install'
+      - name: 'Install dependencies'
-        run: 'npm install'
+        run: 'npm clean-install'
+
+      - name: 'Verify the integrity of provenance attestations and registry signatures for installed dependencies'
+        run: 'npm audit signatures'
 
       - name: 'Release'
         run: 'npm run release'

.github/workflows/test.yml

@@ -10,16 +10,16 @@ jobs:
   test:
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: 'actions/checkout@v3.0.0'
+      - uses: 'actions/checkout@v3.5.2'
 
-      - name: 'Use Node.js'
+      - name: 'Setup Node.js'
-        uses: 'actions/setup-node@v3.1.0'
+        uses: 'actions/setup-node@v3.6.0'
         with:
           node-version: 'lts/*'
           cache: 'npm'
 
-      - name: 'Install'
+      - name: 'Install dependencies'
-        run: 'npm install'
+        run: 'npm clean-install'
 
       - name: 'Test'
         run: 'npm run test'

.markdownlint-cli2.jsonc

@@ -1,4 +1,10 @@
 {
+  "config": {
+    "extends": "markdownlint/style/prettier",
+    "relative-links": true,
+    "default": true,
+    "MD033": false
+  },
   "globs": ["**/*.{md,mdx}"],
   "ignores": ["**/node_modules", "**/test/fixtures"],
   "customRules": ["./src/index.js"]

.markdownlint.json

@@ -1,8 +0,0 @@
-{
-  "default": true,
-  "relative-links": true,
-  "extends": "markdownlint/style/prettier",
-  "MD024": false,
-  "MD033": false,
-  "MD041": false
-}

.npmrc

@@ -1 +1,2 @@
 save-exact=true
+provenance=true

CODE_OF_CONDUCT.md

@@ -60,7 +60,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
-contact@divlo.fr.
+<contact@divlo.fr>.
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

CONTRIBUTING.md

@@ -2,6 +2,14 @@
 
 Thanks a lot for your interest in contributing to **markdownlint-rule-relative-links**! 🎉
 
+## Code of Conduct
+
+**markdownlint-rule-relative-links** adopted the [Contributor Covenant](https://www.contributor-covenant.org/) as its Code of Conduct, and we expect project participants to adhere to it. Please read [the full text](./CODE_OF_CONDUCT.md) so that you can understand what actions will and will not be tolerated.
+
+## Open Development
+
+All work on **markdownlint-rule-relative-links** happens directly on this repository. Both core team members and external contributors send pull requests which go through the same review process.
+
 ## Types of contributions
 
 - Reporting a bug.
@@ -21,26 +29,4 @@ If you're adding new features to **markdownlint-rule-relative-links**, please in
 
 ## Commits
 
-The commit message guidelines respect [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/master/%40commitlint/config-conventional) and [Semantic Versioning](https://semver.org/) for releases.
+The commit message guidelines adheres to [Conventional Commits](https://www.conventionalcommits.org/) and [Semantic Versioning](https://semver.org/) for releases.
-
-### Types
-
-Types define which kind of changes you made to the project.
-
-| Types    | Description                                                                                                  |
-| -------- | ------------------------------------------------------------------------------------------------------------ |
-| feat     | A new feature.                                                                                               |
-| fix      | A bug fix.                                                                                                   |
-| docs     | Documentation only changes.                                                                                  |
-| style    | Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc).      |
-| refactor | A code change that neither fixes a bug nor adds a feature.                                                   |
-| perf     | A code change that improves performance.                                                                     |
-| test     | Adding missing tests or correcting existing tests.                                                           |
-| build    | Changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm).         |
-| ci       | Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs). |
-| chore    | Other changes that don't modify src or test files.                                                           |
-| revert   | Reverts a previous commit.                                                                                   |
-
-### Scopes
-
-Scopes define what part of the code changed.

README.md

@@ -4,15 +4,13 @@
   <strong>Custom rule for <a href="https://github.com/DavidAnson/markdownlint">markdownlint</a> to validate relative links.</strong>
 </p>
 
-</p>
-
 <p align="center">
   <a href="./CONTRIBUTING.md"><img src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat" /></a>
   <a href="./LICENSE"><img src="https://img.shields.io/badge/licence-MIT-blue.svg" alt="Licence MIT"/></a>
   <a href="./CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-v2.0%20adopted-ff69b4.svg" alt="Contributor Covenant" /></a>
   <br />
   <a href="https://github.com/Divlo/markdownlint-rule-relative-links/actions/workflows/lint.yml"><img src="https://github.com/Divlo/markdownlint-rule-relative-links/actions/workflows/lint.yml/badge.svg?branch=develop" /></a>
-  <a href="https://github.com/Divlo/emarkdownlint-rule-relative-linksactions/workflows/test.yml"><img src="https://github.com/Divlo/markdownlint-rule-relative-links/actions/workflows/test.yml/badge.svg?branch=develop" /></a>
+  <a href="https://github.com/Divlo/markdownlint-rule-relative-linksactions/workflows/test.yml"><img src="https://github.com/Divlo/markdownlint-rule-relative-links/actions/workflows/test.yml/badge.svg?branch=develop" /></a>
   <br />
   <a href="https://conventionalcommits.org"><img src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg" alt="Conventional Commits" /></a>
   <a href="https://github.com/semantic-release/semantic-release"><img src="https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg" alt="semantic-release" /></a>
@@ -23,9 +21,32 @@
 
 **markdownlint-rule-relative-links** is a [markdownlint](https://github.com/DavidAnson/markdownlint) custom rule to validate relative links.
 
-It ensures that relative links that start with `./` or `../` (or not starting with external protocols like `http://` or `https://`) are working and not "dead" which means that it exists in the file system of the project that uses `markdownlint`.
+It ensures that relative links (using `file:` protocol) are working and not "dead" which means that it exists in the file system of the project that uses [markdownlint](https://github.com/DavidAnson/markdownlint).
 
-Related links:
+### Example
+
+File structure:
+
+```txt
+├── abc.txt
+└── awesome.md
+```
+
+With `awesome.md` content:
+
+```md
+[abc](./abc.txt)
+
+[Dead link](./dead.txt)
+```
+
+Running [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) with `markdownlint-rule-relative-links` will output:
+
+```sh
+awesome.md:3 relative-links Relative links should be valid [Link "./dead.txt" is dead]
+```
+
+### Related links
 
 - [DavidAnson/markdownlint#253](https://github.com/DavidAnson/markdownlint/issues/253)
 - [DavidAnson/markdownlint#121](https://github.com/DavidAnson/markdownlint/issues/121)
@@ -43,9 +64,9 @@ npm install --save-dev markdownlint-rule-relative-links
 
 ## Configuration
 
-There are various ways `markdownlint` can be configured using objects, config files etc. For more information on `markdownlint` configuration refer [options.config](https://github.com/DavidAnson/markdownlint#optionsconfig).
+There are various ways [markdownlint](https://github.com/DavidAnson/markdownlint) can be configured using objects, config files etc. For more information on configuration refer to [options.config](https://github.com/DavidAnson/markdownlint#optionsconfig).
 
-We recommend configuring `markdownlint-cli2` over `markdownlint-cli` for compatibility with the `vscode-markdownlint` plugin.
+We recommend configuring [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) over [markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli) for compatibility with the [vscode-markdownlint](https://github.com/DavidAnson/vscode-markdownlint) extension.
 
 `.markdownlint-cli2.jsonc`
 

package.json

@@ -21,15 +21,19 @@
   "files": [
     "src"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "engines": {
     "node": ">=16.0.0",
-    "npm": ">=8.0.0"
+    "npm": ">=9.0.0"
   },
   "scripts": {
     "lint:commit": "commitlint",
     "lint:editorconfig": "editorconfig-checker",
     "lint:markdown": "markdownlint-cli2",
-    "lint:eslint": "eslint \"**/*.{js,jsx,ts,tsx}\" --ignore-path \".gitignore\"",
+    "lint:eslint": "eslint \".\" --ignore-path \".gitignore\"",
     "lint:prettier": "prettier \".\" --check --ignore-path \".gitignore\"",
     "lint:staged": "lint-staged",
     "test": "tap",
@@ -39,24 +43,24 @@
     "postpublish": "pinst --enable"
   },
   "devDependencies": {
-    "@commitlint/cli": "17.3.0",
+    "@commitlint/cli": "17.6.3",
-    "@commitlint/config-conventional": "17.3.0",
+    "@commitlint/config-conventional": "17.6.3",
-    "@types/tap": "15.0.7",
+    "@types/tap": "15.0.8",
-    "editorconfig-checker": "4.0.2",
+    "editorconfig-checker": "5.0.1",
-    "eslint": "8.31.0",
+    "eslint": "8.40.0",
-    "eslint-config-conventions": "6.0.0",
+    "eslint-config-conventions": "9.0.0",
-    "eslint-config-prettier": "8.5.0",
+    "eslint-config-prettier": "8.8.0",
-    "eslint-plugin-import": "2.26.0",
+    "eslint-plugin-import": "2.27.5",
     "eslint-plugin-prettier": "4.2.1",
     "eslint-plugin-promise": "6.1.1",
-    "eslint-plugin-unicorn": "45.0.2",
+    "eslint-plugin-unicorn": "47.0.0",
-    "husky": "8.0.2",
+    "husky": "8.0.3",
-    "lint-staged": "13.1.0",
+    "lint-staged": "13.2.2",
-    "markdownlint": "0.27.0",
+    "markdownlint": "0.28.2",
-    "markdownlint-cli2": "0.6.0",
+    "markdownlint-cli2": "0.7.1",
     "pinst": "3.0.0",
-    "prettier": "2.8.1",
+    "prettier": "2.8.8",
-    "semantic-release": "19.0.5",
+    "semantic-release": "21.0.2",
-    "tap": "16.3.2"
+    "tap": "16.3.4"
   }
 }

src/index.js

@@ -40,14 +40,6 @@ const addError = (onError, lineNumber, detail, context, range, fixInfo) => {
   })
 }
 
-const EXTERNAL_PROTOCOLS = new Set([
-  'http:',
-  'https:',
-  'mailto:',
-  'tel:',
-  'ftp:'
-])
-
 const customRule = {
   names: ['relative-links'],
   description: 'Relative links should be valid',
@@ -56,23 +48,36 @@ const customRule = {
     filterTokens(params, 'inline', (token) => {
       token.children.forEach((child) => {
         const { lineNumber, type, attrs } = child
+
+        /** @type {string | null} */
+        let hrefSrc = null
+
         if (type === 'link_open') {
           attrs.forEach((attr) => {
             if (attr[0] === 'href') {
-              const href = attr[1]
+              hrefSrc = attr[1]
-              const url = new URL(href, pathToFileURL(params.name))
-              url.hash = ''
-              const isRelative =
-                href.startsWith('./') ||
-                href.startsWith('../') ||
-                !EXTERNAL_PROTOCOLS.has(url.protocol)
-              if (isRelative && !fs.existsSync(url.pathname)) {
-                const detail = `Link "${href}" is dead`
-                addError(onError, lineNumber, detail)
-              }
             }
           })
         }
+
+        if (type === 'image') {
+          attrs.forEach((attr) => {
+            if (attr[0] === 'src') {
+              hrefSrc = attr[1]
+            }
+          })
+        }
+
+        if (hrefSrc != null) {
+          const url = new URL(hrefSrc, pathToFileURL(params.name))
+          url.hash = ''
+          const isRelative =
+            url.protocol === 'file:' && !hrefSrc.startsWith('/')
+          if (isRelative && !fs.existsSync(url)) {
+            const detail = `Link "${hrefSrc}" is dead`
+            addError(onError, lineNumber, detail)
+          }
+        }
       })
     })
   }

test/basic.test.js

@@ -12,13 +12,23 @@ tap.test('ensure we validate correctly', async (t) => {
     customRules: [relativeLinks]
   })
   t.equal(lintResults['test/fixtures/Valid.md'].length, 0)
-  t.equal(lintResults['test/fixtures/Invalid.md'].length, 1)
+  t.equal(lintResults['test/fixtures/Invalid.md'].length, 2)
+
   t.equal(
-    lintResults['test/fixtures/Invalid.md'][0].ruleDescription,
+    lintResults['test/fixtures/Invalid.md'][0]?.ruleDescription,
     'Relative links should be valid'
   )
   t.equal(
-    lintResults['test/fixtures/Invalid.md'][0].errorDetail,
+    lintResults['test/fixtures/Invalid.md'][0]?.errorDetail,
     'Link "./basic.test.js" is dead'
   )
+
+  t.equal(
+    lintResults['test/fixtures/Invalid.md'][1]?.ruleDescription,
+    'Relative links should be valid'
+  )
+  t.equal(
+    lintResults['test/fixtures/Invalid.md'][1]?.errorDetail,
+    'Link "../image.png" is dead'
+  )
 })

test/fixtures/Invalid.md

@@ -1,3 +1,5 @@
 # Invalid
 
 [basic.js](./basic.test.js)
+
+![Image](../image.png)

test/fixtures/Valid.md

@@ -1,3 +1,13 @@
 # Valid
 
 [basic.js](../basic.test.js)
+
+![Image](./image.png)
+
+![Absolute Path](/absolute/path.png)
+
+[External https link](https://example.com/)
+
+[External https link 2](https:./external.https)
+
+[External ftp link](ftp:./external.ftp)