Merge 0711a683bd into e2b2e56bd2

Safely handle odd chars in filenames
Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>
2026-03-20 02:14:10 +01:00 · 2025-10-30 14:50:00 +00:00 · 2025-10-30 15:49:58 +01:00 · 2025-10-30 15:44:56 +01:00 · 2025-10-30 15:43:51 +01:00 · 2025-10-30 15:43:25 +01:00
4 changed files with 15 additions and 14 deletions
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@ -12,6 +12,9 @@ jobs:
    defaults:
      run:
        working-directory: packages/npm
+    permissions:
+      contents: read
+      id-token: write
    steps:
      - name: 🧮 Checkout code
        uses: actions/checkout@v4
@ -23,6 +26,10 @@ jobs:
          cache-dependency-path: packages/npm/yarn.lock
          registry-url: "https://registry.npmjs.org"

+      # Ensure npm 11.5.1 or later is installed
+      - name: Update npm
+        run: npm install -g npm@latest
+
      - name: 🔨 Install dependencies
        run: "yarn install --frozen-lockfile"

@ -33,10 +40,4 @@ jobs:
          VERSION: ${{ github.event.release.tag_name }}.0

      - name: 🚀 Publish to npm
-        id: npm-publish
-        uses: JS-DevTools/npm-publish@19c28f1ef146469e409470805ea4279d47c3d35c # v3.1.1
-        with:
-          token: ${{ secrets.NPM_TOKEN }}
-          package: packages/npm
-          access: public
-          ignore-scripts: false
+        run: npm publish --provenance --access public --tag latest
--- a/changelogs/internal/newsfragments/2239.clarification
+++ b/changelogs/internal/newsfragments/2239.clarification
@ -0,0 +1 @@
+Use NPM Trusted Publishers for publishing `@matrix-org/spec` to npm.
--- a/content/olm-megolm/_index.md
+++ b/content/olm-megolm/_index.md
@ -4,9 +4,7 @@ weight: 61
 type: docs
 ---

-The Olm and Megolm cryptographic ratchets are not formally part
-of the Matrix specification. In lack of a better place, their
-specification is reproduced here, regardless.
+Matrix uses the Olm and Megolm cryptographic ratchets for [end-to-end encryption](../client-server-api/#end-to-end-encryption).

 -   [Olm: A Cryptographic Ratchet](/olm-megolm/olm/)
 -   [Megolm group ratchet](/olm-megolm/megolm/)
--- a/scripts/download-katex-assets.sh
+++ b/scripts/download-katex-assets.sh
@ -1,8 +1,9 @@
 #!/bin/bash
-
+#
+# Download the KaTeX fonts and CSS, and copy them into `static`.
 set -e

-root=$(git rev-parse --show-toplevel)
+root=$(dirname "$0")/..

 # Check that the caller supplied a version.
 version=$1
@ -35,6 +36,6 @@ install -vm644 "$tmp_dir/katex/katex.min.css" "$root/static/css/katex.min.css"

 # Remove any existing fonts and move the new ones into place.
 rm -rvf "$root"/static/css/fonts/KaTeX*
-while read -r file; do
+while IFS= read -r -d '' file; do
    install -vm644 "$file" "$root/static/css/fonts"
-done < <(find "$tmp_dir/katex/fonts" -maxdepth 1 -name "KaTeX*.woff2")
+done < <(find "$tmp_dir/katex/fonts" -maxdepth 1 -name "KaTeX*.woff2" -print0)
Author	SHA1	Message	Date
Johannes Marbach	eb2ef1ba93	Merge `0711a683bd` into `e2b2e56bd2`	2025-10-30 14:50:00 +00:00
Johannes Marbach	0711a683bd	Safely handle odd chars in filenames Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	2025-10-30 15:49:58 +01:00
Johannes Marbach	3fe74be1bd	Don't rely on git to find the root path Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	2025-10-30 15:44:56 +01:00
Johannes Marbach	4dc44c1021	Add header comment to document script Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	2025-10-30 15:43:51 +01:00
Johannes Marbach	9ca00d2119	Tweak index page text Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	2025-10-30 15:43:25 +01:00
Michael Telatynski	e2b2e56bd2	Use NPM Trusted Publishers over token (#2239 ) Some checks failed Spec / 🔎 Validate OpenAPI specifications (push) Has been cancelled Details Spec / 🔎 Check Event schema examples (push) Has been cancelled Details Spec / 🔎 Check OpenAPI definitions examples (push) Has been cancelled Details Spec / 🔎 Check JSON Schemas inline examples (push) Has been cancelled Details Spec / ⚙️ Calculate baseURL for later jobs (push) Has been cancelled Details Spec / 📢 Run towncrier for changelog (push) Has been cancelled Details Spell Check / Spell Check with Typos (push) Has been cancelled Details Spec / 🐍 Build OpenAPI definitions (push) Has been cancelled Details Spec / 📖 Build the spec (push) Has been cancelled Details Spec / 🔎 Validate generated HTML (push) Has been cancelled Details Spec / 📖 Build the historical backup spec (push) Has been cancelled Details * Use NPM Trusted Publishers over token due to security changes being enacted next month by npm * Add changelog entry * Update npm	2025-10-29 11:44:58 -06:00
				`@ -0,0 +1 @@`
				Use NPM Trusted Publishers for publishing `@matrix-org/spec` to npm.