From cf3c8aae2a94fab3d32d698fa6ec82f735415ec3 Mon Sep 17 00:00:00 2001
From: Kludex <marcelotryle@gmail.com>
Date: Sat, 24 Oct 2026 15:34:58 +0000
Subject: [PATCH] Resolve open code scanning alerts

- Reference the shared workflow with the self-repository `$/` syntax
  (zizmor self-repository)
- Move the prettier hook to the maintained rbubley/mirrors-prettier mirror,
  since pre-commit/mirrors-prettier is archived (zizmor archived-uses)
- Make the <script> extraction regex in the docs app test case-insensitive
  (CodeQL js/bad-tag-filter)
---
 .github/workflows/main.yml         | 2 +-
 .github/workflows/publish-pypi.yml | 2 +-
 .pre-commit-config.yaml            | 4 ++--
 tests/docs_src/test_apps.test.js   | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ea214bc852..45df5129a9 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   checks:
-    uses: ./.github/workflows/shared.yml
+    uses: $/.github/workflows/shared.yml
 
   all-green:
     if: always()
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 86b2aeab21..3f25d49f7b 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -38,7 +38,7 @@ jobs:
           path: dist/
 
   checks:
-    uses: ./.github/workflows/shared.yml
+    uses: $/.github/workflows/shared.yml
 
   pypi-publish:
     name: Upload release to PyPI
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 321b60bc52..94fc4cf152 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -6,8 +6,8 @@ repos:
     hooks:
       - id: end-of-file-fixer
 
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v3.1.0
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.9.10
     hooks:
       - id: prettier
         types_or: [yaml, json5]
diff --git a/tests/docs_src/test_apps.test.js b/tests/docs_src/test_apps.test.js
index 8529a88702..d76e7bebe9 100644
--- a/tests/docs_src/test_apps.test.js
+++ b/tests/docs_src/test_apps.test.js
@@ -15,7 +15,7 @@ for (const [name, file] of cases) {
     const source = readFileSync(path.join(root, file), "utf8");
     const html = source.match(/CLOCK_HTML = """([\s\S]*?)"""/)?.[1];
     assert.ok(html);
-    const script = html.match(/<script>([\s\S]*?)<\/script>/)?.[1];
+    const script = html.match(/<script>([\s\S]*?)<\/script>/i)?.[1];
     const result = { content: [{ type: "text", text: "2026-06-26T12:00:00Z" }] };
     assert.ok(script);
     const clock = { textContent: "..." };