fix(actions): avoid status event fan-out

ci(deps): bump actions/checkout from 6 to 7

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  # Monitor GitHub Actions dependencies
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "02:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "xixu-me"
+    assignees:
+      - "xixu-me"
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,202 @@
+name: Dependabot Auto Merge
+
+on:
+  check_suite:
+    types: [completed]
+  workflow_run:
+    workflows:
+      - "CodeQL"
+      - "Dependabot Updates"
+      - "The Workflow"
+    types:
+      - completed
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.run_id }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  checks: read
+  statuses: read
+
+jobs:
+  merge:
+    name: Auto-merge Dependabot PRs
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Merge Dependabot PRs when checks pass
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const successfulCheckConclusions = new Set(["success", "skipped", "neutral"]);
+            const successfulStatusStates = new Set(["success"]);
+            const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+            const latestBy = (items, keyOf, timeOf) => {
+              const latest = new Map();
+              for (const item of items) {
+                const key = keyOf(item);
+                const itemTime = new Date(timeOf(item) || 0).getTime();
+                const existing = latest.get(key);
+                const existingTime = existing ? new Date(timeOf(existing) || 0).getTime() : -1;
+                if (!existing || itemTime >= existingTime) {
+                  latest.set(key, item);
+                }
+              }
+              return [...latest.values()];
+            };
+
+            const findCandidatePulls = async () => {
+              const pulls = await github.paginate(github.rest.pulls.list, {
+                owner,
+                repo,
+                state: "open",
+                per_page: 100,
+              });
+            
+              return pulls.filter((pr) => pr.user?.login === "dependabot[bot]");
+            };
+            
+            const getMergeablePullRequest = async (pull_number) => {
+              for (let attempt = 1; attempt <= 6; attempt += 1) {
+                const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
+                if (pr.mergeable !== null) {
+                  return pr;
+                }
+                core.info("PR #" + pull_number + " mergeability is still being computed; retry " + attempt + "/6.");
+                await wait(5000);
+              }
+
+              const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
+              return pr;
+            };
+
+            const getSignalState = async (sha) => {
+              const checkRuns = await github.paginate(github.rest.checks.listForRef, {
+                owner,
+                repo,
+                ref: sha,
+                per_page: 100,
+              });
+
+              const statuses = await github.paginate(github.rest.repos.listCommitStatusesForRef, {
+                owner,
+                repo,
+                ref: sha,
+                per_page: 100,
+              });
+
+              const latestChecks = latestBy(
+                checkRuns.filter((run) => run.name !== "Dependabot Auto Merge"),
+                (run) => (run.app?.slug || "unknown") + ":" + run.name,
+                (run) => run.completed_at || run.started_at || run.created_at,
+              );
+              const latestStatuses = latestBy(statuses, (status) => status.context, (status) => status.updated_at || status.created_at);
+
+              const pendingChecks = latestChecks.filter((run) => run.status !== "completed");
+              const failedChecks = latestChecks.filter(
+                (run) => run.status === "completed" && !successfulCheckConclusions.has(String(run.conclusion || "").toLowerCase()),
+              );
+              const failedStatuses = latestStatuses.filter((status) => !successfulStatusStates.has(String(status.state || "").toLowerCase()));
+
+              return {
+                totalSignals: latestChecks.length + latestStatuses.length,
+                pendingChecks,
+                failedChecks,
+                failedStatuses,
+              };
+            };
+
+            const { data: repository } = await github.rest.repos.get({ owner, repo });
+            const mergeMethods = [];
+            if (repository.allow_merge_commit) mergeMethods.push("merge");
+            if (repository.allow_squash_merge) mergeMethods.push("squash");
+            if (repository.allow_rebase_merge) mergeMethods.push("rebase");
+
+            if (mergeMethods.length === 0) {
+              core.info("This repository has no enabled pull request merge methods.");
+              return;
+            }
+
+            const pulls = await findCandidatePulls();
+            if (pulls.length === 0) {
+              core.info("No open Dependabot PRs to evaluate.");
+              return;
+            }
+
+            for (const candidate of pulls) {
+              const pull_number = candidate.number;
+              const pr = await getMergeablePullRequest(pull_number);
+
+              if (pr.user?.login !== "dependabot[bot]") {
+                core.info("PR #" + pull_number + " is no longer a Dependabot PR.");
+                continue;
+              }
+
+              if (pr.state !== "open" || pr.draft) {
+                core.info("PR #" + pull_number + " is not an open, ready PR.");
+                continue;
+              }
+
+              if (pr.mergeable !== true) {
+                core.info("PR #" + pull_number + " is not currently mergeable.");
+                continue;
+              }
+
+              const signalState = await getSignalState(pr.head.sha);
+              if (signalState.totalSignals === 0) {
+                core.info("PR #" + pull_number + " has no checks or statuses yet; skipping.");
+                continue;
+              }
+
+              if (signalState.pendingChecks.length > 0) {
+                core.info("PR #" + pull_number + " still has pending checks: " + signalState.pendingChecks.map((run) => run.name).join(", ") + ".");
+                continue;
+              }
+
+              if (signalState.failedChecks.length > 0 || signalState.failedStatuses.length > 0) {
+                const failedChecks = signalState.failedChecks.map((run) => run.name + "=" + run.conclusion).join(", ");
+                const failedStatuses = signalState.failedStatuses.map((status) => status.context + "=" + status.state).join(", ");
+                core.info("PR #" + pull_number + " is not green. Checks: " + (failedChecks || "none") + ". Statuses: " + (failedStatuses || "none") + ".");
+                continue;
+              }
+
+              let merged = false;
+              let lastError = null;
+              for (const merge_method of mergeMethods) {
+                try {
+                  await github.rest.pulls.merge({ owner, repo, pull_number, merge_method });
+                  core.info("Merged Dependabot PR #" + pull_number + " with " + merge_method + ".");
+                  merged = true;
+                  break;
+                } catch (error) {
+                  lastError = error;
+                  if (error.status === 403 || error.status === 405 || error.status === 409) {
+                    core.info("Cannot merge PR #" + pull_number + " with " + merge_method + ": " + error.message);
+                    continue;
+                  }
+                  throw error;
+                }
+              }
+
+              if (!merged) {
+                core.info("PR #" + pull_number + " could not be merged: " + (lastError?.message || "unknown error") + ".");
+                continue;
+              }
+
+              if (pr.head.repo?.full_name === owner + "/" + repo) {
+                try {
+                  await github.rest.git.deleteRef({ owner, repo, ref: "heads/" + pr.head.ref });
+                  core.info("Deleted branch " + pr.head.ref + ".");
+                } catch (error) {
+                  core.info("Could not delete branch " + pr.head.ref + ": " + error.message);
+                }
+              }
+            }

.github/workflows/run.yml

@@ -13,18 +13,20 @@ on:
         default: "200000"
         type: string
 
-# Add permissions for the workflow
-permissions:
-  contents: write
-  actions: read
-
 env:
   # Default domain count (can be overridden by workflow input)
   DOMAIN_COUNT: ${{ github.event.inputs.domain_count || '200000' }}
 
+# Global permissions for the workflow
+permissions:
+  contents: write
+  actions: write
+
 jobs:
   validate-input:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Validate domain count input
         run: |
@@ -38,10 +40,13 @@ jobs:
   fetch-domain-list:
     runs-on: ubuntu-latest
     needs: validate-input
+    permissions:
+      contents: read
+      actions: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Fetch top domains from Cloudflare Radar API
         run: |
@@ -58,7 +63,7 @@ jobs:
           echo "Domain list processed. Total domains: $(wc -l < domains)"
 
       - name: Upload domain list as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: domain-list-artifact
           path: domains
@@ -67,13 +72,16 @@ jobs:
   process-favicons-and-release:
     runs-on: ubuntu-latest
     needs: fetch-domain-list
+    permissions:
+      contents: write
+      actions: read
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download domain list artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: domain-list-artifact
           path: .
@@ -95,9 +103,6 @@ jobs:
           success_count=0
           error_count=0
 
-          # Array to track used filenames for duplicate handling
-          declare -A filename_count
-
           # Read domains file line by line
           while IFS= read -r domain; do
             counter=$((counter + 1))
@@ -112,62 +117,47 @@ jobs:
               echo "Progress: $counter/$total_domains domains processed (Success: $success_count, Errors: $error_count)"
             fi
             
-            # Extract second-level domain (remove top-level domain)
-            # For example: google.com -> google, github.io -> github
-            second_level_domain=$(echo "$domain" | sed 's/\.[^.]*$//')
-            
-            # Handle duplicate filenames by adding sequential numbers
-            base_filename="$second_level_domain"
-            if [[ -n "${filename_count[$base_filename]}" ]]; then
-              # Increment count for this filename
-              filename_count[$base_filename]=$((filename_count[$base_filename] + 1))
-              final_filename="${base_filename}_${filename_count[$base_filename]}"
-            else
-              # First occurrence of this filename
-              filename_count[$base_filename]=0
-              final_filename="$base_filename"
-            fi
-            
             # Construct favicon URL
             favicon_url="https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=https://${domain}&size=256"
-            favicon_file="favicons/${final_filename}.png"
+            
+            # Temporarily use a temp file for download
+            temp_favicon_file="favicons/temp_favicon.png"
             
             # Download favicon with enhanced error handling and timeout
-            if timeout 15 curl -L -s -o "$favicon_file" "$favicon_url" --max-time 10 --retry 3 --retry-delay 1; then
+            if timeout 15 curl -L -s -o "$temp_favicon_file" "$favicon_url" --max-time 10 --retry 3 --retry-delay 1; then
               # Check if file was actually downloaded and has content
-              if [ -s "$favicon_file" ]; then
+              if [ -s "$temp_favicon_file" ]; then
                 # Calculate SHA-256 hash of the downloaded file
-                file_hash=$(sha256sum "$favicon_file" | cut -d' ' -f1)
+                file_hash=$(sha256sum "$temp_favicon_file" | cut -d' ' -f1)
                 
                 # Check if the hash matches the failure hash
                 if [ "$file_hash" = "59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64" ]; then
                   # This is a failed download (generic/default favicon)
-                  rm -f "$favicon_file"
+                  rm -f "$temp_favicon_file"
                   error_count=$((error_count + 1))
-                  echo "Warning: Generic favicon detected for domain: $domain (mapped to $final_filename) (SHA-256: $file_hash)"
+                  echo "Warning: Generic favicon detected for domain: $domain (SHA-256: $file_hash)"
                 else
+                  # Valid favicon downloaded - use domain as filename
+                  favicon_file="favicons/${domain}.png"
+                  mv "$temp_favicon_file" "$favicon_file"
+                  
                   # Valid favicon downloaded
                   success_count=$((success_count + 1))
-                  echo "Success: Downloaded favicon for $domain -> $final_filename.png"
+                  echo "Success: Downloaded favicon for $domain -> ${domain}.png"
                 fi
               else
                 # Remove empty file
-                rm -f "$favicon_file"
+                rm -f "$temp_favicon_file"
                 error_count=$((error_count + 1))
-                echo "Warning: Empty file for domain: $domain (mapped to $final_filename)"
+                echo "Warning: Empty file for domain: $domain"
               fi
             else
               # Remove any partial file
-              rm -f "$favicon_file"
+              rm -f "$temp_favicon_file"
               error_count=$((error_count + 1))
-              echo "Error: Failed to download favicon for domain: $domain (mapped to $final_filename)"
-            fi
-            
-            # Add high failure rate detection (stop if >80% failures after 100 domains)
-            if [ $counter -gt 100 ] && [ $((error_count * 100 / counter)) -gt 80 ]; then
-              echo "Error: High failure rate detected (${error_count}/${counter}). Stopping execution."
-              exit 1
+              echo "Error: Failed to download favicon for domain: $domain"
             fi
+
           done < domains
 
           echo "Favicon download completed!"
@@ -201,9 +191,9 @@ jobs:
             git push origin assets --force
           fi
 
-      - name: Install tzst compression tool
+      - name: Install tzst
         run: |
-          echo "Installing tzst compression tool..."
+          echo "Installing tzst..."
           pip install tzst
           tzst --version
 
@@ -231,7 +221,7 @@ jobs:
           echo "Generated release tag: $TAG"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           name: "Archive (Top ${{ env.DOMAIN_COUNT }}) - ${{ steps.tag.outputs.tag }}"

README.md

@@ -14,15 +14,21 @@ This repository hosts a collection of favicon images for the world's most popula
 
 ### Access Individual Favicons
 
-Individual favicons are stored in the `assets` branch and are named according to their second-level domain:
+Individual favicons are stored in the `assets` branch and are named according to their domain name:
 
-- `google.png` for google.com
-- `github.png` for github.com
+- `google.com.png` for google.com
+- `github.com.png` for github.com
 
 Access patterns:
 
 ```
-https://raw.githubusercontent.com/xixu-me/favicons/assets/DOMAIN_NAME.png
+https://raw.githubusercontent.com/xixu-me/favicons/refs/heads/assets/favicons/DOMAIN_NAME.png
+```
+
+For better performance and global availability, you can access the favicons through jsDelivr CDN:
+
+```
+https://cdn.jsdelivr.net/gh/xixu-me/favicons@refs/heads/assets/favicons/DOMAIN_NAME.png
 ```
 
 ### Download Compressed Archives
@@ -46,7 +52,7 @@ tzst x archive.tzst
 
 Archives are available with the following domain counts:
 
-- 200 (minimal)
+- 200
 - 500
 - 1,000
 - 2,000
@@ -56,8 +62,6 @@ Archives are available with the following domain counts:
 - 50,000
 - 100,000
 - 200,000
-- 500,000
-- 1,000,000 (complete set)
 
 ## Self-Build Instructions
 
@@ -110,15 +114,12 @@ You can modify the run.yml file to change:
 
 ### File Naming
 
-Favicons are named based on the second-level domain:
+Favicons are named using the domain name:
 
-- `example.com` → `example.png`
-- `subdomain.example.com` → `example.png`
+- `example.com` → `example.com.png`
+- `subdomain.example.com` → `subdomain.example.com.png`
 
-When duplicate second-level domains exist, sequential numbers are added:
-
-- First `github.io` domain → `github.png`
-- Second `github.io` domain → `github_1.png`
+This ensures unique filenames for all domains and preserves the complete domain information.
 
 ### Error Handling