🔧 update: dependencies and improve commit workflow configuration

.contributerc.json

@@ -0,0 +1,21 @@
+{
+  "workflow": "clean-flow",
+  "role": "maintainer",
+  "mainBranch": "main",
+  "devBranch": "dev",
+  "upstream": "upstream",
+  "origin": "origin",
+  "branchPrefixes": [
+    "feature",
+    "fix",
+    "docs",
+    "chore",
+    "test",
+    "refactor"
+  ],
+  "commitConvention": "clean-commit",
+  "aiEnabled": true,
+  "aiProvider": "openrouter",
+  "aiModel": "openai/gpt-oss-20b:free",
+  "showTips": true
+}

.gitattributes

@@ -0,0 +1,27 @@
+# Auto-detect text files and normalize line endings to LF
+* text=auto eol=lf
+
+# Explicitly declare text files
+*.ts text eol=lf
+*.tsx text eol=lf
+*.js text eol=lf
+*.jsx text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.toml text eol=lf
+*.env text eol=lf
+*.sh text eol=lf
+
+# Declare binary files
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.otf binary
+*.eot binary

.github/workflows/ci.yml

@@ -1,25 +1,29 @@
 name: CI
 
 on:
-  pull_request:
-    branches: [main, dev]
-  push:
-    branches: [main, dev]
   workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: CI-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
   pull-requests: write
 
 jobs:
-  commits:
+  validate:
+    name: Lint Test Validate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout code
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Validate commit messages
+        if: github.event_name == 'pull_request' || github.event_name == 'push'
         run: |
           # Clean Commit convention pattern
           # Format: <emoji> <type>[(<scope>)]: <description>
@@ -70,45 +74,34 @@ jobs:
             exit 1
           fi
 
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - uses: oven-sh/setup-bun@v2
+      - name: Detect secrets
+        uses: gitleaks/gitleaks-action@v2.3.9
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Run Biome lint and format check
-        run: bun run lint
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
 
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
 
-      - uses: oven-sh/setup-bun@v2
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Build packages
-        run: bun run build:packages
-
-      - name: Build plugins
-        run: bun run build:plugins
-
-  test:
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - uses: oven-sh/setup-bun@v2
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
+      - name: Run Biome lint and format check
+        run: bun run lint
 
       - name: Build packages
         run: bun run build:packages
@@ -117,8 +110,16 @@ jobs:
         run: bun run build:plugins
 
       - name: Run tests (with retry for Bun runtime segfaults)
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@v4
         with:
           max_attempts: 3
           timeout_minutes: 10
           command: bun test
+
+      - name: Test Docker build (no push)
+        run: |
+          echo "Testing Docker build..."
+          docker build -t test-build .
+          echo "Build successful, cleaning up..."
+          docker image rm test-build
+          echo "Docker build test completed"

.github/workflows/codeql.yml

@@ -1,37 +1,34 @@
 name: CodeQL
 
 on:
-  pull_request:
-    branches: [main, dev]
-  push:
-    branches: [main, dev]
   schedule:
-    # Run every Monday at 6:00 UTC to catch new vulnerabilities
-    - cron: '0 6 * * 1'
+    - cron: "0 6 * * 1"
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: CodeQL-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 permissions:
   contents: read
   security-events: write
 
 jobs:
   analyze:
+    name: Analyze (TypeScript)
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['javascript-typescript']
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout code
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
+        uses: github/codeql-action/init@v4
         with:
-          languages: ${{ matrix.language }}
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
+          languages: javascript-typescript
+          queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
+        uses: github/codeql-action/analyze@v4
         with:
-          category: '/language:${{ matrix.language }}'
+          category: /language:javascript-typescript

.github/workflows/container.yml

@@ -1,14 +1,17 @@
-name: Container Build
+name: Container
 
 on:
   pull_request:
-    branches: [main, dev]
+    branches: [ dev, main ]
   push:
-    branches: [main, dev]
-  workflow_call:
-  workflow_dispatch:
+    branches: [ dev, main ]
   release:
-    types: [published]
+    types: [ published ]
+  workflow_dispatch:
+
+concurrency:
+  group: Container-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -17,22 +20,39 @@ permissions:
   pull-requests: write
 
 jobs:
+  ci:
+    name: CI Gate
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: write
+
+  codeql:
+    name: CodeQL Gate
+    uses: ./.github/workflows/codeql.yml
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
   build:
-    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
+    name: Build Container Images
     runs-on: ubuntu-latest
+    needs: [ ci, codeql ]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Checkout code
+        uses: actions/checkout@v6
 
       - name: Build and Push Container
-        uses: wgtechlabs/container-build-flow-action@v1.3.1 # v1.3.1
+        uses: wgtechlabs/container-build-flow-action@v1.8.1
         with:
           registry: both
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
-          platforms: linux/amd64,linux/arm64
+          ghcr-token: ${{ github.token }}
+          floating-tags: true
+          release-platforms: linux/amd64
           trivy-severity: CRITICAL
           fail-on-vulnerability: true
+          commit-convention-enabled: true

.github/workflows/landing.yml

@@ -31,7 +31,7 @@ jobs:
         run: bun run --cwd src/landing build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: src/landing/dist
 
@@ -47,4 +47,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0