Skitionek · Mar 22, 2026 · Mar 23, 2026 · Mar 23, 2026 · Mar 23, 2026 · Mar 23, 2026
diff --git a/.cspell.json b/.cspell.json
@@ -0,0 +1,27 @@
+{
+  "version": "0.2",
+  "words": [
+    "CODEOWNERS",
+    "ehthumbs",
+    "eslintcache",
+    "hmarr",
+    "ipynb",
+    "marocchino",
+    "maxage",
+    "nosniff",
+    "pids",
+    "PRFIELD",
+    "REPOFIELD",
+    "SAMEORIGIN",
+    "Segoe",
+    "pyx",
+    "sarif",
+    "SARIF",
+    "Skitionek",
+    "tfvars",
+    "vercel",
+    "vite",
+    "Xuan",
+    "yourname"
+  ]
+}
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -0,0 +1 @@
+*  @Skitionek
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
@@ -0,0 +1 @@
+github: Skitionek
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
@@ -0,0 +1,15 @@
+# Copilot Instructions
+
+- Always use Conventional Commits for every commit message.
+- Use this format: `<type>(<optional-scope>): <description>`.
+- Allowed types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`, `revert`.
+- Keep the description short and imperative (for example: `fix(api): handle null user id`).
+- Mark breaking changes with `!` after type/scope (for example: `feat(auth)!: remove legacy token flow`) and include `BREAKING CHANGE:` in the commit body when applicable.
+
+## Changelog
+
+- **Always update `CHANGELOG.md`** when making any user-facing change (feat, fix, perf, refactor, or breaking change).
+- Add entries under the `[Unreleased]` section at the top of the file.
+- Group entries by type: `Added`, `Changed`, `Fixed`, `Removed`, `Security`, `Deprecated`.
+- Reference the related PR number as a link (e.g. `([#123])`).
+- Do **not** add changelog entries for pure dependency bumps handled by Dependabot — those are batched by a human when relevant.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+# Dependabot configuration
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "ci"
+
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "build"
diff --git a/.github/workflows/build-action-code.yml b/.github/workflows/build-action-code.yml
@@ -0,0 +1,52 @@
+name: Build Action Code
+
+on:
+  push:
+    paths:
+      - "index.ts"
+      - "scripts/**"
+      - "api/**"
+      - "action.yml"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/build-action-code.yml"
+  pull_request:
+    paths:
+      - "index.ts"
+      - "scripts/**"
+      - "api/**"
+      - "action.yml"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/build-action-code.yml"
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  build-action:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build action bundle
+        run: npm run build:action
+
+      - name: Ensure scripts bundle is up to date
+        run: |
+          if ! git diff --quiet -- scripts/update-markdown-pr-stats.cjs; then
+            echo 'scripts/update-markdown-pr-stats.cjs is out of date. Run npm run build:action and commit the result.'
+            git --no-pager diff -- scripts/update-markdown-pr-stats.cjs
+            exit 1
+          fi
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,89 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "36 0 * * 0"
+
+permissions: read-all
+
+jobs:
+  # Check whether Code scanning is enabled before running the expensive analysis.
+  # The GitHub API returns 403 when the feature is disabled; any other successful
+  # response (even an empty list) means it IS enabled.
+  check-code-scanning:
+    name: Check Code Scanning enabled
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: read
+    outputs:
+      enabled: ${{ steps.check.outputs.enabled }}
+    steps:
+      - name: Check via API
+        id: check
+        uses: actions/github-script@v7
+        with:
+          script: |
+            try {
+              await github.rest.codeScanning.listAlertsForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                per_page: 1,
+              });
+              core.setOutput('enabled', 'true');
+            } catch (err) {
+              if (err.status === 403) {
+                core.warning('Code scanning is not enabled for this repository — skipping CodeQL analysis.');
+                core.setOutput('enabled', 'false');
+              } else {
+                // Any other error (e.g. 404 empty repo) — still try to run.
+                core.setOutput('enabled', 'true');
+              }
+            }
+
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    needs: check-code-scanning
+    if: needs.check-code-scanning.outputs.enabled == 'true'
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Run manual build steps
+        if: matrix.build-mode == 'manual'
+        shell: bash
+        run: |
+          echo 'Replace this with your project build commands, for example:'
+          echo '  make bootstrap'
+          echo '  make release'
+          exit 1
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
+        with:
+          category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/copilot-auto-fix.yml b/.github/workflows/copilot-auto-fix.yml
@@ -0,0 +1,90 @@
+name: Copilot Auto-Fix on CI Failure
+
+on:
+  workflow_run:
+    workflows:
+      - Build Action Code
+    types:
+      - completed
+
+permissions: read-all
+
+jobs:
+  copilot-fix:
+    name: Copilot Auto-Fix
+    runs-on: ubuntu-latest
+    # Only run for same-repo PRs to avoid running untrusted code with write permissions.
+    if: >
+      github.event.workflow_run.conclusion == 'failure' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout failing branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install Copilot CLI
+        run: npm install -g @github/copilot
+
+      - name: Run Copilot CLI to fix failing tests
+        # COPILOT_TOKEN must be a fine-grained PAT with the "Copilot Requests" permission.
+        # Store it as a repository secret named COPILOT_TOKEN.
+        env:
+          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_TOKEN }}
+          WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
+          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
+          RUN_URL: ${{ github.event.workflow_run.html_url }}
+        run: |
+          copilot -p "The CI workflow '${WORKFLOW_NAME}' is failing on branch '${BRANCH_NAME}' (run: ${RUN_URL}). \
+          Run the tests to see exactly what is failing, then fix the source code so all tests pass. \
+          Do not modify any test files — only fix the implementation." \
+            --allow-tool='write,shell(npm:*),shell(npx:*),shell(yarn:*),shell(git:*)' \
+            --no-ask-user
+
+      - name: Create PR with Copilot fixes
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+        id: cpr
+        with:
+          # PAT is preferred so the fix PR triggers downstream CI workflows.
+          # Falls back to GITHUB_TOKEN if PAT is not set.
+          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+          commit-message: "fix(ci): apply Copilot auto-fix for failing tests"
+          title: "fix(ci): Copilot auto-fix for failing tests on ${{ github.event.workflow_run.head_branch }}"
+          labels: |
+            bot
+            copilot-fix
+          branch: copilot-fix/${{ github.event.workflow_run.head_branch }}
+          body: |
+            Automated fix generated by GitHub Copilot CLI for failing tests.
+
+            **Workflow run:** ${{ github.event.workflow_run.html_url }}
+            **Branch:** `${{ github.event.workflow_run.head_branch }}`
+
+            Please review the changes and merge if they are correct.
+          base: ${{ github.event.workflow_run.head_branch }}
+
+      - name: Post fix-PR link as comment on original PR
+        if: steps.cpr.outputs.pull-request-url != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const workflowRun = context.payload.workflow_run;
+            if (!workflowRun.pull_requests?.length) return;
+            const prNumber = workflowRun.pull_requests[0].number;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              body: `🤖 Copilot has automatically generated a fix for the failing tests.\n\nFix PR: ${{ steps.cpr.outputs.pull-request-url }}`
+            });
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
@@ -0,0 +1,29 @@
+name: Dependabot auto-merge
+
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    name: Auto-merge Dependabot PR
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
+
+      - name: Auto-approve
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}