2 Commits

Author	SHA1	Message	Date
ANGX	df057a2de8	chore: format documentation and workflow files ... - Normalize line endings (LF -> CRLF on Windows) - Improve QUICKSTART.md table formatting - Update dependabot configuration formatting	2026-01-16 06:45:41 +01:00
ANGX	269cee54d7	ci: add comprehensive GitHub Actions CI/CD pipeline ... **DEVOPS + SEC Team Implementation** ## GitHub Workflows Created ### 1. CI Pipeline (.github/workflows/ci.yml) - **Build & Lint**: TypeScript compilation, ESLint, Prettier formatting checks - **Multi-Platform Tests**: Node 20/22 on Ubuntu/Windows/macOS - **Code Coverage**: Vitest coverage with Codecov integration - **Security Audit**: npm audit + CodeQL analysis - **Package Validation**: Export checks, CLI binary validation - **Concurrency**: Cancel redundant runs on push ### 2. Release Pipeline (.github/workflows/release.yml) - **Automated Publishing**: npm + GitHub Packages - **Version Validation**: package.json version verification - **Release Assets**: Tarball generation, dist artifacts - **GitHub Releases**: Auto-generated release notes from commits - **Notifications**: Success confirmation with URLs ### 3. PR Checks (.github/workflows/pr.yml) - **Semantic PR Titles**: Enforces conventional commits - **Coverage Diff**: LCOV reporter with inline comments - **Change Analysis**: Auto-labels by affected areas - **Size Warnings**: Alerts for large PRs (>100 files, >1000 lines) - **Missing Tests**: Reminder when src changes without tests - **API Compatibility**: Breaking change detection ### 4. Auto-labeling (.github/labeler.yml) - **Area Labels**: lexer, parser, semantic, runtime, cli, etc. - **Type Labels**: tests, docs, ci, config - **Priority Labels**: Based on critical file changes - **Size Labels**: xs/s/m/l/xl based on lines changed ### 5. Dependabot (.github/dependabot.yml) - **Weekly Updates**: Monday 09:00 UTC for npm, 10:00 UTC for actions - **Grouped Updates**: Minor/patch updates batched by type - **Security First**: Major updates and security patches get individual PRs - **Auto-reviewers**: Assigns team for review ## Security Features - CodeQL static analysis - npm audit on every build - Automated dependency updates - Secrets management for NPM_TOKEN ## Quality Gates - All tests must pass across platforms - Code coverage reporting - Linting and formatting enforcement - Type checking with TypeScript strict mode **Next**: Add CHANGELOG.md and QUICKSTART.md	2026-01-16 06:30:48 +01:00