[neilime]

Summary

Upgrade GitHub Actions and reusable workflow dependencies to their verified stable releases, replace the removed local-action helpers with native $/ references, and add automated releases for this repository.

• Update setup-node to 7.1.0, upload/download-artifact to 7.0.2/8.0.2, CodeQL to 4.39.1, ci-github-common to 0.39.1, ci-github-container to 0.39.0, and ci-github-publish to 1.0.2. Keep immutable SHA pins; the other audited dependencies are already current.
• Upgrade the maintained Super-Linter image to 2.0.0 for native-reference support. Propagate the container workflow's required attestation permission while keeping attestations disabled for the test image.
• Configure Conventional Commits parsing for breaking-change headers, exclude generated documentation from clone detection, and fix the test Dockerfile's numeric user and exec-form healthcheck.
• Add PR release labeling and a weekly/manual internal release workflow. Releases require shared CI to pass on the default branch, use the validated commit SHA, and support forcing a release when no relevant changes are detected.
• Use a GitHub App token so release tags trigger the existing documentation workflow. Generate an AI summary alongside the release notes.
• Document Release Drafter configuration, optional AI summaries, draft review, committed changelogs, and recovery after partial publication. Regenerate affected action/workflow documentation with CI Dokumentor.

Compatibility and setup

Breaking change: native $/ references require GitHub.com and GitHub-hosted runners or self-hosted runners 2.336.0+. GitHub Enterprise Server is unsupported by this composition mechanism.

The internal release workflow needs CI_BOT_APP_CLIENT_ID, CI_BOT_APP_PRIVATE_KEY, and OPENAI_API_KEY through repository or organization configuration. The app must have repository contents write and pull requests read access. Scheduled publication runs Mondays at 08:25 UTC after CI passes.

Validation

Passed locally:

• Workflow linting with the maintained image, focused zizmor checks, formatting, and Markdown linting.

• Upstream SHA/input/secret contracts, nested workflow permissions, and native-reference resolution checks.

• Eleven release-condition scenarios covering branch restrictions, scheduled/manual runs, force, changes, and an empty planned tag.

• Generated-document consistency, documentation examples/links, and git diff --check.

• Full make lint-fix and make lint with Super-Linter 2.0.0.

• Commitlint accepts breaking-change headers and rejects malformed messages. JSCPD reports zero clones, with handwritten documentation still checked.

• Docker base-stage build and smoke check confirm the numeric user is still node (UID/GID 1000) and the healthcheck command succeeds.

Hosted CI is rerunning on the latest commit.

Related dependency PRs: #549 and #504.

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter
Super-linter revision: 2da136927bd4a73596db63044b504547c62cb854
Super-linter version: 9.0.0

[github-actions]

Code Coverage Report

Coverage Results

Coverage

Metric	Covered	Total	Percentage
Lines	2	2	100.00%
Functions	1	1	100.00%

Overall: 100.00% 🟢
🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (6212d1b) to head (fd5f2bb).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #555   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            1         1           
  Lines            3         3           
=========================================
  Hits             3         3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.