feat(dashboard): rewrite on React + Vite + TanStack stack

.github/dependabot.yml

@@ -1,17 +1,98 @@
 version: 2
-  updates:
-    - package-ecosystem: cargo
-      directory: /
-      schedule:
-        interval: weekly
-      groups:
-        rust-deps:
-          patterns: ["*"]
-    - package-ecosystem: pip
-      directory: /
-      schedule:
-        interval: weekly
-    - package-ecosystem: github-actions
-      directory: /
-      schedule:
-        interval: monthly
+
+# Weekly dependency updates across every ecosystem taskito uses.
+# Patch + minor updates are grouped into one PR per ecosystem to keep
+# review traffic low; major updates get their own PRs so they can be
+# evaluated individually. Security advisories always open dedicated PRs.
+updates:
+  # Rust (workspace Cargo.toml + per-crate)
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: UTC
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - area/rust
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    groups:
+      rust-deps:
+        update-types:
+          - patch
+          - minor
+
+  # Python (pyproject.toml — uv manages resolution)
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: UTC
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - area/python
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    groups:
+      python-deps:
+        update-types:
+          - patch
+          - minor
+
+  # Dashboard (pnpm)
+  - package-ecosystem: npm
+    directory: /dashboard
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: UTC
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - area/dashboard
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    groups:
+      dashboard-deps:
+        update-types:
+          - patch
+          - minor
+      # Surface Radix + TanStack ecosystem upgrades together when they
+      # co-release — lets us pin compatible sets in a single PR.
+      radix:
+        patterns:
+          - "@radix-ui/*"
+      tanstack:
+        patterns:
+          - "@tanstack/*"
+
+  # GitHub Actions used in .github/workflows/*.yml
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: UTC
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - area/ci
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      actions:
+        update-types:
+          - patch
+          - minor
+          - major

.github/labeler.yml

@@ -0,0 +1,61 @@
+# Path-based PR auto-labels. Drives triage, filtering, and release-notes
+# grouping. Each area label is additive — a PR touching Rust + docs gets
+# both `area/rust` and `area/docs`.
+
+area/rust:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "crates/**"
+          - "Cargo.toml"
+          - "Cargo.lock"
+
+area/python:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "py_src/**"
+          - "pyproject.toml"
+          - "uv.lock"
+
+area/dashboard:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "dashboard/**"
+
+area/docs:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "docs/**"
+          - "README.md"
+          - "CHANGELOG.md"
+          - "**/*.md"
+
+area/tests:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "tests/**"
+          - "**/*_test.py"
+          - "**/test_*.py"
+          - "**/*.test.ts"
+          - "**/*.test.tsx"
+
+area/ci:
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".github/**"
+          - ".pre-commit-config.yaml"
+
+area/storage:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "crates/taskito-core/src/storage/**"
+
+area/scheduler:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "crates/taskito-core/src/scheduler/**"
+
+area/workflows:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "crates/taskito-core/src/workflow*/**"
+          - "py_src/taskito/workflows/**"

.github/workflows/actionlint.yml

@@ -0,0 +1,28 @@
+name: Actionlint
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actionlint.yaml"
+  pull_request:
+    branches: [master]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actionlint.yaml"
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Run actionlint
+        uses: raven-actions/actionlint@v2
+        with:
+          matcher: true

.github/workflows/ci.yml

@@ -53,35 +53,6 @@ jobs:
       - name: Mypy
         run: uv run mypy py_src/taskito/ tests/python/ --no-incremental
 
-  dashboard-lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: "10.30.3"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "22"
-          cache: "pnpm"
-          cache-dependency-path: dashboard/pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: cd dashboard && pnpm install --frozen-lockfile
-
-      - name: Biome lint + format check
-        run: cd dashboard && pnpm exec biome ci src/
-
-      - name: TypeScript check
-        run: cd dashboard && pnpm exec tsc --noEmit
-
-      - name: Build check
-        run: cd dashboard && pnpm exec vite build
-
   rust-test:
     runs-on: ubuntu-latest
     steps:

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    # Weekly scan so advisories added after merge still catch regressions.
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: python
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+
+      - name: Perform analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/dashboard.yml

@@ -0,0 +1,85 @@
+name: Dashboard
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - "dashboard/**"
+      - ".github/workflows/dashboard.yml"
+  pull_request:
+    branches: [master]
+    paths:
+      - "dashboard/**"
+      - ".github/workflows/dashboard.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: dashboard
+
+jobs:
+  ci:
+    name: lint · typecheck · test · build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: "10.30.3"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: "pnpm"
+          cache-dependency-path: dashboard/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate route tree
+        # TanStack Router's file-based tree is a build artifact; tsc needs
+        # it to resolve route imports.
+        run: pnpm exec tsr generate
+
+      - name: Biome (lint + format)
+        run: pnpm exec biome ci src/
+
+      - name: TypeScript check
+        run: pnpm exec tsc --noEmit
+
+      - name: Unit tests (vitest)
+        run: pnpm exec vitest run
+
+      - name: Build
+        run: pnpm exec vite build
+
+      - name: Bundle size summary
+        if: always()
+        run: |
+          set -e
+          {
+            echo "### Dashboard bundle"
+            echo
+            echo "| File | Size | Gzipped |"
+            echo "|------|-----:|--------:|"
+            find ../py_src/taskito/static/dashboard -type f \( -name "*.js" -o -name "*.css" -o -name "*.html" \) | sort | while read -r f; do
+              raw=$(stat -c%s "$f")
+              gz=$(gzip -c "$f" | wc -c)
+              printf "| \`%s\` | %s | %s |\n" "${f#../py_src/taskito/static/dashboard/}" "$(numfmt --to=iec --suffix=B "$raw")" "$(numfmt --to=iec --suffix=B "$gz")"
+            done
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload built assets
+        uses: actions/upload-artifact@v5
+        with:
+          name: dashboard-dist
+          path: py_src/taskito/static/dashboard/
+          retention-days: 7
+          if-no-files-found: error

.github/workflows/labeler.yml

@@ -0,0 +1,18 @@
+name: Labeler
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          configuration-path: .github/labeler.yml
+          sync-labels: true