ci: add coverage, security, and weekly prereleases

.github/release-drafter.yml

@@ -0,0 +1,20 @@
+name-template: "Unofficial downstream Super Synara $RESOLVED_VERSION (unsigned prerelease)"
+tag-template: "super-v$RESOLVED_VERSION"
+tag-prefix: "super-v"
+change-template: "- $TITLE (#$NUMBER) $AUTHORS"
+change-title-escapes: "\\<*_&"
+exclude-labels:
+  - skip-changelog
+template: |
+  <!-- super-synara-release-drafter-owned -->
+
+  > [!WARNING]
+  > This is an unofficial, unsigned Super Synara prerelease. Verify the published SHA-256 checksum before running an installer. Windows SmartScreen and macOS Gatekeeper warnings are expected. Do not disable operating-system protections globally.
+
+  Installation updates remain manual. This prerelease is never the GitHub Latest release and does not publish an updater feed.
+
+  ## Changes
+
+  $CHANGES
+
+  **Full comparison:** $PREVIOUS_TAG...super-v$RESOLVED_VERSION

.github/workflows/ci.yml

@@ -77,8 +77,55 @@ jobs:
       - name: Typecheck
         run: bun run typecheck
 
-      - name: Test
-        run: bun run test
+      - name: Test with coverage and JUnit
+        id: unit_tests
+        run: bun run test:ci
+
+      - name: Upload test results to Mergify CI Insights
+        id: mergify_ci
+        if: ${{ !cancelled() && (steps.unit_tests.outcome == 'success' || steps.unit_tests.outcome == 'failure') && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: Mergifyio/gha-mergify-ci@8173bc3c1d337d3367454672d50cfdf6f0273396 # v23
+        with:
+          action: junit-process
+          token: ${{ secrets.MERGIFY_TOKEN }}
+          job_name: quality
+          report_path: >-
+            ./apps/desktop/test-report.junit.xml
+            ./apps/server/test-report.junit.xml
+            ./apps/web/test-report.junit.xml
+            ./packages/contracts/test-report.junit.xml
+            ./packages/shared/test-report.junit.xml
+            ./scripts/test-report.junit.xml
+          test_step_outcome: ${{ steps.unit_tests.outcome }}
+
+      - name: Verify Mergify test results upload
+        if: ${{ !cancelled() && (steps.unit_tests.outcome == 'success' || steps.unit_tests.outcome == 'failure') && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        env:
+          MERGIFY_UPLOAD_OUTCOME: ${{ steps.mergify_ci.outputs.test_results_upload }}
+        run: test "$MERGIFY_UPLOAD_OUTCOME" = "success"
+
+      - name: Upload coverage reports to Codecov
+        if: ${{ !cancelled() && (steps.unit_tests.outcome == 'success' || steps.unit_tests.outcome == 'failure') }}
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./apps/desktop/coverage/lcov.info,./apps/server/coverage/lcov.info,./apps/web/coverage/lcov.info,./packages/contracts/coverage/lcov.info,./packages/shared/coverage/lcov.info,./scripts/coverage/lcov.info
+          disable_search: true
+          fail_ci_if_error: true
+          flags: unit
+          name: super-synara-unit-coverage
+
+      - name: Upload test results to Codecov
+        if: ${{ !cancelled() && (steps.unit_tests.outcome == 'success' || steps.unit_tests.outcome == 'failure') }}
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./apps/desktop/test-report.junit.xml,./apps/server/test-report.junit.xml,./apps/web/test-report.junit.xml,./packages/contracts/test-report.junit.xml,./packages/shared/test-report.junit.xml,./scripts/test-report.junit.xml
+          disable_search: true
+          fail_ci_if_error: true
+          flags: unit
+          name: super-synara-unit-test-results
+          report_type: test_results
 
       - name: Install browser test runtime
         timeout-minutes: 15

.github/workflows/codeql.yml

@@ -0,0 +1,94 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "41 6 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze_actions:
+    name: codeql-actions
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        with:
+          languages: actions
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        with:
+          category: /language:actions
+
+  analyze_javascript_typescript:
+    name: codeql-javascript-typescript
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        with:
+          languages: javascript-typescript
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        with:
+          category: /language:javascript-typescript
+
+  analyze_swift:
+    name: codeql-swift
+    runs-on: macos-15
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        with:
+          languages: swift
+          build-mode: manual
+
+      - name: Build Swift AppSnap helper
+        run: node apps/desktop/scripts/build-appsnap-helper.mjs --arch arm64 --output "${{ runner.temp }}/synara-appsnap-helper"
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        with:
+          category: /language:swift

.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: dependency-review
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/release-drafter.yml

@@ -0,0 +1,190 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "23 14 * * 1"
+  workflow_dispatch:
+    inputs:
+      release_scope:
+        description: "Exact platform set to publish when changes exist"
+        required: true
+        default: windows-only
+        type: choice
+        options:
+          - windows-only
+          - windows-and-macos
+
+permissions:
+  contents: read
+
+concurrency:
+  group: super-synara-prerelease
+  queue: max
+  cancel-in-progress: false
+
+jobs:
+  draft:
+    name: Update exact unsigned prerelease draft
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: read
+    outputs:
+      source_sha: ${{ steps.source.outputs.source_sha }}
+      version: ${{ steps.plan.outputs.version }}
+      tag: ${{ steps.plan.outputs.tag }}
+      latest_tag: ${{ steps.plan.outputs.latest_tag }}
+      latest_tag_commit: ${{ steps.plan.outputs.latest_tag_commit }}
+      should_release: ${{ steps.changes.outputs.should_release }}
+      draft_id: ${{ steps.release_drafter.outputs.id }}
+    steps:
+      - id: source
+        name: Bind exact protected main source
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PUSH_SHA: ${{ github.event_name == 'push' && github.sha || '' }}
+        run: |
+          set -euo pipefail
+          main_sha="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
+          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
+          if [[ -n "$PUSH_SHA" ]]; then
+            [[ "$PUSH_SHA" == "$main_sha" ]]
+          fi
+          echo "source_sha=$main_sha" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout exact main source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          ref: ${{ steps.source.outputs.source_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - id: plan
+        name: Resolve the one owned next draft
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ steps.source.outputs.source_sha }}
+        run: >-
+          node scripts/plan-super-synara-release-drafter.ts
+          --repository "$GITHUB_REPOSITORY"
+          --source-commit "$SOURCE_SHA"
+          --github-output "$GITHUB_OUTPUT"
+
+      - id: changes
+        name: Gate scheduled release work on new commits
+        shell: bash
+        env:
+          SOURCE_SHA: ${{ steps.source.outputs.source_sha }}
+          LATEST_TAG: ${{ steps.plan.outputs.latest_tag }}
+          LATEST_TAG_COMMIT: ${{ steps.plan.outputs.latest_tag_commit }}
+        run: |
+          set -euo pipefail
+          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$LATEST_TAG_COMMIT" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$(git rev-parse "$LATEST_TAG^{commit}")" == "$LATEST_TAG_COMMIT" ]]
+          git merge-base --is-ancestor "$LATEST_TAG_COMMIT" "$SOURCE_SHA"
+          commit_count="$(git rev-list --count "$LATEST_TAG_COMMIT..$SOURCE_SHA")"
+          [[ "$commit_count" =~ ^[0-9]+$ ]]
+          if [[ "$commit_count" == "0" ]]; then
+            echo "No commits exist after $LATEST_TAG; no draft will be created or updated."
+            echo "should_release=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "$commit_count commits exist after $LATEST_TAG."
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Authorize manual release controller before mutation
+        if: github.event_name == 'workflow_dispatch'
+        shell: bash
+        env:
+          ACTOR: ${{ github.actor }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+          OWNER: ${{ github.repository_owner }}
+        run: |
+          set -euo pipefail
+          [[ "$ACTOR" == "$OWNER" ]]
+          [[ "$TRIGGERING_ACTOR" == "$OWNER" ]]
+
+      - name: Authorize workflow rerun before mutation
+        if: github.run_attempt > 1
+        shell: bash
+        env:
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+          OWNER: ${{ github.repository_owner }}
+        run: |
+          set -euo pipefail
+          [[ "$TRIGGERING_ACTOR" == "$OWNER" ]]
+
+      - id: release_drafter
+        name: Release Drafter
+        if: steps.changes.outputs.should_release == 'true'
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
+        with:
+          token: ${{ github.token }}
+          config-name: release-drafter.yml
+          name: Unofficial downstream Super Synara ${{ steps.plan.outputs.version }} (unsigned prerelease)
+          tag: ${{ steps.plan.outputs.tag }}
+          version: ${{ steps.plan.outputs.version }}
+          publish: false
+          prerelease: true
+          latest: false
+          commitish: ${{ steps.source.outputs.source_sha }}
+
+      - name: Admit only the planned Release Drafter draft
+        if: steps.changes.outputs.should_release == 'true'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ steps.source.outputs.source_sha }}
+          TAG: ${{ steps.plan.outputs.tag }}
+          EXISTING_DRAFT_ID: ${{ steps.plan.outputs.existing_draft_id }}
+          DRAFT_ID: ${{ steps.release_drafter.outputs.id }}
+          VALIDATION_ACTOR: ${{ github.run_attempt > 1 && github.triggering_actor || (github.event_name == 'workflow_dispatch' && github.actor || 'github-actions[bot]') }}
+          VALIDATION_TRIGGERING_ACTOR: ${{ github.run_attempt > 1 && github.triggering_actor || (github.event_name == 'workflow_dispatch' && github.triggering_actor || 'github-actions[bot]') }}
+        run: |
+          set -euo pipefail
+          [[ "$DRAFT_ID" =~ ^[1-9][0-9]*$ ]]
+          if [[ -n "$EXISTING_DRAFT_ID" ]]; then
+            [[ "$DRAFT_ID" == "$EXISTING_DRAFT_ID" ]]
+          fi
+          node scripts/verify-super-synara-github-state.ts \
+            --phase preflight \
+            --repository "$GITHUB_REPOSITORY" \
+            --ref-name main \
+            --actor "$VALIDATION_ACTOR" \
+            --triggering-actor "$VALIDATION_TRIGGERING_ACTOR" \
+            --owner "$GITHUB_REPOSITORY_OWNER" \
+            --tag "$TAG" \
+            --source-commit "$SOURCE_SHA" \
+            --current-run-draft-id "$DRAFT_ID"
+
+      - name: Reject a raced main update
+        if: steps.changes.outputs.should_release == 'true'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ steps.source.outputs.source_sha }}
+        run: |
+          set -euo pipefail
+          current_main_sha="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
+          [[ "$current_main_sha" == "$SOURCE_SHA" ]]
+
+  dispatch:
+    name: Dispatch weekly exact-artifact prerelease
+    if: ${{ github.event_name != 'push' && needs.draft.outputs.should_release == 'true' }}
+    needs: draft
+    uses: ./.github/workflows/super-synara-prerelease.yml
+    permissions:
+      contents: write
+    with:
+      version: ${{ needs.draft.outputs.version }}
+      tag: ${{ needs.draft.outputs.tag }}
+      release_scope: ${{ github.event_name == 'workflow_dispatch' && inputs.release_scope || 'windows-only' }}
+      expected_source_sha: ${{ needs.draft.outputs.source_sha }}
+      release_draft_id: ${{ needs.draft.outputs.draft_id }}
+      confirm_unsigned: true