fix: remove deprecated workflows, pin SHAs, fix autoload bugs, add CI governance

.github/CODEOWNERS

@@ -1 +1,32 @@
-* @z-shell/tsc
+# CODEOWNERS — zi
+#
+# GitHub evaluates rules top-to-bottom; the LAST matching rule wins.
+# Sections are ordered from broadest to most specific so that narrower
+# rules can override the default without removing coverage elsewhere.
+#
+# Team:  @z-shell/tsc  — Technical Steering Committee (final sign-off)
+# Owner: @ss-o         — Primary maintainer (day-to-day reviews)
+
+# ── Default ──────────────────────────────────────────────────────────────────
+# Catch-all: everything not matched by a more specific rule below.
+*                                   @ss-o
+
+# ── Core Zsh runtime ─────────────────────────────────────────────────────────
+# Changes here affect every Zi user; require TSC review.
+/zi.zsh                             @z-shell/tsc
+/lib/                               @z-shell/tsc
+
+# ── CI / Workflows ───────────────────────────────────────────────────────────
+# Workflow changes reviewed by primary maintainer; no TSC sign-off required.
+/.github/workflows/                 @ss-o
+/.github/dependabot.yml             @ss-o
+
+# ── Documentation & templates ────────────────────────────────────────────────
+/docs/                              @ss-o
+/.github/ISSUE_TEMPLATE/            @ss-o
+/.github/PULL_REQUEST_TEMPLATE.md   @ss-o
+/.github/copilot-instructions.md    @ss-o
+
+# ── Governance (must be last — highest specificity) ───────────────────────────
+# CODEOWNERS itself requires TSC approval to change.
+/.github/CODEOWNERS                 @z-shell/tsc

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,43 +1,46 @@
-<!--- Provide a general summary of your changes in the Title above -->
+<!--
+  Thanks for contributing to zi! Please read the checklist below.
 
-## Description
-
-<!--- Describe your changes in detail -->
-
-## Motivation and Context
+  Branch model:
+    • Create your branch FROM next:  git checkout -b fix/my-fix next
+    • Open this PR TARGETING next — never target main directly
+    • main is only updated from next via a release PR
 
-<!--- Why is this change required? What problem does it solve? -->
-<!--- If it fixes an open issue, please link to the issue here. -->
+  Commit messages must follow Conventional Commits:
+    type(scope): short description   (≤72 chars, imperative mood)
+    Types: feat  fix  perf  refactor  docs  test  ci  chore  revert
+    Example: fix(self-update): correctly propagate exit code on failure
 
-## How Has This Been Tested?
+  See .github/copilot-instructions.md for full guidelines.
+-->
 
-<!--- Please describe in detail how you tested your changes. -->
-<!--- Include details of your testing environment, and the tests you ran to -->
-<!--- see how your change affects other areas of the code, etc. -->
-
-## Screenshots (if appropriate):
+## Description
 
-## Types of changes
+<!-- Describe your changes clearly. What problem does this solve? -->
 
-<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
+## Related issues
 
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to change)
-- [ ] Documentation update (if none of the other choices apply)
-- [ ] Chore (general maintenance, refactoring, or code style update)
+<!-- Closes #NNN  /  Part of #NNN  /  N/A -->
 
-## Checklist:
+## Type of change
 
-<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
-<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+<!-- Put an `x` in all boxes that apply -->
 
-- [ ] My code follows the code style of this project.
-- [ ] I have read the **CONTRIBUTING** document.
-- [ ] I have added tests to cover my changes.
-- [ ] All new and existing tests passed.
-- [ ] I have updated the documentation accordingly.
+- [ ] `fix` — bug fix (non-breaking)
+- [ ] `feat` — new feature (non-breaking)
+- [ ] `feat!` / `fix!` — breaking change
+- [ ] `perf` — performance improvement
+- [ ] `refactor` — code change with no functional impact
+- [ ] `docs` — documentation only
+- [ ] `ci` — CI/workflow change
+- [ ] `chore` — maintenance / dependency bump
 
-## Other information (if applicable)
+## Checklist
 
-<!--- Any other information that is important to this PR such as environment variables, special considerations, etc. -->
+- [ ] My branch was created from `next` (not `main`)
+- [ ] This PR targets the `next` branch
+- [ ] Commit messages follow Conventional Commits format
+- [ ] No AI co-author trailers in commit messages
+- [ ] I have read [CONTRIBUTING.md](docs/CONTRIBUTING.md)
+- [ ] Existing tests pass (`zsh -n zi.zsh` / Trunk checks)
+- [ ] Documentation updated if needed

.github/copilot-instructions.md

@@ -0,0 +1,54 @@
+# GitHub Copilot Instructions for zi
+
+## Commit messages
+
+- Use **Conventional Commits** format: `type(scope): short description`
+- Allowed types: `feat`, `fix`, `perf`, `refactor`, `docs`, `test`, `ci`, `chore`, `revert`
+- Subject line: imperative mood, ≤72 characters, no trailing period
+- Body: wrap at 72 characters, explain _what_ and _why_ (not _how_)
+- **Never add AI co-author trailers** — do not append `Co-authored-by: Copilot`, `Co-authored-by: Claude`, `Co-authored-by: GitHub Copilot`, or any AI-generated attribution to commit messages
+- Breaking changes: add `!` after the type (`feat!:`) and include `BREAKING CHANGE:` in the footer
+
+Examples:
+
+````text
+feat(loader): add lazy-loading for completions
+
+Defer completion setup until first TAB press to cut startup time
+for users with large fpath trees.
+
+BREAKING CHANGE: ZI_COMPLETION_LAZY must be set before zi is sourced.
+```text
+
+```text
+fix(self-update): correctly set exit code on network failure
+```text
+
+## Branch model
+
+```text
+main  ← production releases (tags only, squash-merged from next)
+next  ← integration branch (PR target for all work)
+  └─ feat/<name>    feature branches
+  └─ fix/<name>     bug-fix branches
+  └─ perf/<name>    performance improvements
+  └─ docs/<name>    documentation updates
+  └─ ci/<name>      CI/workflow changes
+  └─ chore/<name>   maintenance, refactors
+```text
+
+- **All branches must be created from `next`**, not `main`
+- Open PRs **targeting `next`**, never `main` directly
+- `next` → `main` is the only path to production; it requires all CI checks to pass
+
+## AI-generated files
+
+- Do **not** suggest adding `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `.cursorrules`, `.aider*`, or similar AI-specific config files to this repository
+- Copilot configuration lives **only** in `.github/copilot-instructions.md`
+
+## Code style
+
+- Zsh files: 2-space indent, `# vim: ft=zsh sw=2 ts=2 et` modeline, LF endings
+- Every plugin entry file must resolve `$0` via the ZERO pattern
+- Follow the [Z-Shell Plugin Standard](https://wiki.zshell.dev/community/zsh_plugin_standard)
+````

.github/dependabot.yml

@@ -5,4 +5,5 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    target-branch: "next"

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+---
+name: CodeQL
+
+on:
+  push:
+    branches: [main, next]
+  pull_request:
+    branches: [main, next]
+  schedule:
+    - cron: "28 15 * * 5"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/commit-lint.yml

@@ -0,0 +1,101 @@
+---
+name: "📝 Commit Lint"
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+    branches:
+      - main
+      - next
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: read
+  contents: read
+
+jobs:
+  commit-lint:
+    name: "📝 Validate Commits"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "⤵️ Check out code from GitHub"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: "📝 Lint commit messages"
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          DISALLOWED_TRAILER_PATTERN: ${{ secrets.DISALLOWED_TRAILER_PATTERN }}
+        run: |
+          set -euo pipefail
+
+          CONVENTIONAL_PATTERN='^(feat|fix|perf|refactor|docs|test|ci|chore|revert)(\([^)]+\))?!?: .{1,72}$'
+
+          errors=0
+          checked=0
+
+          while IFS= read -r sha; do
+            parent_count=$(git cat-file -p "$sha" | grep -c '^parent' || true)
+            [ "$parent_count" -gt 1 ] && continue
+
+            subject=$(git show -s --format='%s' "$sha")
+            checked=$((checked + 1))
+
+            if ! echo "$subject" | grep -qE "$CONVENTIONAL_PATTERN"; then
+              echo "❌ Invalid commit message (${sha:0:7}): expected type(scope): description ≤72 chars"
+              errors=$((errors + 1))
+            fi
+
+            if [ -n "${DISALLOWED_TRAILER_PATTERN:-}" ]; then
+              if git show -s --format='%B' "$sha" | grep -qE "$DISALLOWED_TRAILER_PATTERN"; then
+                echo "❌ Disallowed trailer found (${sha:0:7}): remove before merging"
+                errors=$((errors + 1))
+              fi
+            fi
+          done < <(git log --format='%H' "${BASE_SHA}..${HEAD_SHA}")
+
+          if [ "$errors" -gt 0 ]; then
+            echo "::error::$errors commit(s) failed validation — run: git rebase -i ${BASE_SHA}"
+            exit 1
+          fi
+
+          echo "✅ $checked commit(s) validated"
+
+  pr-title:
+    name: "📋 Validate PR Title"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "📋 Check PR title follows Conventional Commits"
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          PATTERN='^(feat|fix|perf|refactor|docs|test|ci|chore|revert)(\([^)]+\))?!?: .{1,72}$'
+          if ! echo "$PR_TITLE" | grep -qE "$PATTERN"; then
+            echo "::error::PR title must follow Conventional Commits: type(scope): description"
+            exit 1
+          fi
+          echo "✅ PR title valid"
+
+  branch-naming:
+    name: "🌿 Validate Branch Name"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "🌿 Check branch naming convention"
+        env:
+          BRANCH: ${{ github.head_ref }}
+        run: |
+          PATTERN='^(feat|fix|perf|refactor|docs|test|ci|chore|revert)/[a-z0-9][a-z0-9-]*[a-z0-9]$'
+          if echo "$BRANCH" | grep -q '^dependabot/'; then
+            echo "✅ OK"
+            exit 0
+          fi
+          if ! echo "$BRANCH" | grep -qE "$PATTERN"; then
+            echo "::error::Branch name must follow type/short-description (e.g. feat/my-feature)"
+            exit 1
+          fi
+          echo "✅ Branch name valid"