build: перейти на TypeScript, vitest и mise (tasks, daemons)

.github/dependabot.yml

@@ -1,31 +1,40 @@
 version: 2
 updates:
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: 'npm'
+    directory: '/'
     schedule:
-      interval: "monthly"
+      interval: 'monthly'
     open-pull-requests-limit: 1
+    # Свежий релиз неделю вылёживается: так не попасть на отозванную версию.
+    cooldown:
+      default-days: 7
     groups:
       all-npm-dependencies:
         patterns:
-          - "*"
+          - '*'
 
-  - package-ecosystem: "docker"
-    directory: "/"
+  - package-ecosystem: 'docker'
+    directory: '/'
     schedule:
-      interval: "monthly"
+      interval: 'monthly'
     open-pull-requests-limit: 1
+    # Свежий релиз неделю вылёживается: так не попасть на отозванную версию.
+    cooldown:
+      default-days: 7
     groups:
       all-docker-dependencies:
         patterns:
-          - "*"
+          - '*'
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "monthly"
+      interval: 'monthly'
     open-pull-requests-limit: 1
+    # Свежий релиз неделю вылёживается: так не попасть на отозванную версию.
+    cooldown:
+      default-days: 7
     groups:
       all-github-actions-dependencies:
         patterns:
-          - "*"
+          - '*'

.github/workflows/pr-title.yml

@@ -5,7 +5,9 @@ name: PR Title
 # поднять. Проверка отдельных коммитов ветки намеренно не делается, чтобы не
 # мешать работе внутри PR.
 on:
-  pull_request_target:
+  # pull_request_target нужен намеренно: экшену надо читать заголовок и у PR из
+  # форков. Код PR здесь не чекаутится и не выполняется, токен только на чтение.
+  pull_request_target: # jactionlint ignore=dangerous-triggers
     types:
       - opened
       - edited
@@ -15,10 +17,15 @@ on:
 permissions:
   pull-requests: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -13,39 +13,60 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+# Прогон на пуллреквесте отменяется новым коммитом, а прогон на main нет:
+# отменённая публикация образа оставила бы main без свежего образа.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5
 
-      - uses: jdx/mise-action@v5
       - name: Install
-        run: make setup
+        run: mise run setup
 
-      - name: Tests
-        run: make test
+      - name: Check
+        run: mise run check
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: ${{ github.event_name == 'push' }}
+    permissions:
+      contents: read
+      packages: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+        with:
+          cache-binary: false
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           push: true

.oxfmtrc.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "singleQuote": true,
+  "semi": true,
+  "printWidth": 120,
+  "ignorePatterns": [
+    "custom-server/src/generated",
+    "custom-server/assets",
+    "tsp-output",
+    "pnpm-lock.yaml",
+    "**/*.tsp",
+    "**/*.md"
+  ]
+}

.oxlintrc.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "import", "node", "promise", "vitest", "unicorn", "oxc"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn"
+  },
+  "env": { "node": true, "es2026": true },
+  "rules": {
+    "oxc/no-async-endpoint-handlers": "off"
+  },
+  "ignorePatterns": ["custom-server/src/generated", "custom-server/assets", "tsp-output", "node_modules"]
+}