Use github-release-actions for CI/CD

.github/dependabot.yml

@@ -0,0 +1,13 @@
+# Renovate owns version updates for this repo; Dependabot is kept only for security updates.
+# `open-pull-requests-limit: 0` disables Dependabot version-update PRs (so it does not duplicate
+# Renovate) while security-update PRs continue to be raised and pick up the `semver:patch` label
+# required by the validate-pr label gate.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    labels:
+      - "semver:patch"

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+# Runs linting and unit tests on every pull request and reports coverage to Codecov.
+name: CI
+
+on:
+  pull_request:
+    branches: ['main']
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: 24.16.0
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+
+      - name: Configure node
+        uses: actions/setup-node@v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install packages
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Run unit tests
+        run: npm run test:ci
+
+      - name: Upload coverage reports to Codecov
+        uses: codecov/codecov-action@v6.0.1
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/docker-build.yml

@@ -0,0 +1,37 @@
+# Builds the Docker image on every pull request without pushing it, so a broken Dockerfile (or a
+# broken `npm run build`) surfaces at PR time rather than on merge in release-candidate.yml.
+name: Docker Build
+
+on:
+  pull_request:
+    branches: ['main']
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: 24.16.0
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+
+      - name: Configure node
+        uses: actions/setup-node@v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install packages
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v7.2.0
+        with:
+          context: .
+          push: false