Add release hygiene, CI, and trusted publishing

[mohanagy]

Summary

• add package metadata, a verified npm pack contract, and release/community documentation
• add least-privilege CI verification for development and main pull requests
• add OIDC-only npm publishing with provenance from a protected npm environment
• add Dependabot and security-sensitive issue/PR templates

Linked issue

• Closes [Release] Add project metadata, security policy, CI publishing, and npm provenance #24

Validation

• npm test
• npm run typecheck
• npm run lint
• npm run build
• node dist/cli/main.js schema
• npm run check:pack

Summary by CodeRabbit

• New Features

  • Added structured GitHub issue and pull request templates (including safety/privacy check steps).
  • Added automated CI for linting, tests, build, and CLI smoke checks.
  • Added npm publishing workflow with trusted publishing validation.
  • Added package metadata and packaging “contract” validation for the publish artifact.

• Documentation

  • Added/updated security, contribution, release policy, and changelog documentation.
  • Updated README to reflect experimental status and security-reporting links.

• Tests

  • Added contract tests for package contents and release/publishing configuration.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 99fec191-c9a7-4126-b04c-3318acb11148

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The repository adds npm package metadata and artifact validation, CI and trusted publishing workflows, security and contribution policies, structured issue and pull-request templates, Dependabot configuration, and tests covering package, workflow, and repository release contracts.

Changes

Release and repository governance

Layer / File(s)	Summary
Package metadata and artifact contract package.json, scripts/check-pack.mjs, tests/package-contract.test.ts	Adds npm metadata and publishing settings, validates packed paths, and tests package metadata and artifact contents.
Continuous integration verification .github/workflows/ci.yml, eslint.config.js, tests/tooling-config.test.ts	Adds branch and pull-request CI for linting, typechecking, tests, builds, CLI smoke tests, packaging checks, and repository tooling contracts.
Release validation and trusted publishing .github/workflows/publish.yml, tests/release-config.test.ts	Adds release-triggered validation of toolchain, tags, versions, ancestry, build results, package contents, and provenance publishing.
Security, contribution, and issue intake policies .github/ISSUE_TEMPLATE/*, .github/pull_request_template.md, CHANGELOG.md, CONTRIBUTING.md, README.md, SECURITY.md, tests/release-config.test.ts	Adds structured reporting templates and documents security disclosure, contribution, release, and experimental-project policies.
Dependency update policy .github/dependabot.yml, tests/release-config.test.ts	Configures grouped monthly npm minor and patch updates and tests the policy.

Estimated code review effort: 4 (Complex) | ~60 minutes

Poem

A rabbit checks the package gate,
Then hops through workflows, neat and straight.
“No secrets here!” the checkboxes cheer,
Provenance follows every gear.
Release carrots safely appear!

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (2 errors)

Check name	Status	Explanation	Resolution
Linked Issues check	❌ Error	Most requirements are covered, but the PR does not show the requested GitHub repository description, homepage, or topics updates from #24.	Add the repository-level description, homepage, and topics updates, or document where they were set if handled outside the PR.
Docstring Coverage	❌ Error	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the PR’s main themes: release hygiene, CI, and trusted publishing.
Out of Scope Changes check	✅ Passed	The changes stay focused on release, publishing, security, and tooling work aligned with the linked issue.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/issue-24-release-hygiene

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/pull_request_template.md:
- Line 1: Add a top-level H1 heading before the existing “## Summary” heading in
the pull request template, ensuring the document follows a valid Markdown
heading hierarchy and satisfies markdownlint MD041.

In @.github/workflows/publish.yml:
- Around line 35-59: Review the npm version comparison in the inline toolchain
check and simplify the convoluted nested every/some logic into a clearer
tuple-wise comparison while preserving the existing behavior for versions such
as 12.0.0, 11.5.1, 11.5.0, 11.4.9, and 10.9.9. Keep the validation and error
handling in the “Verify trusted-publishing toolchain” step unchanged.

In `@SECURITY.md`:
- Line 11: Verify that GitHub private vulnerability reporting is enabled for the
repository, and test the security advisory link to confirm it opens a valid
private disclosure form before release. Update the guidance if necessary so
vulnerability details are not submitted publicly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6f2b3f2c-0101-47b6-900c-0a295520568e

📥 Commits

Reviewing files that changed from the base of the PR and between b971f75 and 72a1b74.

📒 Files selected for processing (15)

• .github/ISSUE_TEMPLATE/bug_report.yml
• .github/ISSUE_TEMPLATE/config.yml
• .github/ISSUE_TEMPLATE/feature_request.yml
• .github/dependabot.yml
• .github/pull_request_template.md
• .github/workflows/ci.yml
• .github/workflows/publish.yml
• CHANGELOG.md
• CONTRIBUTING.md
• README.md
• SECURITY.md
• package.json
• scripts/check-pack.mjs
• tests/package-contract.test.ts
• tests/release-config.test.ts

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/release-config.test.ts`:
- Around line 16-22: Move the regex literals used by npmVersionComparison and
the callback around lines 96–114 to module-level constants, then reference those
static constants inside the function and callback. Preserve the existing
patterns and matching behavior while eliminating the e18e/prefer-static-regex
lint violations.

In `@tests/tooling-config.test.ts`:
- Around line 9-31: Move the regex literals used in the three tests in
tooling-config.test.ts to module-level constants, then reference those constants
inside the expect(...).toMatch calls to satisfy e18e/prefer-static-regex while
preserving the existing matching behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0d2a701-2f2d-4274-8a5f-adf66619ce5b

📥 Commits

Reviewing files that changed from the base of the PR and between 72a1b74 and acc14a3.

📒 Files selected for processing (6)

• .github/pull_request_template.md
• .github/workflows/publish.yml
• eslint.config.js
• scripts/check-pack.mjs
• tests/release-config.test.ts
• tests/tooling-config.test.ts