ci: streamline CI workflow and upgrade GitHub Actions dependencies

Author: github-actions[bot]

.github/workflows/ci.yml

@@ -25,142 +25,57 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  NODE_VERSION: 20
+
 jobs:
   test:
     if: github.event_name == 'push' || github.event.pull_request.draft == false
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
-<<<<<<< HEAD
+      - name: Harden runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
+        with:
+          egress-policy: audit
+
       - name: ⬇️ Checkout code
         uses: actions/checkout@v4
         with:
           persist-credentials: false
           fetch-depth: 1
+
       - name: 🟢 Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
           registry-url: https://registry.npmjs.org/
           cache-dependency-path: package-lock.json
+
       - name: 📦 Install dependencies
         run: npm ci
         shell: bash
-      - name: 🔧 Fix Node.js module exports
-        shell: bash
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          echo "Fixing Node.js module export issues..."
-          # Safe file processing without shell injection risks
-          find src/ -name "*.js" -exec grep -l "module.exports" {} \; | while IFS= read -r file; do
-            if [[ -f "$file" ]] && [[ ! $(tail -1 "$file") =~ module\.exports ]]; then
-              echo "// Ensure module.exports is properly defined" >> "$file"
-              echo "Fixed exports in: $file"
-            fi
-          done
-      - name: 🧹 Lint (Resilient)
-        id: lint
-        shell: bash
-        env:
-          EVENT_NAME: "\"${{ github.event_name }}\""
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          if [[ ""$EVENT_NAME"" == "pull_request" ]]; then
-            echo "📝 PR Mode: Warnings allowed, errors reported"
-            npm run lint:errors-only || echo "::warning::Lint errors found but not blocking PR"
-          else
-            echo "🔒 Main branch: Strict linting enforced"
-            npm run lint:strict
-          fi
-        continue-on-error: ${{ github.event_name == 'pull_request' }}
-      - name: ✅ Core Tests
-        id: test
-        shell: bash
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          echo "Running critical test suite..."
-          npm test -- --testPathPattern="(core|pipeline|cli)" --maxWorkers=2
-        continue-on-error: false
-        timeout-minutes: 15
-  diagnostics:
-    name: 📊 Quality Diagnostics
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    needs:
-      - critical-checks
-    if: always()
-    steps:
-      - name: ⬇️ Checkout code
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          fetch-depth: 1
-      - name: 🟢 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-=======
-      - name: Harden runner
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
->>>>>>> develop
-          cache: npm
-          cache-dependency-path: package-lock.json
 
-      - name: Install
-        run: npm ci
-<<<<<<< HEAD
-        shell: bash
-      - name: 📊 Full Lint Report
-        shell: bash
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          npm run lint:diagnostic
-        continue-on-error: true
-      - name: 📈 Coverage Report
-        shell: bash
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          npm test -- --coverage --testPathPattern="(core|pipeline)" || echo "Partial coverage generated"
-        continue-on-error: true
-      - name: 📊 Upload Partial Coverage
-        uses: codecov/codecov-action@v4
-=======
-      - name: Lint
+      - name: 🧹 Lint
         run: npm run lint --if-present
-      - name: Type check
+
+      - name: 🔍 Type check
         run: npm run typecheck --if-present
-      - name: Test
+
+      - name: ✅ Test
         run: npm test -- --ci --reporters=default --reporters=jest-junit --passWithNoTests
 
       - name: Upload JUnit
->>>>>>> develop
         if: always()
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874
+        uses: actions/upload-artifact@v4
         with:
           name: junit
           path: junit.xml
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874
+        uses: actions/upload-artifact@v4
         with:
           name: coverage
           path: coverage
@@ -171,105 +86,20 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-<<<<<<< HEAD
-      - name: ⬇️ Checkout code
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          fetch-depth: 1
-      - name: 🟢 Setup Node.js
-        uses: actions/setup-node@v4
-=======
       - name: Harden runner
         uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
         with:
           egress-policy: audit
-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
->>>>>>> develop
+
+      - name: Download coverage
+        uses: actions/download-artifact@v4
         with:
           name: coverage
           path: coverage
         continue-on-error: true
-<<<<<<< HEAD
-        timeout-minutes: ${{ matrix.test-suite.timeout }}
-  deploy:
-    name: 🚀 Deploy & Release
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    permissions:
-      contents: write
-      packages: write
-      id-token: write
-    needs:
-      - critical-checks
-    if: |
-      github.ref == 'refs/heads/main' && 
-      needs.critical-checks.outputs.lint-status == 'success' && 
-      needs.critical-checks.outputs.test-status == 'success' &&
-      github.actor != 'github-actions[bot]'
-    steps:
-      - name: ⬇️ Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: 🟢 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-          registry-url: https://registry.npmjs.org/
-          cache-dependency-path: package-lock.json
-      - name: 📦 Install dependencies
-        run: npm ci
-        shell: bash
-      - name: ✅ Run tests with coverage
-        shell: bash
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          npm test
-        timeout-minutes: 20
-      - name: 🧪 Validate Fixtures (Non-blocking)
-        shell: bash
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          npm run validate-fixtures || echo "Fixtures validation failed but continuing..."
-        continue-on-error: true
-      - name: 📊 Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-=======
+
       - name: Upload to Codecov
-        uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a
->>>>>>> develop
+        uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false
-<<<<<<< HEAD
-      - name: 🚀 Semantic Release
-        shell: bash
-        env:
-          GITHUB_TOKEN: "\"${{ secrets.GITHUB_TOKEN }}\""
-          GH_TOKEN: "\"${{ secrets.GH_TOKEN }}\""
-          NPM_TOKEN: "\"${{ secrets.NPM_TOKEN }}\""
-          NODE_AUTH_TOKEN: "\"${{ secrets.NPM_TOKEN }}\""
-        run: |
-          set -e
-          set -o pipefail
-          set -Eeuo pipefail
-          npx semantic-release
-        timeout-minutes: 15
-      - name: 📋 Upload Release Artifacts
-        if: failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-failure-logs
-          path: |
-            npm-debug.log*
-            .npm/_logs/*
-          retention-days: 7
-=======
->>>>>>> develop

.github/workflows/docs-build.yml

@@ -0,0 +1,58 @@
+name: Docs Build
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "docs-site/**"
+      - ".github/workflows/docs-build.yml"
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: package-lock.json
+      - name: Install root deps
+        run: npm ci
+      - name: Build Docusaurus
+        working-directory: docs-site
+        run: |
+          npm ci
+          npm run build
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa
+        with:
+          path: docs-site/build
+
+  deploy:
+    needs: build
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e

.github/workflows/docs-deploy.yml

@@ -1,4 +1,3 @@
-<<<<<<< HEAD
 name: Deploy Docs to GitHub Pages
 
 on:
@@ -49,62 +48,3 @@ jobs:
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v4
-=======
-name: Docs
-on:
-  push:
-    branches: [main]
-    paths:
-      - "docs/**"
-      - "docs-site/**"
-      - ".github/workflows/docs-deploy.yml"
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: true
-
-jobs:
-  build:
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: package-lock.json
-      - name: Install root deps
-        run: npm ci
-      - name: Build Docusaurus
-        working-directory: docs-site
-        run: |
-          npm ci
-          npm run build
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa
-        with:
-          path: docs-site/build
-
-  deploy:
-    needs: build
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    permissions:
-      pages: write
-      id-token: write
-    steps:
-      - id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
->>>>>>> develop