Merge remote-tracking branch 'origin/master' into feat/release-v0.3.0

# Conflicts:
#	CHANGELOG.md

Author: askalf

.github/dependabot.yml

@@ -0,0 +1,45 @@
+# Dependabot version-update config.
+#
+# Security-advisory updates are already on via the repo-level "Dependabot
+# security updates" setting; this file covers *version* updates (catching
+# stale deps before they ship a vuln, not after).
+#
+# Non-major updates are grouped into a single weekly PR per ecosystem to
+# keep noise down; majors still open individually so they get real review.
+
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 10
+    groups:
+      non-major:
+        update-types:
+          - minor
+          - patch
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      non-major:
+        update-types:
+          - minor
+          - patch
+    commit-message:
+      prefix: ci
+      include: scope

.github/workflows/actionlint.yml

@@ -0,0 +1,40 @@
+name: actionlint
+
+# Validates GitHub Actions workflow YAML against actionlint's rule set.
+# Catches interpolation/quoting bugs, bad `needs:` refs, and the
+# untrusted-input-in-run-script class of injection risk that otherwise
+# only surfaces at workflow-fire time.
+
+on:
+  # Runs on every PR + every push to master, not just workflow changes.
+  # Path-filtered required checks can never report on PRs that don't
+  # touch the filter — leaves merges permanently blocked. 30s of CI on
+  # unrelated PRs is cheaper than that failure mode.
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - name: Install actionlint v1.7.1
+        # Official release tarball, pinned to a specific version. CI-only
+        # lint tool; a broken build here won't ship to users, so a
+        # checksum pin isn't essential.
+        run: |
+          set -euo pipefail
+          curl -fsSL -o actionlint.tgz \
+            https://github.com/rhysd/actionlint/releases/download/v1.7.1/actionlint_1.7.1_linux_amd64.tar.gz
+          tar xzf actionlint.tgz actionlint
+          chmod +x actionlint
+          ./actionlint -version
+
+      - name: Run actionlint
+        run: ./actionlint -color

.github/workflows/ci.yml

@@ -20,9 +20,15 @@ jobs:
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: ${{ matrix.node-version }}
+          cache: 'npm'
       - run: npm ci
         env:
+          # Skip the 100MB Chromium download — tests use a mock BrowserLike
+          # via AgentConfig.browserFactory, and the `--help` smoke doesn't
+          # launch a browser. Doctor's browser check would fail without it,
+          # but that's not exercised in CI.
           PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+      - run: npm run typecheck
       - run: npm run build
       - run: npm test
       - run: node dist/cli.js --help

.github/workflows/stale.yml

@@ -0,0 +1,44 @@
+name: Stale issue / PR housekeeping
+
+# Low-key housekeeping that keeps the tracker from accumulating dead
+# threads. Conservative defaults for a low-volume repo: 60 days to
+# warn, 14 more to close. Exempt labels keep security reports and
+# in-flight work out of the sweep.
+
+on:
+  schedule:
+    - cron: '30 4 * * *'
+  workflow_dispatch: {}
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        with:
+          days-before-stale: 60
+          days-before-close: 14
+          stale-issue-label: stale
+          stale-pr-label: stale
+          stale-issue-message: >
+            No activity on this issue for 60 days. Marking as stale. If
+            it's still relevant, leave a comment and we'll take another
+            look — otherwise it'll auto-close in 14 days.
+          stale-pr-message: >
+            No activity on this PR for 60 days. Marking as stale. If
+            it's still in flight, leave a comment or push an update —
+            otherwise it'll auto-close in 14 days.
+          close-issue-message: >
+            Auto-closing after 14 days of no follow-up. Feel free to
+            reopen if the issue recurs or you have new information.
+          close-pr-message: >
+            Auto-closing after 14 days of no follow-up. Feel free to
+            reopen if you want to pick the work back up.
+          exempt-issue-labels: security,auth,review-feedback,help-wanted,good-first-issue,pinned
+          exempt-pr-labels: security,pinned,wip,blocked
+          operations-per-run: 60
+          remove-stale-when-updated: true

CHANGELOG.md

@@ -10,6 +10,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 Streaming synthesis, `deepdive doctor`, LLM retry + per-call timeout, robots.txt respect, CI foundation parity with dario / claude-bridge, auto-release workflow preemptively ported, CodeQL pass, home-dir scrubbing on error output.
 
+### CI — foundation parity with dario / claude-bridge
+
+Brings deepdive's CI surface up to the maturity of the sibling repos:
+
+- **`actionlint.yml`** — `actionlint` v1.7.1 runs on every PR + push. No path filter (required-checks gate would never report on src-only PRs if filtered — classic footgun fixed on dario + claude-bridge already).
+- **`dependabot.yml`** — weekly (Monday 09:00 UTC) npm + github-actions version updates. Non-major grouped per ecosystem; majors open individually so they get real review.
+- **`stale.yml`** — `actions/stale@v10.2.0` daily at 04:30 UTC. 60 days to warn, 14 to close. Exempts `security`/`auth`/`review-feedback`/`help-wanted`/`good-first-issue`/`pinned` for issues, plus `wip`/`blocked`/`security` for PRs.
+- **`ci.yml`** — added `typecheck` step (`tsc --noEmit`) as a separate CI step before `build`, so type errors surface before the tsc emit step does. Matrix stays at Node 20 / 22 (engines `>=20.0.0` rules out 18; `node --test --test-concurrency` also needs 20.11+).
+- **Labels** — `security`, `auth`, `pinned`, `wip`, `blocked`, `review-feedback` created out-of-band to match the dario / claude-bridge vocabulary. Referenced by the stale-bot exempts above.
+- Repo setting `allow_update_branch` toggled on so auto-merge can rebase PRs against master without the maintainer clicking "Update branch".
+
 ### CI — auto-release workflow (ports the dario pattern preemptively)
 
 New `.github/workflows/auto-release.yml`. Fires on merge of any PR to master; exits in ~10s unless `package.json.version` changed from the parent commit, in which case it creates the matching `vX.Y.Z` tag and GitHub release (extracting the CHANGELOG section for the version as release notes). `publish.yml` then fires on `release:published` and runs `npm publish --access public --provenance`.

package.json

@@ -22,6 +22,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "typecheck": "tsc --noEmit",
     "test": "node --test --test-concurrency=4 test/*.test.mjs",
     "dev": "tsx src/cli.ts",
     "start": "node dist/cli.js",