Enhance modularity in logger and validation, update dependencies

[danielmarv]

Description

This pull request updates dependencies, improves configuration handling, and refines GitHub workflow scripts. The main focus is on upgrading the sharp image processing library and related packages, updating other dependencies, and making the automation scripts more robust and maintainable.

Dependency upgrades:

• Upgraded sharp and all related native and WASM packages from 0.34.x to 0.35.3, with updated peer dependencies and minimum Node version requirements. This includes all platform-specific and libvips sub-packages. [1] [2] [3]
• Updated postcss to ^8.5.23 in package.json and to 8.5.25 in pnpm-lock.yaml, and bumped undici to 7.29.0. Added/updated overrides for sharp and brace-expansion@1. [1] [2] [3] [4] [5]
• Added new dependency snapshots for @img/sharp-freebsd-wasm32 and @img/sharp-webcontainers-wasm32.

Workflow and script improvements:

• Updated GitHub Actions workflow scripts to remove debug logger steps and improved ESM module loading by switching from import() to require() and unwrapping the default export for bot scripts. [1] [2]
• Changed CodeQL action versions to use a specific commit for both init and analyze steps.

Configuration and documentation:

• Improved config loading in .github/scripts/helpers/config-loader.js by replacing __dirname with a more robust ESM-compatible directory resolution using import.meta.url.
• Added new documentation links (readme, signingGuide, mergeConflictsGuide) to .github/hiero-automation.json.

Changes Made

• Added...
• Modified...
• Fixed...

Related Issues

Screenshots (if applicable)

Checklist

• Tests added/updated
• Documentation updated
• Linting passes
• Branch up-to-date with main

Deployment Notes

Summary by CodeRabbit

• Documentation

  • Added quick-access links for the README, signing guide, and merge-conflicts guide.

• Bug Fixes

  • Improved configuration loading compatibility in modern JavaScript environments.
  • Updated automation behavior for more reliable pull request processing.

• Chores

  • Refined security scanning and automated workflow maintenance for improved reliability.

[netlify]

✅ Deploy Preview for hiero-open-source ready!

Name	Link
🔨 Latest commit	0066fe4
🔍 Latest deploy log	https://app.netlify.com/projects/hiero-open-source/deploys/6a734dffd609b90008bd96fb
😎 Deploy Preview	https://deploy-preview-588--hiero-open-source.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[lfdt-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates automation documentation links, fixes ES module configuration path resolution, changes pull request bot loading, revises CodeQL action pins, and updates package dependency overrides.

Changes

Automation and maintenance

Layer / File(s)	Summary
Automation documentation links .github/hiero-automation.json	Adds README, signing, and merge-conflicts documentation URLs.
Bot module loading and path resolution .github/scripts/helpers/config-loader.js, .github/workflows/on-pr*.yml	Resolves the configuration directory from import.meta.url. Pull request workflows use synchronous require() with default-export unwrapping and remove logger diagnostics.
Action and dependency overrides .github/workflows/codeql.yml, package.json	Pins CodeQL actions to v4.37.3 and updates overrides for postcss, undici, sharp, and brace-expansion@1.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• hiero-ledger/hiero-website#288: Adds contributor documentation referenced by the automation configuration.
• hiero-ledger/hiero-website#500: Introduces the configuration loader and pull request workflows modified here.
• hiero-ledger/hiero-website#584: Modifies the same CodeQL action pins.

Suggested labels: dependencies

Suggested reviewers: exploreriii, aceppaluni

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies workflow modularity improvements and dependency updates covered by the pull request.
Description check	✅ Passed	The description clearly explains the purpose and major changes, although template checkboxes and optional sections remain unfilled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/hiero-automation.json:
- Around line 76-77: Update the .github/hiero-automation.json entries for
signingGuide and mergeConflictsGuide so each points to its dedicated guide file
instead of the shared directory. Keep the existing base path, but change
signingGuide to the signing-specific markdown and mergeConflictsGuide to the
merge-conflicts markdown to match how the automation selects guidance.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ce457ada-ce06-4717-ae69-cc579fa70660

📥 Commits

Reviewing files that changed from the base of the PR and between 834a9ca and 0066fe4.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

• .github/hiero-automation.json
• .github/scripts/helpers/config-loader.js
• .github/workflows/codeql.yml
• .github/workflows/on-pr-update.yml
• .github/workflows/on-pr.yml
• package.json