Sync tooling with the monorepo starter and update dependencies

.claude/settings.json

@@ -1,13 +1,34 @@
 {
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
     "allow": [
       "Bash(pnpm lint:*)",
-      "Bash(pnpm format:check:*)",
       "Bash(pnpm typecheck:*)",
-      "Bash(pnpm test:*)",
+      "Bash(pnpm build:*)",
       "Bash(pnpm format:*)",
+      "Bash(pnpm format:check:*)",
+      "Bash(pnpm test:*)",
+      "Bash(pnpm secrets:scan:*)",
+      "Bash(pnpm knip:*)",
       "Bash(pnpm --filter:*)",
       "Bash(gh api:*)"
-    ]
+    ],
+    "deny": [
+      "Bash(curl:*)",
+      "Bash(wget:*)",
+      "Bash(nc:*)",
+      "Bash(ssh:*)",
+      "Read(**/.env*)",
+      "Read(**/.dev.vars)",
+      "Read(**/.prod.vars)",
+      "Read(**/secrets/**)"
+    ],
+    "ask": [
+      "Bash(pnpm install:*)",
+      "Bash(pnpm add:*)",
+      "Bash(pnpm remove:*)",
+      "Bash(git commit:*)"
+    ],
+    "defaultMode": "default"
   }
 }

.github/workflows/feature.yml

@@ -18,13 +18,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Typecheck
         run: pnpm typecheck
@@ -36,31 +36,49 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Lint
         run: pnpm lint
 
+  knip:
+    name: knip
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Knip
+        run: pnpm knip
+
   format-check:
     name: format-check
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Format check
         run: pnpm format:check
@@ -72,13 +90,65 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Test
         run: pnpm test
+
+  secrets-scan:
+    name: secrets-scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      # Full history: gitleaks scans every commit, not just the checked-out tree.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      # Same script as `pnpm secrets:scan`; runs the pinned gitleaks Docker
+      # image, so no pnpm/Node setup is needed.
+      - name: Scan for secrets
+        run: sh tooling/github/scripts/secrets-scan.sh
+
+  codeql:
+    name: codeql (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        # `actions` scans the workflow files themselves (injection, unpinned
+        # third-party actions, over-broad permissions).
+        language: [javascript-typescript, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      # Advanced setup: turn OFF "default setup" under Settings → Code security,
+      # or GitHub rejects these uploads. Neither language needs a build step.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/main.yml

@@ -18,13 +18,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Typecheck
         run: pnpm typecheck
@@ -36,31 +36,49 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Lint
         run: pnpm lint
 
+  knip:
+    name: knip
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Knip
+        run: pnpm knip
+
   format-check:
     name: format-check
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Format check
         run: pnpm format:check
@@ -72,34 +90,86 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Test
         run: pnpm test
 
+  secrets-scan:
+    name: secrets-scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      # Full history: gitleaks scans every commit, not just the checked-out tree.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      # Same script as `pnpm secrets:scan`; runs the pinned gitleaks Docker
+      # image, so no pnpm/Node setup is needed.
+      - name: Scan for secrets
+        run: sh tooling/github/scripts/secrets-scan.sh
+
+  codeql:
+    name: codeql (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        # `actions` scans the workflow files themselves (injection, unpinned
+        # third-party actions, over-broad permissions).
+        language: [javascript-typescript, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      # Advanced setup: turn OFF "default setup" under Settings → Code security,
+      # or GitHub rejects these uploads. Neither language needs a build step.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          category: "/language:${{ matrix.language }}"
+
   deploy:
     name: deploy
-    needs: [typecheck, lint, format-check, test]
+    needs: [typecheck, lint, knip, format-check, test, secrets-scan]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     environment: production
     permissions:
       contents: read
       deployments: write
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Deploy browser-scraper to Cloudflare Workers
         run: pnpm --filter @repo/browser-scraper run deploy

.github/workflows/migrations.yml

@@ -21,13 +21,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: ./tooling/github/setup
 
       - name: Apply D1 migrations
         run: pnpm --filter @repo/operator exec wrangler d1 migrations apply switch-operator-db --remote

.gitignore

@@ -1,5 +1,34 @@
+# Dependencies
 node_modules
+
+# Turbo / Wrangler
+.turbo
+.cache
+.wrangler
+
+# Local git worktrees
+.worktrees/
+
+# Build Outputs
+dist
+build
+
+# Logs
+logs
+*.log
+
+# Environment files
+.env
+.env.*
+!.env.example
 .dev.vars
 .prod.vars
-.env
-.wrangler
+*.local
+
+# Editors
+.idea
+*.suo
+*.sw?
+
+# Misc
+.DS_Store

.nvmrc

@@ -1 +1 @@
-24.12.0
+24.21.0