ci: adopt detect-changes gating, runloopai actions, pnpm 10 workspace overrides, drop ink-big-text

Adapts runloopai/runloop-fe#1919's CI-consolidation and supply-chain patterns
into rl-cli.

CI (ci.yml):
- detect-changes job gates all check jobs (format/lint/build/test) via
  tj-actions/changed-files path groups + yq-enumerated self-change detection
- Conditional runs-on (ubuntu-latest when running, ubuntu-slim when skipping)
  and job-level if: ensures required status checks satisfy the branch ruleset
  even when skipped
- Push trigger on main with push-aware concurrency (run_id key, never cancels)
- runloopai/* action wrappers throughout (checkout, pnpm-action, setup-node,
  github-script, upload-artifact)
- Removes the old aggregator job (ready-to-merge) and the inlined
  dependency-check job (now a separate dependency-age-check.yml)

dependency-age-check.yml: adds push trigger with path filters so the
  supply-chain gate re-runs on main merges that touch lockfiles.

pnpm 10 + security overrides:
- Bumps packageManager to pnpm@10.33.0 and moves pnpm field to
  pnpm-workspace.yaml (pnpm 10 ignores package.json#pnpm)
- Overrides keyed by Dependabot advisory vulnerable_version_range with
  exact first_patched_version values (no carets) for 23 CVE advisories
- minimumReleaseAge: 10080 (7 days) with @runloop/api-client excluded

ink-big-text: replaced runtime cfonts rendering with a pre-rendered BANNER_ART
  template literal; removes the cfonts/window-size/define-property transitive
  dep subtree.

Divergences from runloop-fe#1919 (intentional):
- Job IDs kept lowercase with hyphens (detect-changes, not detect_changes) and
  no job-level name: fields — branch ruleset requires bare job IDs as required
  status checks
- node-version: "20" explicit (no .nvmrc in this repo)
- yq bracket path .jobs["detect-changes"].outputs for hyphenated job ID
- jobToOutputKey = {} (no shard jobs in rl-cli)
- minimumReleaseAge: 10080 minutes (7 days, matching lisan-al-gaib min-age-days)

Author: jason-rl

.gitattributes

@@ -0,0 +1 @@
+pnpm-lock.yaml -merge linguist-vendored

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: Dependency Age Check
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/dependency-age-check.yml
+      - pnpm-workspace.yaml
+      - pnpm-lock.yaml
+  pull_request:
+    branches: [main]
+    # labeled/unlabeled needed so the bypass-age-gate label re-triggers the gate
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.run_id || github.ref }}
+
+jobs:
+  dependency-check:
+    name: Check dependency age
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: runloopai/checkout@main
+
+      - name: Check dependency age (supply-chain gate)
+        uses: runloopai/lisan-al-gaib-action@main
+        with:
+          ecosystems: npm,actions
+          min-age-days: '7'
+          warn-age-days: '14'
+          bypass-keyword: 'bypass-age-gate'

.github/workflows/dependency-age-check.yml

@@ -4,20 +4,25 @@ on:
   push:
     branches: [main]
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   release:
     runs-on: ubuntu-slim
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          client-id: ${{ secrets.DEPLOY_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
         with:
+          token: ${{ steps.app-token.outputs.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 

.github/workflows/release.yml

@@ -6,3 +6,4 @@ coverage
 *.log
 package-lock.json
 src/mcp/index.js
+pnpm-lock.yaml

.prettierignore

@@ -66,7 +66,7 @@ export default {
 
   // Transform ignore patterns for node_modules
   transformIgnorePatterns: [
-    'node_modules/(?!(conf|@runloop|ink|react|ink-big-text|ink-gradient|ink-spinner|ink-text-input|ink-select-input|ink-box|ink-text|ink-testing-library|figures|is-unicode-supported)/)'
+    'node_modules/(?!(conf|@runloop|ink|react|ink-gradient|ink-spinner|ink-text-input|ink-select-input|ink-box|ink-text|ink-testing-library|figures|is-unicode-supported)/)'
   ],
 
   // Treat these extensions as ESM

jest.config.js

@@ -28,9 +28,10 @@
     "test:e2e": "NODE_OPTIONS='--experimental-vm-modules' jest --config jest.e2e.config.js --forceExit",
     "test:router": "NODE_OPTIONS='--experimental-vm-modules' jest --config jest.router.config.js --forceExit",
     "docs:commands": "pnpm run build && node scripts/generate-command-docs.js",
-    "prepare": "husky"
+    "prepare": "husky",
+    "actions:update": "actions-up --min-age 14 --exclude 'runloopai/.+'"
   },
-  "packageManager": "pnpm@9.15.4",
+  "packageManager": "pnpm@10.33.0",
   "keywords": [
     "runloop",
     "cli",
@@ -83,7 +84,6 @@
     "figures": "6.1.0",
     "gradient-string": "3.0.0",
     "ink": "6.6.0",
-    "ink-big-text": "2.0.0",
     "ink-gradient": "3.0.0",
     "ink-link": "5.0.0",
     "ink-spinner": "5.0.0",
@@ -94,38 +94,6 @@
     "yaml": "2.8.3",
     "zustand": "5.0.10"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ],
-    "overrides": {
-      "tmp": "^0.2.6",
-      "qs": "^6.15.2",
-      "ws": "^8.20.1",
-      "hono": "4.12.24",
-      "@hono/node-server": "^1.19.14",
-      "@modelcontextprotocol/sdk>ajv": "^8.18.0",
-      "express-rate-limit": "^8.3.2",
-      "fast-uri": "3.1.2",
-      "ip-address": "10.1.1",
-      "tar": "^7.5.13",
-      "flatted": "^3.4.2",
-      "handlebars": "^4.7.9",
-      "eslint>minimatch": "^3.1.3",
-      "eslint-plugin-react>minimatch": "^3.1.3",
-      "glob>minimatch": "^3.1.3",
-      "test-exclude>minimatch": "^3.1.3",
-      "@typescript-eslint/typescript-estree>minimatch": "^9.0.9",
-      "jest-util>picomatch": "^2.3.2",
-      "anymatch>picomatch": "^2.3.2",
-      "eslint>ajv": "^6.14.0",
-      "minimatch>brace-expansion": "^1.1.13",
-      "node-forge": "^1.4.0",
-      "micromatch>picomatch": "^2.3.2",
-      "tinyglobby>picomatch": "^4.0.4",
-      "path-to-regexp": "^8.4.2"
-    }
-  },
   "devDependencies": {
     "@anthropic-ai/mcpb": "2.1.2",
     "@types/adm-zip": "0.5.7",
@@ -135,6 +103,7 @@
     "@types/tar-stream": "3.1.4",
     "@typescript-eslint/eslint-plugin": "8.54.0",
     "@typescript-eslint/parser": "8.54.0",
+    "actions-up": "^1.14.2",
     "esbuild": "0.27.2",
     "eslint": "9.39.2",
     "eslint-plugin-react": "7.37.5",