🔧 update: remove contributor rc file and update dependencies

.github/workflows/ci.yml

@@ -0,0 +1,92 @@
+name: CI
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: CI-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Lint Test Validate (Node.js ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [22, 24, 26]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Detect secrets
+        uses: gitleaks/gitleaks-action@v2.3.9
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@v5
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Lint
+        run: bunx biome check . --reporter=github
+
+      - name: Type checking
+        run: bun run type-check
+
+      - name: Run tests
+        run: bun run test
+
+      - name: Generate coverage
+        run: bun run test:coverage
+
+      - name: Build TypeScript
+        run: bun run build
+
+      - name: Node.js runtime smoke check
+        run: |
+          node <<'EOF'
+          const {
+            generateSignature,
+            verifySignature,
+          } = require('./dist/utils/signature.js');
+          const payload = '{"event":"message"}';
+          const secret = 'ci-secret';
+          const signature = generateSignature(payload, secret);
+          if (!verifySignature(payload, signature, secret)) {
+            throw new Error('Node runtime smoke check failed');
+          }
+          console.log('Node runtime smoke check passed on', process.version);
+          EOF
+
+      - name: Test Docker build (no push)
+        run: |
+          echo "Testing Docker build..."
+          docker build -t test-build .
+          echo "Build successful, cleaning up..."
+          docker image rm test-build
+          echo "Docker build test completed"

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: CodeQL-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  analyze:
+    name: Analyze (TypeScript)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:javascript-typescript

.github/workflows/container.yml

@@ -1,55 +1,54 @@
 name: Container
 
 on:
+  pull_request:
+    branches: [ dev, main ]
+  push:
+    branches: [ dev, main ]
   release:
-    types: [published]
+    types: [ published ]
+  workflow_dispatch:
+
+concurrency:
+  group: Container-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  build-production:
-    name: Build Production Images
+  ci:
+    name: CI Gate
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
+  codeql:
+    name: CodeQL Gate
+    uses: ./.github/workflows/codeql.yml
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
+  build:
+    name: Build Container Images
     runs-on: ubuntu-latest
+    needs: [ ci, codeql ]
     permissions:
       contents: read
       packages: write
       security-events: write
-
+      pull-requests: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
 
-      - name: Build and Push Production Container
-        uses: wgtechlabs/container-build-flow-action@v1.7.1
+      - name: Build and Push Container
+        uses: wgtechlabs/container-build-flow-action@v1.8.1
         with:
-          # Registry Configuration
           registry: both
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-
-          # Branch Configuration
-          main-branch: main
-          dev-branch: dev
-
-          # Image Configuration
-          image-name: unthread-webhook-server
-          dockerfile: ./Dockerfile
-          context: .
-          platforms: linux/amd64,linux/arm64
+          ghcr-token: ${{ github.token }}
+          floating-tags: true
           release-platforms: linux/amd64
-
-          # Build Arguments
-          build-args: |
-            NODE_VERSION=22.22-alpine3.23
-            RAILWAY_SERVICE_ID=${{ secrets.RAILWAY_SERVICE_ID }}
-
-          # Labels
-          labels: |
-            org.opencontainers.image.title=Unthread Webhook Server
-            org.opencontainers.image.description=A reliable, production-ready Node.js server for processing Unthread.io webhooks with signature verification and smart platform handling.
-            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
-            org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}
-            org.opencontainers.image.licenses=GPL-3.0
-
-          # Features
-          cache-enabled: true
-          provenance: true
-          sbom: true

.github/workflows/release.yml

@@ -2,25 +2,55 @@ name: Release
 
 on:
   push:
-    branches: [main]
+    branches: [ main ]
+  workflow_dispatch:
+
+concurrency:
+  group: Release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
+  ci:
+    name: CI Gate
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
+  codeql:
+    name: CodeQL Gate
+    uses: ./.github/workflows/codeql.yml
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
   release:
     name: Create Release
     runs-on: ubuntu-latest
+    needs: [ ci, codeql ]
     permissions:
       contents: write
+      pull-requests: write
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
+      - name: Verify GH_PAT is set
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+        run: |
+          if [ -z "$GH_PAT" ]; then
+            echo "::error::GH_PAT secret is required."
+            exit 1
+          fi
+
       - name: Create Release
         id: release
         uses: wgtechlabs/release-build-flow-action@v1.7.0
         with:
-          # Use PAT so the release event triggers downstream workflows
-          # (e.g., container build flow)
           github-token: ${{ secrets.GH_PAT }}
+          commit-convention: clean-commit