feat(ci): 拆分 CI 为 per-OS workflow + 新增 CodeQL/clang-tidy

- 新增 ubuntu.yml / macos.yml / windows.yml：各自独立运行 Debug+ASan / Debug+TSan / Release
- 精简 ci.yml 为额外检查：clang-format / clang-tidy / install-test
- 新增 codeql-analysis.yml：周一自动安全扫描
- 新增 .gitattributes / .gitignore / FUNDING.yml / ISSUE_TEMPLATE

Author: wicyn

.gitattributes

@@ -0,0 +1,9 @@
+# Mark third-party and build artifacts as vendored / excluded from stats
+benchmarks/taskflow/* linguist-vendored
+build/* linguist-vendored
+documentation/img/* linguist-vendored
+
+# C++ source files
+*.cpp linguist-language=C++
+*.hpp linguist-language=C++
+*.h linguist-language=C++

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# Repository for the funding models
+
+github: wicyn

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,30 @@
+---
+name: Bug report
+about: Create a report to help us improve
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior. Please include a minimal, self-contained code example:
+
+```cpp
+#include <taskflowlite/taskflowlite.hpp>
+
+int main() {
+    // minimal code that triggers the bug
+}
+```
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Environment:**
+ - OS: [e.g. Windows 11, Ubuntu 24.04, macOS 15]
+ - Compiler: [e.g. GCC 14.1, Clang 18.1, MSVC 19.40]
+ - C++ Standard: [e.g. C++23]
+ - TaskflowLite version/commit: [e.g. main @ a1b2c3d]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+---
+
+**Please describe your feature request.**
+A clear and concise description of what you want to happen, and the problem it solves. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: TaskflowLite CI
+name: CI Extras
 
 on:
   push:
@@ -14,11 +14,9 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # ============================================================================
-  # 代码格式检查（clang-format）
-  # ============================================================================
+  # clang-format
   clang-format:
-    name: clang-format check
+    name: clang-format
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -27,175 +25,20 @@ jobs:
     - name: Run clang-format
       run: find taskflowlite -name '*.hpp' -o -name '*.cpp' | xargs clang-format-18 --dry-run --Werror
 
-  # ============================================================================
-  # 编译 + 测试矩阵（OS × BuildType × Sanitizer）
-  # ============================================================================
-  build-and-test:
-    name: ${{ matrix.os }} | ${{ matrix.build_type }} | San=${{ matrix.sanitizer }}
-    runs-on: ${{ matrix.os }}
-    needs: clang-format
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # ── Ubuntu GCC ──
-          - os: ubuntu-latest
-            compiler: gcc
-            build_type: Release
-            sanitizer: OFF
-          - os: ubuntu-latest
-            compiler: gcc
-            build_type: Debug
-            sanitizer: ASAN
-          - os: ubuntu-latest
-            compiler: gcc
-            build_type: Debug
-            sanitizer: TSAN
-
-          # ── Ubuntu Clang ──
-          - os: ubuntu-latest
-            compiler: clang
-            build_type: Release
-            sanitizer: OFF
-          - os: ubuntu-latest
-            compiler: clang
-            build_type: Debug
-            sanitizer: ASAN
-
-          # ── macOS ──
-          - os: macos-latest
-            compiler: clang
-            build_type: Release
-            sanitizer: OFF
-          - os: macos-latest
-            compiler: clang
-            build_type: Debug
-            sanitizer: ASAN
-          - os: macos-latest
-            compiler: clang
-            build_type: Debug
-            sanitizer: TSAN
-
-          # ── Windows MSVC ──
-          - os: windows-latest
-            compiler: msvc
-            build_type: Release
-            sanitizer: OFF
-          - os: windows-latest
-            compiler: msvc
-            build_type: Debug
-            sanitizer: ASAN
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    # ── 编译器配置 ──
-    - name: Setup GCC
-      if: matrix.compiler == 'gcc'
-      run: |
-        sudo apt-get update -qq
-        sudo apt-get install -y -qq g++-14
-        echo "CC=gcc-14" >> $GITHUB_ENV
-        echo "CXX=g++-14" >> $GITHUB_ENV
-
-    - name: Setup Clang
-      if: matrix.compiler == 'clang'
-      run: |
-        wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
-        sudo add-apt-repository -y "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-18 main"
-        sudo apt-get update -qq
-        sudo apt-get install -y -qq clang-18 libc++-18-dev libc++abi-18-dev
-        echo "CC=clang-18" >> $GITHUB_ENV
-        echo "CXX=clang++-18" >> $GITHUB_ENV
-
-    # ── ccache 加速 ──
-    - name: Setup ccache
-      if: matrix.os != 'windows-latest'
-      uses: hendrikmuhs/ccache-action@v1
-      with:
-        key: ${{ matrix.os }}-${{ matrix.compiler }}-${{ matrix.build_type }}
-
-    - name: Configure ccache (MSVC)
-      if: matrix.os == 'windows-latest'
-      uses: actions/cache@v4
-      with:
-        path: ~/ccache
-        key: ccache-${{ matrix.os }}-${{ matrix.build_type }}-${{ github.run_id }}
-        restore-keys: ccache-${{ matrix.os }}-${{ matrix.build_type }}-
-
-    # ── CMake 配置 ──
-    - name: Configure CMake
-      run: >
-        cmake -S . -B build
-        -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}
-        -DTASKFLOWLITE_BUILD_TESTS=ON
-        -DTASKFLOWLITE_BUILD_EXAMPLES=ON
-        -DTASKFLOWLITE_SANITIZER=${{ matrix.sanitizer }}
-        ${{ matrix.os == 'windows-latest' && '-T ClangCL' || '' }}
-
-    # ── 编译 ──
-    - name: Build
-      run: cmake --build build --config ${{ matrix.build_type }} --parallel ${{ runner.os == 'macOS' && '3' || '4' }}
-
-    # ── Windows ASan DLL 准备 ──
-    - name: Copy ASan DLLs (Windows)
-      if: matrix.os == 'windows-latest' && matrix.sanitizer == 'ASAN'
-      shell: pwsh
-      working-directory: ${{ github.workspace }}/build
-      run: |
-        $vsPath = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
-        $msvcVer = (Get-ChildItem "$vsPath\VC\Tools\MSVC" | Sort-Object Name -Descending | Select-Object -First 1).Name
-        $asanDir = "$vsPath\VC\Tools\MSVC\$msvcVer\bin\Hostx64\x64"
-        Get-ChildItem -Path . -Filter "TaskflowLiteTest.exe" -Recurse | ForEach-Object {
-          Copy-Item -Path "$asanDir\clang_rt.asan*.dll" -Destination $_.DirectoryName -Force
-        }
-
-    # ── 运行测试 (Unix) ──
-    - name: Run Tests (Unix)
-      if: matrix.os != 'windows-latest'
-      working-directory: ${{ github.workspace }}/build
-      env:
-        TSAN_OPTIONS: ${{ matrix.sanitizer == 'TSAN' && format('suppressions={0}/tsan_suppressions.txt second_deadlock_stack=1 history_size=7', github.workspace) || '' }}
-        ASAN_OPTIONS: ${{ matrix.sanitizer == 'ASAN' && 'halt_on_error=1:abort_on_error=1:print_stacktrace=1:detect_leaks=1' || '' }}
-        UBSAN_OPTIONS: ${{ matrix.sanitizer == 'ASAN' && 'halt_on_error=1:print_stacktrace=1' || '' }}
-        CTEST_OUTPUT_ON_FAILURE: '1'
-      run: |
-        if [ "${{ matrix.sanitizer }}" = "TSAN" ]; then
-          printf '%s\n' \
-            'race:Catch::RunContext' \
-            'race:Catch::Detail' \
-            'race:Catch::StringStreams' \
-            'race:Catch::OutputRedirect' \
-            'race:Catch::ConsoleReporter' \
-            'race:__sanitizer::IsAccessibleMemoryRange' \
-            > ${{ github.workspace }}/tsan_suppressions.txt
-        fi
-        ctest -C ${{ matrix.build_type }} --output-on-failure -j2
-
-    # ── 运行测试 (Windows) ──
-    - name: Run Tests (Windows)
-      if: matrix.os == 'windows-latest'
-      working-directory: ${{ github.workspace }}/build
-      run: ctest -C ${{ matrix.build_type }} --output-on-failure -j2
-
-  # ============================================================================
-  # 额外：Clang-Tidy 静态分析
-  # ============================================================================
+  # clang-tidy (PR only)
   clang-tidy:
-    name: clang-tidy analysis
+    name: clang-tidy
     runs-on: ubuntu-latest
-    needs: clang-format
     if: github.event_name == 'pull_request'
     steps:
     - uses: actions/checkout@v4
-    - name: Install tools
+    - name: Install clang-tidy
       run: |
         wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
         sudo add-apt-repository -y "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-18 main"
         sudo apt-get update -qq
         sudo apt-get install -y -qq clang-tidy-18
-    - name: Configure CMake
+    - name: Configure
       run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DTASKFLOWLITE_BUILD_TESTS=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
     - name: Run clang-tidy
       run: |
@@ -204,24 +47,20 @@ jobs:
           --checks='-*,bugprone-*,performance-*,modernize-use-nullptr,modernize-use-override' \
           --warnings-as-errors='bugprone-*'
 
-  # ============================================================================
-  # 发布构建验证（Install + 消费测试）
-  # ============================================================================
+  # install + consumer test
   install-test:
-    name: install + consumer test
+    name: install + consumer
     runs-on: ubuntu-latest
-    needs: clang-format
     steps:
     - uses: actions/checkout@v4
     - name: Configure
       run: cmake -S . -B build -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/install
     - name: Install
       run: cmake --install build
-    - name: Verify installed files
+    - name: Verify
       run: |
         test -f install/include/taskflowlite/taskflowlite.hpp
         test -f install/lib/cmake/TaskflowLite/TaskflowLiteConfig.cmake
-        echo "Install verified OK"
     - name: Consumer test
       run: |
         mkdir -p /tmp/test-consumer
@@ -245,4 +84,3 @@ jobs:
         cmake -S /tmp/test-consumer -B /tmp/test-consumer/build \
           -DCMAKE_PREFIX_PATH=${{ github.workspace }}/install
         cmake --build /tmp/test-consumer/build
-        echo "Consumer build OK"

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,32 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '30 2 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+    steps:
+    - uses: actions/checkout@v4
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: cpp
+    - name: Build
+      run: |
+        cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DTASKFLOWLITE_BUILD_TESTS=ON
+        cmake --build build --parallel $(nproc)
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3

.github/workflows/macos.yml

@@ -0,0 +1,48 @@
+name: macOS
+
+on: [push, pull_request]
+
+jobs:
+
+  # Debug + ASan/UBSan
+  debug-asan:
+    runs-on: macos-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Configure
+      run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DTASKFLOWLITE_BUILD_TESTS=ON -DTASKFLOWLITE_SANITIZER=ASAN
+    - name: Build
+      run: cmake --build build --parallel $(sysctl -n hw.logicalcpu)
+    - name: Test
+      working-directory: build
+      run: ctest --output-on-failure
+
+  # Debug + TSan
+  debug-tsan:
+    runs-on: macos-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Configure
+      run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DTASKFLOWLITE_BUILD_TESTS=ON -DTASKFLOWLITE_SANITIZER=TSAN
+    - name: Build
+      run: cmake --build build --parallel $(sysctl -n hw.logicalcpu)
+    - name: Test
+      working-directory: build
+      env:
+        TSAN_OPTIONS: suppressions=tsan_suppressions.txt second_deadlock_stack=1 history_size=7
+      run: |
+        printf 'race:Catch::RunContext\nrace:Catch::Detail\nrace:__sanitizer::IsAccessibleMemoryRange\n' > tsan_suppressions.txt
+        ctest --output-on-failure
+
+  # Release
+  release:
+    runs-on: macos-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Configure
+      run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DTASKFLOWLITE_BUILD_TESTS=ON
+    - name: Build
+      run: cmake --build build --parallel $(sysctl -n hw.logicalcpu)
+    - name: Test
+      working-directory: build
+      run: ctest --output-on-failure