ci: Add super-linter for pull requests

.github/DISCUSSION_TEMPLATE/feature-request-ideas.yml

@@ -1,7 +1,8 @@
-body:
-  - type: textarea
-    attributes:
-      label: Describe the feature you'd like
-      description: A clear and concise description of what you want to happen
-    validations:
-      required: true
+---
+body:
+  - type: textarea
+    attributes:
+      label: Describe the feature you'd like
+      description: A clear and concise description of what you want to happen
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,3 +1,4 @@
+---
 name: Report an issue
 description: Create a report to help us improve
 labels: ["bug"]

.github/ISSUE_TEMPLATE/config.yml

@@ -1,3 +1,4 @@
+---
 blank_issues_enabled: false
 contact_links:
   - name: Feature request / Ideas

.github/linters/.codespellrc

@@ -0,0 +1,2 @@
+[codespell]
+skip = */src/lang/*.json

.github/linters/.stylelintrc.json

@@ -0,0 +1,3 @@
+{
+  "extends": ["../../stylelint.config.mjs"]
+}

.github/linters/eslint.config.mjs

@@ -0,0 +1,3 @@
+import config from "../../eslint.config.mjs";
+
+export default config;

.github/linters/zizmor.yaml

@@ -0,0 +1,6 @@
+---
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

.github/workflows/lint.yml

@@ -0,0 +1,42 @@
+---
+name: Lint
+
+on:
+  pull_request: null
+
+permissions: {}
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      statuses: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: "pnpm"
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: super-linter
+        uses: super-linter/super-linter/slim@v8.4.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IGNORE_GITIGNORED_FILES: true
+          STRIP_DEFAULT_WORKSPACE_FOR_REGEX: true
+          FILTER_REGEX_EXCLUDE: ^(CHANGELOG\.md|pnpm-lock\.yaml)$
+          VALIDATE_BIOME_FORMAT: false # Prettier is used instead
+          VALIDATE_BIOME_LINT: false # Prettier is used instead
+          VALIDATE_JSCPD: false # TODO: Enable this linter in the future to detect code duplication

.github/workflows/publish-pre-release.yml

@@ -1,38 +1,45 @@
-name: Publish Pre-Release
-
-on:
-  release:
-    types:
-      - prereleased
-
-permissions:
-  contents: write
-
-jobs:
-  publish-chrome-pre-release:
-    name: Publish Pre-Release to Chrome Web Store
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-
-      - run: pnpm install --frozen-lockfile
-
-      - run: pnpm run build:chrome:pre-release
-
-      - run: gh release upload ${{ github.event.release.tag_name }} $(ls .output/*-chrome.zip)
-        env:
-          GITHUB_TOKEN: ${{ github.TOKEN }}
-
-      - run: pnpm wxt submit --chrome-zip .output/*-chrome.zip
-        env:
-          CHROME_EXTENSION_ID: adgcdimdkkaddeopcabokepmaihfhklb
-          CHROME_CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
-          CHROME_CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }}
-          CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}
+---
+name: Publish Pre-Release
+
+on:
+  release:
+    types:
+      - prereleased
+
+permissions: {}
+
+jobs:
+  publish-chrome-pre-release:
+    name: Publish Pre-Release to Chrome Web Store
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run build:chrome:pre-release
+
+      - run: gh release upload "${RELEASE_TAG}" "$(ls .output/*-chrome.zip)"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+
+      - run: pnpm wxt submit \
+          --chrome-zip .output/*-chrome.zip
+        env:
+          CHROME_EXTENSION_ID: adgcdimdkkaddeopcabokepmaihfhklb
+          CHROME_CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
+          CHROME_CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }}
+          CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}

.github/workflows/publish.yml

@@ -1,64 +1,78 @@
-name: Publish
-
-on:
-  release:
-    types:
-      - released
-
-permissions:
-  contents: write
-
-jobs:
-  publish-chrome:
-    name: Publish to Chrome Web Store
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-
-      - run: pnpm install --frozen-lockfile
-
-      - run: pnpm run build:chrome:release
-
-      - run: gh release upload ${{ github.event.release.tag_name }} $(ls .output/*-chrome.zip)
-        env:
-          GITHUB_TOKEN: ${{ github.TOKEN }}
-      - run: pnpm wxt submit --chrome-zip .output/*-chrome.zip
-        env:
-          CHROME_EXTENSION_ID: ldcanhhkffokndenejhafhlkapflgcjg
-          CHROME_CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
-          CHROME_CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }}
-          CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}
-
-  publish-firefox:
-    name: Publish to Firefox Addon Store
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-
-      - run: pnpm install --frozen-lockfile
-
-      - run: pnpm run build:firefox:release
-
-      - run: gh release upload ${{ github.event.release.tag_name }} $(ls .output/*-firefox.zip)
-        env:
-          GITHUB_TOKEN: ${{ github.TOKEN }}
-
-      - run: pnpm wxt submit --firefox-zip .output/*-firefox.zip --firefox-sources-zip .output/*-sources.zip
-        env:
-          FIREFOX_EXTENSION_ID: "{ea2ad5bc-e458-414d-8565-5cfe9f7cf0c2}"
-          FIREFOX_JWT_ISSUER: ${{ secrets.FIREFOX_JWT_ISSUER }}
-          FIREFOX_JWT_SECRET: ${{ secrets.FIREFOX_JWT_SECRET }}
+---
+name: Publish
+
+on:
+  release:
+    types:
+      - released
+
+permissions: {}
+
+jobs:
+  publish-chrome:
+    name: Publish to Chrome Web Store
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run build:chrome:release
+
+      - run: gh release upload "${RELEASE_TAG}" "$(ls .output/*-chrome.zip)"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+      - run: pnpm wxt submit --chrome-zip .output/*-chrome.zip
+        env:
+          CHROME_EXTENSION_ID: ldcanhhkffokndenejhafhlkapflgcjg
+          CHROME_CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
+          CHROME_CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }}
+          CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}
+
+  publish-firefox:
+    name: Publish to Firefox Addon Store
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run build:firefox:release
+
+      - run: gh release upload "${RELEASE_TAG}" "$(ls .output/*-firefox.zip)"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+
+      - run: pnpm wxt submit \
+          --firefox-zip .output/*-firefox.zip \
+          --firefox-sources-zip .output/*-sources.zip
+        env:
+          FIREFOX_EXTENSION_ID: "{ea2ad5bc-e458-414d-8565-5cfe9f7cf0c2}"
+          FIREFOX_JWT_ISSUER: ${{ secrets.FIREFOX_JWT_ISSUER }}
+          FIREFOX_JWT_SECRET: ${{ secrets.FIREFOX_JWT_SECRET }}

.github/workflows/release.yml

@@ -1,3 +1,4 @@
+---
 name: Release
 
 on:
@@ -6,8 +7,7 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   release:
@@ -23,6 +23,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: pnpm/action-setup@v4
 

.prettierignore

@@ -1 +1,3 @@
+CHANGELOG.md
+pnpm-lock.yaml
 src/routeTree.gen.ts

.redmine/README.md

@@ -1,25 +1,24 @@
-## Redmine dev setup
+# Redmine dev setup
 
 This folder provides local Redmine instances for manual testing against multiple Redmine versions.
 
-### Start a version
+## Start a version
 
-Run from this directory:
+Run from this directory (`.redmine`):
 
 ```bash
-cd .redmine
 docker compose up -d redmine-v6
 ```
 
 Available services and ports:
 
-- Redmine 6: http://localhost:3006 (service `redmine-v6`)
-- Redmine 5: http://localhost:3005 (service `redmine-v5`)
-- Redmine 4: http://localhost:3004 (service `redmine-v4`)
-- Redmine 3: http://localhost:3003 (service `redmine-v3`)
-- Redmine 2: http://localhost:3002 (service `redmine-v2`)
+- Redmine 6: [http://localhost:3006](http://localhost:3006) (service `redmine-v6`)
+- Redmine 5: [http://localhost:3005](http://localhost:3005) (service `redmine-v5`)
+- Redmine 4: [http://localhost:3004](http://localhost:3004) (service `redmine-v4`)
+- Redmine 3: [http://localhost:3003](http://localhost:3003) (service `redmine-v3`)
+- Redmine 2: [http://localhost:3002](http://localhost:3002) (service `redmine-v2`)
 
-### Notes
+## Notes
 
 - [Default credentials](https://hub.docker.com/_/redmine#accessing-the-application): `admin`/`admin`
 - [Themes](https://www.redmine.org/projects/redmine/wiki/theme_list) are mounted from `.redmine/themes`