ci: replace deprecated dependabot auto-merge action with gh CLI

.commitlintrc

@@ -1,5 +1,3 @@
 {
-  "extends": [
-    "airlight"
-  ]
+  "extends": ["@commitlint/config-conventional"]
 }

.github/dependabot.yml

@@ -9,3 +9,10 @@ updates:
       include: scope
     schedule:
       interval: daily
+  - package-ecosystem: github-actions
+    open-pull-requests-limit: 10
+    directory: /
+    commit-message:
+      prefix: ci
+    schedule:
+      interval: weekly

.github/workflows/automerge.yml

@@ -0,0 +1,22 @@
+name: Dependabot auto-merge
+
+# pull_request_target is required for dependabot PRs (secrets are withheld
+# from pull_request runs for them); this workflow never checks out PR code
+on: pull_request_target
+
+permissions:
+  contents: write
+
+jobs:
+  auto-merge:
+    timeout-minutes: 5
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    steps:
+      - run: |
+          gh pr review ${{ env.PR_NUMBER }} --comment -b "LGTM!"
+          gh pr review ${{ env.PR_NUMBER }} --approve
+          gh pr merge ${{ env.PR_NUMBER }} --auto --squash
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}

.github/workflows/lgtm.yml

@@ -0,0 +1,25 @@
+name: LGTM auto-approve
+
+# approves maintainer PRs using only the workflow token (no configured
+# secrets, no pull_request_target); dependabot approvals are handled by
+# automerge.yml, and fork PRs are never auto-approved
+on: pull_request
+
+permissions:
+  pull-requests: write
+
+jobs:
+  lgtm:
+    timeout-minutes: 5
+    if: >-
+      github.actor == 'dalisoft' &&
+      github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-22.04
+    steps:
+      - run: |
+          gh pr review "$PR_NUMBER" --repo "$GH_REPO" --comment -b "LGTM!" || true
+          gh pr review "$PR_NUMBER" --repo "$GH_REPO" --approve
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.number }}

.github/workflows/lint_test_release.yml

@@ -1,5 +1,4 @@
-# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+# This workflow will do a clean install of dependencies, build the source code and run tests
 
 name: Linting, Testing and Release
 
@@ -15,66 +14,91 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7.0.1
 
-      - name: Use Node.js
-        uses: actions/setup-node@v3
+      - name: Use Bun.sh
+        uses: oven-sh/setup-bun@v2.2.0
         with:
-          node-version: 18
-          cache: 'npm'
+          bun-version: 1.4.2
+
+      - name: Cache
+        uses: actions/cache@v6.1.0
+        with:
+          path: '~/.bun/install/cache'
+          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 
       - name: Install
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Lint code
-        run: npm run lint
+        run: bun run lint
   test:
     needs: lint
     runs-on: ${{ matrix.os }}
 
     strategy:
       matrix:
-        node-version: [18]
+
         os: [ubuntu-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7.0.1
+
+      - name: Use Bun.sh
+        uses: oven-sh/setup-bun@v2.2.0
+        with:
+          bun-version: 1.4.2
 
-      - name: Use Node.js
-        uses: actions/setup-node@v3
+      - name: Use Node.js 26 (node:test runtime)
+        uses: actions/setup-node@v7.0.0
         with:
-          node-version: ${{ matrix.node-version }}
-          cache: 'npm'
+          node-version: 26
+
+      - name: Cache
+        uses: actions/cache@v6.1.0
+        with:
+          path: '~/.bun/install/cache'
+          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 
       - name: Install
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Build code
-        run: npm run build
+        run: bun run build
 
       - name: Test code
-        run: npm run test
+        run: bun run test
   release:
     needs: test
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7.0.1
+
+      - name: Use Bun.sh
+        uses: oven-sh/setup-bun@v2.2.0
+        with:
+          bun-version: 1.4.2
 
-      - name: Use Node.js
-        uses: actions/setup-node@v3
+      - name: Cache
+        uses: actions/cache@v6.1.0
         with:
-          node-version: 18
-          cache: 'npm'
+          path: '~/.bun/install/cache'
+          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 
       - name: Install
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Build code
-        run: npm run build
+        run: bun run build
 
       - name: Release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_USERNAME: ${{ vars.GIT_USERNAME }}
+          GIT_EMAIL: ${{ vars.GIT_EMAIL }}
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}
+          GPG_KEY: ${{ secrets.GPG_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npx semantic-release
+        run: bun run release-me --plugins=npm,npm-post,git,github-release

.github/workflows/pull_request.yml

@@ -1,9 +1,14 @@
-# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+# This workflow will do a clean install of dependencies, build the source code and run tests
 
 name: Linting, Testing and Auto-merge
 
-on: pull_request_target
+# runs on the PR head without repo secrets (dependabot auto-merge lives in
+# automerge.yml, the only pull_request_target workflow, and it never checks
+# out PR code)
+on: pull_request
+
+permissions:
+  contents: read
 
 env:
   CI: true
@@ -14,40 +19,35 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18]
         os: [ubuntu-latest]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7.0.1
+
+      - name: Use Bun.sh
+        uses: oven-sh/setup-bun@v2.2.0
+        with:
+          bun-version: 1.4.2
+
+      - name: Use Node.js 26 (node:test runtime)
+        uses: actions/setup-node@v7.0.0
+        with:
+          node-version: 26
 
-      - name: Use Node.js
-        uses: actions/setup-node@v3
+      - name: Cache
+        uses: actions/cache@v6.1.0
         with:
-          node-version: ${{ matrix.node-version }}
-          cache: 'npm'
+          path: '~/.bun/install/cache'
+          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
 
       - name: Install
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Lint code
-        run: npm run lint
+        run: bun run lint
 
       - name: Build code
-        run: npm run build
+        run: bun run build
 
       - name: Test code
-        run: npm run test
-  auto-merge:
-    needs: lint_test_build
-    timeout-minutes: 5
-
-    runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
-
-    steps:
-      - uses: actions/checkout@v3
-      - uses: ahmadnassri/action-dependabot-auto-merge@v2
-        with:
-          target: minor
-          approve: true
-          github-token: ${{ secrets.GH_TOKEN }}
+        run: bun run test

.ls-lint.yml

@@ -2,7 +2,7 @@ ls:
   src:
     .dir: kebab-case
     .js: kebab-case
-    .spec.js: kebab-case | pointcase
+    .spec.js: kebab-case
 
 ignore:
   - .git

.oxlintrc.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "ignorePatterns": [
+    "**/cjs/**",
+    "**/esm/**",
+    "**/typings/**",
+    "**/dist/**",
+    "**/coverage/**",
+    "**/bench.tmp.mjs"
+  ]
+}