* ci: migrate ESLint to Biome, optimize workflows, fix tar vulnerability
- Replace ESLint with Biome (15-25x faster linting)
- Pin Biome to 2.3.11 for consistent behavior across local/CI
- Disable useArrowFunction rule (breaks vitest constructor mocks)
- Add composite actions for DRY workflow setup
- Fix tar vulnerability (CVE-2026-23745) by upgrading to v7.5.3
- Add @electron/rebuild override to ensure consistent tar version
- Update electron-builder to 26.4.0
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix(workflows): address all 15 PR review findings
HIGH priority fixes:
- Add [email protected] override to frontend package.json (CVE-2026-23745)
- Use setup-node-frontend composite action in release.yml (4 build jobs)
- Use setup-node-frontend composite action in beta-release.yml (4 build jobs)
MEDIUM priority fixes:
- Add notarization status verification ('Accepted') before stapling
- Add blockmap files to beta-release asset copying (delta updates)
- Add DMG validation with fallback in release.yml
- Extract yq checksum to env block, single definition per step
- Fix snake_case to kebab-case in notarization action outputs
LOW priority fixes:
- Add config files (pyproject.toml, tsconfig*.json, biome.jsonc) to CI paths
- Document yq checksum requirement in merge-macos-manifests
- Always use jq for notarization ID parsing (no regex fallback)
- Add blockmap files to dry-run-summary job
- Change noControlCharactersInRegex from off to warn
- Rename biome.json to biome.jsonc, add comments explaining disabled rules
noSecrets rule kept off due to 2700+ false positives on normal strings.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix(lint): correct biome.jsonc path in workflow triggers
The lint workflow path filter referenced 'biome.json' but the actual
config file is 'biome.jsonc' (renamed to support comments). This fix
ensures the lint workflow triggers when the Biome config is modified.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix(workflows): address 6 PR review findings
- QUAL-001/002: Add DMG file existence checks before stapling
- QUAL-003: Quote all path variables in merge-macos-manifests
- QUAL-004: Add semver validation in update-readme.py
- QUAL-005: Document noDangerouslySetInnerHtml security rule decision
- LOGIC-001: Add warning when both notarization IDs are empty
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* feat(workflows): add gate jobs for branch protection
Add summary/gate jobs to match existing branch protection rules:
- CI Complete: aggregates test-python and test-frontend results
- Lint Complete: aggregates python and typescript lint results
- Security Summary: aggregates codeql and python-security results
These jobs provide a single status check for branch protection instead
of requiring individual job names which can change with matrix configs.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Claude Opus 4.5 <[email protected]>
