chore: renovate semantic commit type

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @afonsojramos @setchy

.github/dependabot.yml

@@ -1,9 +1,16 @@
 version: 2
 updates:
-- package-ecosystem: npm
-  directory: "/"
-  schedule:
-    interval: weekly
-    time: "02:00"
-    timezone: Europe/Berlin
-  open-pull-requests-limit: 10
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      time: "02:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 10
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      time: "02:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 10

.github/workflows/build.yml

@@ -0,0 +1,35 @@
+name: Build
+
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+        branches:
+            - main
+
+permissions: {}
+
+jobs:
+    build:
+        name: Build [vp pack]
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+                  cache: pnpm
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+            - name: Build library
+              run: pnpm run build

.github/workflows/e2e.yml

@@ -0,0 +1,135 @@
+name: E2E
+
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+        branches:
+            - main
+
+permissions: {}
+
+jobs:
+    e2e:
+        name: E2E [${{ matrix.label }}]
+        runs-on: ${{ matrix.runner }}
+        permissions:
+            contents: read
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - runner: macos-26
+                      label: macOS 26 (Tahoe)
+                      key: macos-26
+                    - runner: macos-15
+                      label: macOS 15 (Sequoia)
+                      key: macos-15
+                    - runner: macos-14
+                      label: macOS 14 (Sonoma)
+                      key: macos-14
+                    - runner: windows-2025
+                      label: Windows Server 2025
+                      key: windows-2025
+                    - runner: windows-2022
+                      label: Windows Server 2022
+                      key: windows-2022
+                    - runner: ubuntu-24.04
+                      label: Ubuntu 24.04
+                      key: ubuntu-24.04
+                    - runner: ubuntu-22.04
+                      label: Ubuntu 22.04
+                      key: ubuntu-22.04
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+                  cache: pnpm
+            - name: Install dependencies
+              shell: bash
+              run: |
+                  # pnpm does not reliably run electron's postinstall via
+                  # allowBuilds, so invoke its installer explicitly to fetch the
+                  # binary (path.txt). Verify with a require() before proceeding.
+                  for attempt in 1 2 3; do
+                      if pnpm install --frozen-lockfile && node node_modules/electron/install.js && node -e "require('electron')" >/dev/null 2>&1; then
+                          exit 0
+                      fi
+                      echo "::warning::install attempt $attempt failed (often electron 502); retrying..."
+                      sleep $((attempt * 5))
+                  done
+                  echo "::error::install failed after 3 attempts"
+                  exit 1
+            - name: Build library
+              run: pnpm run build
+            - name: Run E2E (Linux)
+              if: runner.os == 'Linux'
+              env:
+                  E2E_PLATFORM_KEY: ${{ matrix.key }}
+                  E2E_PLATFORM_LABEL: ${{ matrix.label }}
+                  GITHUB_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+              run: xvfb-run --auto-servernum -- pnpm exec playwright test --config tests/e2e/playwright.config.ts
+            - name: Run E2E (macOS / Windows)
+              if: runner.os != 'Linux'
+              env:
+                  E2E_PLATFORM_KEY: ${{ matrix.key }}
+                  E2E_PLATFORM_LABEL: ${{ matrix.label }}
+                  GITHUB_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+              run: pnpm exec playwright test --config tests/e2e/playwright.config.ts
+            - name: Upload platform result
+              if: always()
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              with:
+                  name: platform-${{ matrix.key }}
+                  path: test-results/platforms/${{ matrix.key }}.json
+                  if-no-files-found: warn
+                  retention-days: 14
+
+    update-platforms:
+        name: Update PLATFORMS table
+        needs: e2e
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            pull-requests: write
+        steps:
+            - name: Checkout
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+            - name: Download all platform results
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+              with:
+                  pattern: platform-*
+                  merge-multiple: true
+                  path: test-results/platforms
+            - name: Regenerate PLATFORMS block
+              run: node tests/e2e/update-platforms.mts
+            - name: Open PR if changed
+              uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+              with:
+                  commit-message: "docs: refresh tested platforms table"
+                  title: "docs: refresh tested platforms table"
+                  body: |
+                      Auto-generated update to `PLATFORMS.md` from the latest E2E matrix run on `main`.
+
+                      Source: [E2E workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
+                  branch: chore/update-platforms-table
+                  base: main
+                  delete-branch: true
+                  add-paths: PLATFORMS.md
+                  sign-commits: true

.github/workflows/lint.yml

@@ -3,18 +3,33 @@ name: Linting
 on:
     push:
         branches:
-            - master
+            - main
     pull_request:
+        branches:
+            - main
+
+permissions: {}
 
 jobs:
     lint:
         name: Lint
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
 
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - name: Checkout
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
-                  node-version-file: '.nvmrc'
-            - run: yarn install
-            - run: yarn lint
+                  node-version-file: .node-version
+                  cache: pnpm
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+            - name: Run linter
+              run: pnpm run lint:check

.github/workflows/publish.yml

@@ -0,0 +1,41 @@
+name: Publish
+
+on:
+    workflow_call:
+    workflow_dispatch:
+
+permissions: {}
+
+jobs:
+    publish:
+        name: Publish to npm
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write # for npm OIDC trusted publishing + provenance
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: .node-version
+                  registry-url: https://registry.npmjs.org
+                  cache: pnpm
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+            - name: Type check
+              run: pnpm run typecheck
+            - name: Run tests
+              run: pnpm run test
+            - name: Build library
+              run: pnpm run build
+            - name: Publish to npm
+              # Auth + provenance via OIDC trusted publishing (no NPM_TOKEN needed).
+              # Requires the npm package to trust the entry-point workflow (release.yml).
+              run: npm publish --provenance --access public

.github/workflows/release.yml

@@ -0,0 +1,32 @@
+name: Release
+
+on:
+    push:
+        branches:
+            - main
+
+permissions: {}
+
+jobs:
+    release-please:
+        name: Release Please
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            pull-requests: write
+        outputs:
+            release_created: ${{ steps.release.outputs.release_created }}
+            tag_name: ${{ steps.release.outputs.tag_name }}
+        steps:
+            - name: Run release-please
+              id: release
+              uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+
+    publish:
+        name: Publish
+        needs: release-please
+        if: ${{ needs.release-please.outputs.release_created == 'true' }}
+        permissions:
+            contents: read
+            id-token: write # for npm OIDC trusted publishing + provenance
+        uses: ./.github/workflows/publish.yml

.github/workflows/test.yml

@@ -1,20 +1,37 @@
-name: Run Tests
+name: Test
 
 on:
     push:
         branches:
-            - master
+            - main
     pull_request:
+        branches:
+            - main
+
+permissions: {}
 
 jobs:
-    lint:
+    test:
         name: Run Tests
         runs-on: macos-latest
+        permissions:
+            contents: read
 
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - name: Checkout
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
-                  node-version-file: '.nvmrc'
-            - run: yarn install
-            - run: yarn test
+                  node-version-file: .node-version
+                  cache: pnpm
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+            - name: Type check
+              run: pnpm run typecheck
+            - name: Run tests
+              run: pnpm run test

.github/workflows/triage.yml

@@ -0,0 +1,32 @@
+name: Triage PR
+
+on:
+    # `pull_request_target` is required so the title-validator can write
+    # statuses on PRs from forks (under `pull_request`, GitHub forces
+    # GITHUB_TOKEN to read-only for fork PRs). Safe here because this
+    # workflow:
+    #   - never checks out PR code (no actions/checkout),
+    #   - has no `run:` steps that interpolate PR fields,
+    #   - only invokes a SHA-pinned action that reads PR metadata via the API.
+    pull_request_target:
+        branches:
+            - main
+        types:
+            - opened
+            - reopened
+            - edited
+            - synchronize
+            - ready_for_review
+
+permissions: {}
+
+jobs:
+    pr-title:
+        name: Validate PR title [conventional commits]
+        runs-on: ubuntu-latest
+        permissions:
+            pull-requests: read
+        steps:
+            - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}