Merge branch 'main' into dependabot/npm_and_yarn/typescript-7.0.2

Author: GizzZmo

.github/WORKFLOWS.md

@@ -25,20 +25,21 @@ All workflows have been enhanced with:
 
 **Jobs:**
 
-- **Build and Test** (Matrix: Node.js 18.x, 20.x):
+- **Build and Test** (Matrix: Node.js 20.x, 22.x) — *skipped for Dependabot*:
   - ✅ Install dependencies with npm ci
   - ✅ TypeScript type checking via `npm run typecheck`
   - ✅ **Run Vitest tests** with `npm run test:run`
   - ✅ Frontend build verification (Vite)
   - ✅ C++ server compilation with Make
   - ✅ Binary verification
-  - ✅ Upload build artifacts (dist/ and omnigrid_server)
-- **Code Quality Check**:
+  - ✅ Upload build artifacts (dist/ and omnigrid_server) for Node 20.x
+- **Dependabot Smoke** (Node 20 only) — *only for Dependabot PRs*:
+  - ✅ Typecheck + unit tests (lightweight gate; no matrix / C++ / coverage)
+- **Code Quality Check** (always runs, including Dependabot — **Prettier gate**):
   - ✅ **ESLint** validation with `npm run lint`
-  - ✅ **Prettier** format checking with `npm run format:check`
-  - ✅ Console.log detection (fails build if found in source)
+  - ✅ **Prettier** format checking with `npm run format:check` (fails CI on drift)
   - ✅ TODO/FIXME comment detection (warning only)
-- **Test Coverage**:
+- **Test Coverage** — *skipped for Dependabot*:
   - ✅ Run tests with coverage reporting
   - ✅ Upload coverage artifacts
   - ✅ **Post coverage report as PR comment**
@@ -188,7 +189,7 @@ All workflows have been enhanced with:
 
 **Schedule:** Weekly on Monday at 09:00 UTC
 
-**Purpose:** Automated dependency updates
+**Purpose:** Automated dependency updates with grouped PRs to reduce noise
 
 **Ecosystems:**
 
@@ -199,25 +200,43 @@ All workflows have been enhanced with:
 
 - Automatic PR creation for updates
 - Weekly schedule to minimize noise
-- Labels: `dependencies`, `automated`
+- Labels: `dependencies`, `npm` / `github-actions`, `automated`
 - Auto-reviewers assigned
+- **Grouped updates** (noise reduction):
+  - `production-dependencies` — minor/patch production deps
+  - `development-dependencies` — minor/patch dev deps
+  - `eslint-stack` — eslint, @eslint/*, @typescript-eslint/*
+  - `vitest-stack` — vitest, @vitest/*
+  - `testing-library` — @testing-library/*
+  - `github-actions` — all Actions minor/patch bumps
+- Major updates still open as individual PRs for review
 
 ---
 
 ### Auto-merge Dependabot (`auto-merge-dependabot.yml`)
 
 **Triggers:** Pull Request events from Dependabot
 
-**Purpose:** Automatically merge safe dependency updates
+**Purpose:** Automatically merge safe dependency updates and apply metadata labels
 
 **Jobs:**
 
 - **Auto-merge**:
-  - ✅ Fetch Dependabot metadata
+  - ✅ Fetch Dependabot metadata (`dependabot/fetch-metadata@v2`)
+  - ✅ **Ensure metadata labels exist** (`semver-major`, `semver-minor`, `semver-patch`, `production`, `development`, `npm`, `github-actions`)
+  - ✅ **Apply metadata labels** based on update-type, dependency-type, and package-ecosystem
   - ✅ Check update type (major/minor/patch)
   - ✅ Auto-approve minor and patch updates
   - ✅ Enable auto-merge for safe updates
-  - ✅ Comment on major updates requiring manual review
+  - ✅ Comment on major updates requiring manual review (with `semver-major` label)
+
+**Metadata labels applied:**
+
+| Label | Source |
+|-------|--------|
+| `semver-major` / `semver-minor` / `semver-patch` | `update-type` |
+| `production` / `development` | `dependency-type` |
+| `npm` / `github-actions` | `package-ecosystem` |
 
 **Safety:** Only auto-merges minor and patch updates
 
@@ -430,7 +449,7 @@ File: `.github/labeler.yml`
 
 **Automatic Labels:**
 
-- `documentation`: Changes to docs/\*_ or _.md files
+- `documentation`: Changes to docs/\*_ or \*.md files
 - `frontend`: Changes to components/, widgets/, \*.tsx files
 - `backend`: Changes to server/ or C++ files
 - `services`: Changes to services/
@@ -444,71 +463,14 @@ File: `.github/labeler.yml`
 - `size/S`: 10-49 lines changed
 - `size/M`: 50-199 lines changed
 - `size/L`: 200-499 lines changed
-- `size/XL`: 500+ lines changed
-
----
-
-## 🛠️ Development Commands
-
-### New Scripts Added
-
-```bash
-# Testing
-npm test              # Run tests in watch mode
-npm run test:run      # Run tests once
-npm run test:ui       # Run tests with UI
-npm run test:coverage # Run tests with coverage report
-
-# Linting & Formatting
-npm run lint          # Run ESLint
-npm run lint:fix      # Fix ESLint issues
-npm run format        # Format all files with Prettier
-npm run format:check  # Check formatting without changing files
-
-# Type Checking
-npm run typecheck     # Run TypeScript type checking
-
-# Building
-npm run build         # Build frontend
-npm run build:server  # Build C++ server
-npm run build:all     # Build both frontend and server
-npm run assets:generate # Generate screenshot asset manifest locally
-npm run artifacts:generate # Generate build artifact manifest locally (requires prior `npm run build`)
-```
+- `size/XL`: ≥ 500 lines changed
 
 ---
 
-## 🎯 Best Practices
-
-### For Contributors
-
-1. ✅ Run `npm run lint` and `npm run format:check` before committing
-2. ✅ Run `npm run test:run` to ensure all tests pass
-3. ✅ Keep PRs focused and reasonably sized (< 500 lines when possible)
-4. ✅ Update documentation for new features
-5. ✅ Add tests for bug fixes and new features
-6. ✅ Follow the PR template guidelines
-7. ✅ Ensure all CI checks pass before requesting review
-
-### For Maintainers
-
-1. ✅ Review security alerts from CodeQL and Dependabot promptly
-2. ✅ Monitor workflow performance reports
-3. ✅ Keep dependencies up to date
-4. ✅ Review and merge Dependabot PRs regularly
-5. ✅ Use workflow badges in README to communicate project health
-6. ✅ Check test coverage trends
-
----
-
-## 🔧 Maintenance
-
-### Regular Tasks
+## 🔄 Maintenance Schedule
 
-- **Daily**: Automated dependency audits and stale issue checks
-- **Weekly**:
-  - Review Dependabot PRs
-  - Check CodeQL security scan results
+- **Daily**: Stale bot, dependency audit (scheduled)
+- **Weekly**: Dependabot version updates (Monday 09:00 UTC), CodeQL
 - **Monthly**: Review stale issues and PRs manually
 - **Quarterly**:
   - Review and update workflow configurations
@@ -537,5 +499,5 @@ npm run artifacts:generate # Generate build artifact manifest locally (requires
 
 ---
 
-_Last Updated: 2026-05-28_  
+_Last Updated: 2026-08-20_  
 _For questions or issues with workflows, please open an issue with the `ci-cd` label._

.github/dependabot.yml

@@ -12,10 +12,44 @@ updates:
       - 'GizzZmo'
     labels:
       - 'dependencies'
+      - 'npm'
       - 'automated'
     commit-message:
       prefix: 'chore(deps):'
       include: 'scope'
+    # Group updates to reduce PR noise
+    groups:
+      production-dependencies:
+        dependency-type: 'production'
+        update-types:
+          - 'minor'
+          - 'patch'
+      development-dependencies:
+        dependency-type: 'development'
+        update-types:
+          - 'minor'
+          - 'patch'
+      eslint-stack:
+        patterns:
+          - 'eslint*'
+          - '@eslint/*'
+          - '@typescript-eslint/*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      vitest-stack:
+        patterns:
+          - 'vitest*'
+          - '@vitest/*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      testing-library:
+        patterns:
+          - '@testing-library/*'
+        update-types:
+          - 'minor'
+          - 'patch'
 
   # Enable version updates for GitHub Actions
   - package-ecosystem: 'github-actions'
@@ -34,3 +68,10 @@ updates:
     commit-message:
       prefix: 'chore(actions):'
       include: 'scope'
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'

.github/workflows/assets.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 20.x
 

.github/workflows/audit.yml

@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 20.x
           cache: 'npm'

.github/workflows/auto-merge-dependabot.yml

@@ -7,6 +7,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  issues: write
 
 jobs:
   auto-merge:
@@ -21,6 +22,64 @@ jobs:
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
 
+      - name: Ensure metadata labels exist
+        run: |
+          # Create SemVer + dependency-type labels if missing (idempotent)
+          declare -A LABELS=(
+            ["semver-major"]="Major version bump — requires manual review"
+            ["semver-minor"]="Minor version bump"
+            ["semver-patch"]="Patch version bump"
+            ["production"]="Production / runtime dependency"
+            ["development"]="Development / tooling dependency"
+            ["npm"]="npm package ecosystem"
+            ["github-actions"]="GitHub Actions ecosystem"
+          )
+          for name in "${!LABELS[@]}"; do
+            gh label create "$name" \
+              --description "${LABELS[$name]}" \
+              --color "0366d6" \
+              --force 2>/dev/null || true
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Apply Dependabot metadata labels
+        run: |
+          PR_URL="${{ github.event.pull_request.html_url }}"
+          LABELS=()
+
+          # SemVer labels from update-type
+          case "${{ steps.metadata.outputs.update-type }}" in
+            version-update:semver-major) LABELS+=("semver-major") ;;
+            version-update:semver-minor) LABELS+=("semver-minor") ;;
+            version-update:semver-patch) LABELS+=("semver-patch") ;;
+          esac
+
+          # Dependency type (direct:production / direct:development / indirect)
+          DEP_TYPE="${{ steps.metadata.outputs.dependency-type }}"
+          if [[ "$DEP_TYPE" == *"production"* ]]; then
+            LABELS+=("production")
+          elif [[ "$DEP_TYPE" == *"development"* ]]; then
+            LABELS+=("development")
+          fi
+
+          # Package ecosystem
+          case "${{ steps.metadata.outputs.package-ecosystem }}" in
+            npm)            LABELS+=("npm") ;;
+            github_actions) LABELS+=("github-actions") ;;
+          esac
+
+          # Apply any collected labels
+          if [ ${#LABELS[@]} -gt 0 ]; then
+            LABEL_ARGS=$(printf -- '--add-label %s ' "${LABELS[@]}")
+            gh pr edit "$PR_URL" $LABEL_ARGS
+            echo "Applied labels: ${LABELS[*]}"
+          else
+            echo "No additional metadata labels to apply"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Check if safe to auto-merge
         id: check_safe
         run: |
@@ -55,5 +114,5 @@ jobs:
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: '⚠️ **Major version update detected!** Please review this PR manually before merging.'
+              body: '⚠️ **Major version update detected!** Please review this PR manually before merging.\n\nLabel `semver-major` has been applied for triage.'
             })