Feat: Setup CI workflow and add some new rules

.github/pr-labeler.yaml

@@ -0,0 +1,6 @@
+BC: ['bc/*', 'break/*']
+feature: ['feature/*', 'feat/*']
+bug: ['fix/*', 'bugfix/*']
+refactoring: ['refactor/*', 'refactoring/*']
+documentation: ['docs/*', 'documentation/*']
+maintenance: ['maintenance/*', 'chore/*']

.github/workflows/git.yaml

@@ -0,0 +1,14 @@
+name: 🔍 Git Checks
+
+on: [pull_request]
+
+jobs:
+  block-fixup-merge:
+    name: 🚫 Merge Blocked by Git Fixup
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Block Fixup Commit Merge
+        uses: 13rac1/block-fixup-merge-action@bd5504fb9ca0253e109d98eb86b7debc01970cdc # v2.0.0

.github/workflows/pr-meta.yaml

@@ -0,0 +1,23 @@
+name: Pull Request Meta
+
+on:
+  pull_request:
+    types: [opened, reopened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  process_pr_meta:
+    name: Process PR meta
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Assign to author
+        uses: toshimaru/auto-author-assign@16f0022cf3d7970c106d8d1105f75a1165edb516 # v2.1.1
+
+      - name: Add labels
+        uses: TimonVS/pr-labeler-action@f9c084306ce8b3f488a8f3ee1ccedc6da131d1af # v5.0.0
+        with:
+          configuration-path: .github/pr-labeler.yaml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.prettierrc.json

@@ -0,0 +1,3 @@
+{
+  "proseWrap": "always"
+}

.renovaterc.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>literat/renovate-config",
+    "local>literat/renovate-config:scheduleEveryTwoWeeksNonOfficeHours",
+    ":dependencyDashboard"
+  ],
+  "enabledManagers": ["github-actions"]
+}

default.json

@@ -5,11 +5,17 @@
     ":ignoreModulesAndTests",
     ":autodetectPinVersions",
     "workarounds:all",
-    ":prConcurrentLimit10"
+    ":prConcurrentLimit10",
+    "helpers:pinGitHubActionDigests"
   ],
   "labels": [
     "dependencies"
   ],
   "branchPrefix": "dependencies/",
-  "commitMessagePrefix": "deps: "
+  "commitMessagePrefix": "deps: ",
+  "baseBranches": ["main"],
+  // Security and Stability: Wait at least 7 days before updating any new version
+  // Delay the supply chain attack impact by waiting
+  // @see: https://docs.renovatebot.com/configuration-options/#minimumreleaseage
+  "minimumReleaseAge": "7d"
 }