release: v2.10.5 add Dependabot config for npm and actions #58

	name: Deploy to production

	on:
	push:
	branches:
	- main

	concurrency:
	group: production-deploy
	cancel-in-progress: false

	jobs:
	deploy:
	name: Build and FTP deploy
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Setup Node
	uses: actions/setup-node@v6
	with:
	node-version: "22"
	cache: npm

	- name: Install dependencies
	# The committed package-lock.json is generated on Windows and only
	# records the host platform's optional native binaries (rolldown
	# bindings). Both `npm ci` and `npm install` honor that lockfile and
	# skip the linux-x64-gnu binding this Ubuntu runner needs, breaking
	# vite/rolldown at test time (npm/cli#4828). Removing the lockfile lets
	# npm resolve the correct binary for the runner platform. The lockfile
	# stays committed for local dev and Dependabot.
	run: \|
	rm -f package-lock.json
	npm install --no-audit --no-fund

	- name: Run tests
	run: npm test

	- name: Build
	run: npm run build

	- name: Sync dist via FTPS
	uses: SamKirkland/FTP-Deploy-Action@v4.4.0
	with:
	# FTP_HOST must match the CN/SAN on the FTPS server's TLS cert
	# (typically the bare shared-hosting hostname), not a vanity FQDN
	# like ftp.example.com. With `security: strict`, hostname mismatch
	# aborts the deploy.
	server: ${{ secrets.FTP_HOST }}
	username: ${{ secrets.FTP_USERNAME_PRODUCTION }}
	password: ${{ secrets.FTP_PASSWORD_PRODUCTION }}
	server-dir: ./
	local-dir: ./dist/
	protocol: ftps
	port: 21
	security: strict
	dangerous-clean-slate: false

Provide feedback