Merge pull request #12 from ohgodwhy2k/new-workflows

feat: New workflows

Author: ohgodwhy2k

.github/workflows/bundle-size.yml

@@ -0,0 +1,30 @@
+name: Bundle size check
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  workflow_dispatch:
+
+jobs:
+  bundle_size_check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build project
+        run: npm install && npm run build
+
+      - name: Report bundle size
+        uses: preactjs/[email protected]
+        with:
+          # 1. The mandatory 'repo-token' is now provided
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+          # 2. 'path' is replaced by 'pattern' for glob matching
+          pattern: '**/*.{js,css}'
+
+          # Show the total size of all tracked files (useful)
+          show-total: true

.github/workflows/security-audit.yml

@@ -0,0 +1,32 @@
+name: Security Audit
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  # Allow manual trigger
+  workflow_dispatch:
+
+jobs:
+  npm-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        # This step is critical for npm audit to work
+        run: npm ci
+
+      - name: Run npm audit
+        # The `--audit-level=high` flag only fails the check for HIGH or CRITICAL severity vulnerabilities
+        # Remove the flag to check all levels, or change it to 'critical' to be less strict.
+        run: npm audit --audit-level=high

.github/workflows/stale.yml

@@ -0,0 +1,35 @@
+name: Close Stale Issues and PRs
+
+on:
+  schedule:
+    # Run once a day at 10:30 UTC
+    - cron: '30 10 * * *'
+  workflow_dispatch:
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/stale@v9
+        with:
+          # --- Consolidated Days Inputs (These are correct) ---
+          days-before-stale: 30
+          days-before-close: 7
+
+          # --- Explicit Label Inputs (Corrected for the error) ---
+          stale-issue-label: 'stale'
+          stale-pr-label: 'stale' # Use the same label for both issues and PRs
+
+          # --- Message Inputs ---
+          stale-issue-message: 'This issue is stale because it has been open for 30 days without activity. It will be automatically closed in 7 days unless a comment is made or the stale label is removed.'
+          close-issue-message: 'This issue was closed because it has been stalled for 7 days with no activity.'
+
+          stale-pr-message: 'This PR is stale because it has been open for 30 days without activity. It will be automatically closed in 7 days unless a comment is made or the stale label is removed.'
+          close-pr-message: 'This PR was closed because it has been stalled for 7 days with no activity.'
+
+          # --- Exemption Inputs ---
+          exempt-issue-labels: 'bug, enhancement, documentation'
+          exempt-pr-labels: 'in progress'