release: promote next to main (Node 22 CI fix + Supabase removal) (#750)

* docs(annexes): update available meta-plugins list

Signed-off-by: Salvydas Lukosius <ss-o@users.noreply.github.com>

* docs: update Zi paths to XDG base dir defaults and refresh short URLs

- Replace hardcoded ~/.zi paths with ${XDG_DATA_HOME:-$HOME/.local/share}/zi
- Update ZI[HOME_DIR]/ZI[BIN_DIR] defaults in installation and commands guides
- Update ZPFX/polaris references across plugin standard, customization,
  bin-gem-node annex, syntax guide, and zi_console docs
- Replace deprecated git.io short URLs with zshell.dev equivalents

* docs(community): add ZUnit testing framework section

Introduces community/04_zunit/ with eight pages covering installation,
test syntax, assertions, running tests, configuration, and CI integration.

* docs: update raw GitHub URLs from zi-src to source

* fix(docs): correct raw GitHub URLs from zi-src to src

* fix(docs): repair zunit community links (#727)

Co-authored-by: ss-o <ss-o@users.noreply.github.com>

* docs(gallery): fix zsh-eza repository reference

* fix(gallery): replace dead startify reference

* fix(ci): disable stale trunk cache

* fix(docs): update legacy startify references

* feat(docs): add syntax highlighting + restructure community contributing section (#728)

* feat(docs): add z-shell syntax highlighting

* docs(community): restructure contributing section with SVG illustrations

- Create community/00_contributing/ as first-priority section
  - index.mdx: overview with banner SVG + card grid layout
  - 01_getting_started.mdx: org-wide fork/branch/commit/PR guide
  - 02_contributing_to_zi.mdx: zi-specific contributing guide
  - 03_zsh_plugin_standard.mdx: moved from community root (slug preserved)
  - 04_contributing_docs.mdx: wiki MDX authoring and Crowdin guide
  - 05_project_management.mdx: absorbs project tracker + labels content

- Add six SVG illustrations to static/img/svg/community/:
  - contributing-banner.svg: wide workflow diagram (fork→code→PR→merge)
  - contributing-getting-started.svg: git branch tree (120×120)
  - contributing-zi.svg: gear with zi logo (120×120)
  - contributing-plugin-standard.svg: plug/socket icon (120×120)
  - contributing-docs.svg: document with pen (120×120)
  - contributing-project-management.svg: kanban board (120×120)

- Renumber community top-level:
  - 02_zsh_plugin_standard.mdx removed (moved into 00_contributing/)
  - 03_zsh_native_scripting_handbook.mdx → 02_
  - 04_zunit/ → 03_zunit/ (update _category_.json position + doc link)

- Fix ZUnit broken links in index.mdx, 01_installation.mdx, 04_running-tests.mdx
  by adding .mdx extension (forces correct file-based resolution)

- Update community/index.mdx with contributing CTA section

Closes: docs/project-tracker-and-labels branch (content absorbed)

* feat(highlight): unified zsh/zi/zunit prism grammar with token colors

- Expand zsh grammar: adds zsh-builtin (30+ builtins), zsh-expansion-flag,
  zsh-special-parameter, zsh-glob-qualifier alongside existing zi/zunit tokens
- Simplify prism-include-languages.ts to swizzle delegation pattern
- Add comprehensive CSS token palette (9 token types, light + dark themes)
- Fix dead link in zsh_startify.mdx (z-shell/zsh-startify repo is gone)
- Migrate 44 MDX files from shell to zsh/zi/zunit language fences

* fix(docs): remove dead links to non-existent GitHub repositories

- ecosystem/plugins/zsh_startify.mdx: remove link to z-shell/zsh-startify (404)
  and remove FontAwesome icon from heading (FA kit removed from wiki)
- community/gallery/collection/06_plugins.mdx: remove hyperlink from
  zsh-startify heading (repo no longer exists)
- community/00_contributing/index.mdx: fix broken CODE_OF_CONDUCT link
  (z-shell/zi repo has no CODE_OF_CONDUCT.md) — use contributor-covenant.org
- community/00_contributing/02_contributing_to_zi.mdx: fix same broken
  CODE_OF_CONDUCT link; remove link to z-shell/community guidelines (repo 404)

* feat(highlight): implement zsh/zi/zunit prism grammar and token CSS

- z-shell-languages.ts: rewrite grammar using named capture groups for
  ESLint prefer-named-capture-group compliance; expand zsh-builtin list
  to 50+ builtins; rename zsh-keyword → zsh-builtin; add zsh-expansion-flag
  token; reorganize insertBefore calls for correct priority ordering
- prism-include-languages.ts: replace manual additionalLanguages loop with
  clean swizzle delegation to @theme-original/prism-include-languages
- custom.css: add 9-token semantic color palette (light + dark) for
  zsh-builtin, zsh-expansion-flag, zsh-special-parameter, zsh-glob-qualifier,
  zi-command keyword, zi-command subcommand function, zi-ice, zunit-command,
  zunit-directive, zunit-assertion; uses CSS custom properties and nested rules

* fix(docs): fix admonition titles and lychee exclusion

- Convert space-separated admonition titles to bracket syntax (MDX v3
  requirement): :::note Title -> :::note[Title] in 4 files
- Add z-shell/zsh-startify to lychee exclude list — repo is archived/removed
  and is referenced in existing docs on the target (next) branch; Trunk
  checks both PR and base versions, causing false CI failures

* fix(ci): correct build-script for compressed-size-action

The action prepends 'pnpm run' to the build-script value, so passing
'pnpm build:en' ran 'pnpm run pnpm build:en' — a non-existent script.
Change to the bare script name 'build:en' so the action runs
'pnpm run build:en' correctly.

* fix(highlight): correct CSS selector and override inline Prism theme colors

prism-react-renderer applies inline style="color:..." to token spans
using the Dracula/GitHub theme's alias colors, which beats plain CSS rules.
Two fixes:
- Selector: token colors were targeting <code> but Docusaurus puts
  language-* on <pre>; change to pre.language-* selectors.
- Override: add !important to all custom token color declarations so
  they win over the inline styles.

Also migrate z-shell/community membership links to z-shell/.github
(community repo is private; .github has the same 05_membership.yml
template and public issues enabled).

* fix(highlight): flatten CSS selectors — Docusaurus pipeline strips CSS nesting

Nested rules inside :is() and block selectors were mangled by the build,
producing invalid CSS like `.language-zsh,...) .token.zsh-builtin` with
the `pre` and `:is(` prefix stripped. Flattened all token color rules to
standard descendant selectors which the pipeline processes correctly.

* fix(highlight): expand zi/zunit grammar coverage

zi-command: add light-mode, self-update, cdreplay, cdlist, status
zi-ice: add compile, eval, extract, has, if, nocd, sbin, svn (all
  appear in ecosystem/docs pages but were tokenized as plain text)
zunit-command: broaden pattern from strict lookahead to match bare
  zunit and any subcommand/flag, using lookbehind for boundary

* feat(docs): redesign four landing pages with banner SVGs and card grids

Each page now matches the contributing page pattern:
- Full-width 720×140 banner SVG illustrating the section topic
- :::info/:::tip admonition with key links or quick facts
- CSS grid of cards (icon + title + description + arrow link)

Pages updated: docs/, ecosystem/, community/, community/zunit/
SVGs created: docs-banner, ecosystem-banner, community-banner, zunit-banner
All card links verified against actual built URLs.

* fix(highlight): fix zi-command compound selector and zi-ice token priority

prism-react-renderer v2 renders `inside` tokens as compound classes on the
same span, not nested spans — fix CSS to use .token.zi-command.keyword
instead of descendant .token.zi-command .token.keyword.

Move zi-ice insertBefore to fire before zsh-builtin so ice modifiers like
'wait' and 'src' are not mis-tokenized as shell builtins in zi blocks.

Also redesign docs/ecosystem/community/zunit banner SVGs with distinct
color palettes (blue/amber/purple/teal-red) so each section has a unique
visual identity.

* fix(docs): remove zsh-startify — plugin not under z-shell org

Remove ecosystem/plugins/zsh_startify.mdx (was draft: true) and the
corresponding gallery entry in 06_plugins.mdx. The plugin is hosted
under a third-party org that we do not reference in Z-Shell docs.

---------

Co-authored-by: ss-o <ss-o@users.noreply.github.com>

* docs(wiki): address PR 732 review feedback

* chore(meta): secure workflows and unify agent instructions

* chore(meta): update legacy zdharma references to z-shell

* chore(meta): final zdharma archival cleanup

* fix(docs): repair broken revolver and color snippet links

* fix(docs): pin snippet links to SHA to resolve 404s

* chore: remove unused codebase boilerplate templates

* chore(ci): remove emoji prefixes from workflow and job names

* feat(search): add Supabase knowledge search

* fix(search): use Supabase secret key

* chore(cf): generate Pages Function env types from wrangler bindings

* chore(cf): gitignore generated worker-env.d.ts

* feat(cf): add Pages Function to proxy offloaded R2 assets

* fix(cf): add CORS and robots headers, add functions tsconfig

* fix(cf): standalone functions tsconfig and OPTIONS preflight handler

* fix(cf): align module/moduleResolution in functions tsconfig

* fix(cf): guard non-GET/HEAD methods and add Allow-Headers to preflight

* fix(ci): re-pin GitHub Actions to valid commit SHAs (#739)

Re-pinned every action (workflows + .trunk/setup-ci) to verified release SHAs; fixes Trunk Check + CodeQL failing at job setup. Closes #738.

* docs: move maintainer tooling to community/ and define content-root boundaries (#736)

Reconciles the divergent docs/maintainers vs community/maintainers duplicate (kept canonical SB_SECRET_KEY copy), moves it to community/10_maintainers/, and hardens AGENTS.md + authoring instructions so docs/ stays Zi-user-docs-only.

* fix(search): harden Edge Function + indexer and add local Supabase config

- query.mjs: parse response as text first; surface HTTP status + body on non-JSON errors instead of crashing
- index.ts: wrap the Edge Function handler in try/catch returning internal_error
- migration: schema-qualify vector distance as OPERATOR(extensions.<=>) so match_public_docs works under 'set search_path = '''
- add supabase/config.toml (local CLI config) and supabase/.gitignore

* fix: address PR #740 review feedback

- functions/[[path]].ts: implement Range + If-None-Match handling (206/304) so the advertised preflight headers are actually supported; add Accept-Ranges
- prism: use plain capturing groups instead of named groups for Prism lookbehind (older-browser regex compatibility)
- embed-docs: skip re-embedding sources whose content_hash is unchanged, and batch embeddings into one request per document instead of one per chunk

* docs: move maintainer runbook out of the wiki

The Supabase Knowledge Search maintainer guide is operational documentation
(secret names, infra topology, ops CLIs) and does not belong on the public wiki.
Relocated to z-shell/.github/runbooks/supabase-knowledge-search.md. Updates the
content-root boundaries: community/ holds community content only; maintainer /
operational runbooks live in z-shell/.github/runbooks/. Refs ADR 0006.

* fix(deps): regenerate pnpm-lock.yaml after next<-main merge

The lockfile auto-merge left a dangling ws@8.20.0 reference (main bumped ws to
8.20.1), breaking 'pnpm i --frozen-lockfile' in CI. Re-resolved the lockfile.

* fix(search): do not expose internal error details in Edge Function responses

Addresses CodeQL 'information exposure through a stack trace': log error
details server-side and return only a generic error code to the client.

* fix(prism): keep named capture groups for lookbehind patterns

Reverts the plain-capture-group change: the repo's eslint config enforces
prefer-named-capture-group, and Prism's lookbehind:true requires a capturing
(not non-capturing) group, so named groups are the only option that satisfies
both. Named capture groups are ES2018 and supported across the project's
browserslist targets.

* ci(workflows): require Node 22 for wrangler@4 deploy

Wrangler 4 dropped Node 20 support, which broke the Deploy Wiki and r2-sync workflows. Bump setup-node to 22 across the wrangler and CI workflows.

* chore(search): remove Supabase knowledge-search implementation

The Supabase-backed semantic search had no live frontend consumer (site search is Algolia DocSearch; SearchBar.tsx only tweaks aria attributes), and its indexer workflow was failing on main. Remove the supabase/ project, scripts/knowledge-search/, the indexer workflow, the openai and postgres dependencies, and the stale AGENTS.md reference.

* ci(trunk): align setup-ci and docs with Node 22 requirement

Follow-up to the wrangler@4 Node bump: the Trunk Check composite action still installed deps under Node 20, mismatching engines.node >=22. Bump it and update the AGENTS.md prerequisite.

---------

Signed-off-by: Salvydas Lukosius <ss-o@users.noreply.github.com>
Co-authored-by: Salvydas Lukosius <ss-o@users.noreply.github.com>

Author: ss-o

.github/workflows/ci-perf.yml

@@ -46,15 +46,15 @@ jobs:
       issues: write # for preactjs/compressed-size-action to create comments
     steps:
       - name: "⤵️ Check out code from GitHub"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
       - name: "📦 Setup pnpm"
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - name: "⎔ Setup node"
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
       - uses: preactjs/compressed-size-action@66325aad6443cb7cf89c4bfcd414aea2367cda94 # 2.9.1
         with:
@@ -74,15 +74,15 @@ jobs:
       contents: read
     steps:
       - name: "⤵️ Check out code from GitHub"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
       - name: "📦 Setup pnpm"
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - name: "⎔ Setup node"
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
       - run: pnpm i --frozen-lockfile
         env:

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +67,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -96,6 +96,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/crowdin-download.yml

@@ -25,7 +25,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: "⤵️ Check out code from GitHub"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
       - name: "🚀 Crowdin Download"

.github/workflows/crowdin-upload.yml

@@ -30,7 +30,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: "⤵️ Check out code from GitHub"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
       - name: "🚀 Crowdin Upload"

.github/workflows/knowledge-search-index.yml

@@ -25,15 +25,15 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - name: "⤵️  Check out code from GitHub"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
       - name: "📦 Setup pnpm"
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - name: "⎔  Setup node"
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
       - name: "🏗  Build"
         run: pnpm i --frozen-lockfile && pnpm run build

.github/workflows/pages-deployment.yml

@@ -28,13 +28,13 @@ jobs:
     environment: R2
     steps:
       - name: "⤵️ Check out code from GitHub"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 2
       - name: "⎔ Setup Node.js"
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: "20"
+          node-version: "22"
       - name: "📦 Install wrangler"
         run: npm install -g wrangler@4.13.2
       - name: "📋 Detect changed assets"

.github/workflows/r2-sync.yml

@@ -25,15 +25,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
 
       - name: Setup dependencies
         uses: ./.trunk/setup-ci
 
       - name: Trunk Check
-        uses: trunk-io/trunk-action@04ba50e7658c81db7356da96657e6e77f220bfa3 # v1.3.1
+        uses: trunk-io/trunk-action@75699af9e26881e564e9d832ef7dc3af25ec031b # v1.2.4
         with:
           cache: false
           # Run full link audit on schedule/dispatch, otherwise run standard incremental checks

.github/workflows/trunk-check.yml

@@ -9,7 +9,7 @@ runs:
     - name: ⎔ Setup node
       uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
       with:
-        node-version: "20"
+        node-version: "22"
         cache: "pnpm"
     - name: 🏗 Prepare
       shell: bash

.trunk/setup-ci/action.yml

@@ -4,7 +4,7 @@ This project follows the organization-wide [Z-Shell Organization Guidelines](htt
 
 ## Build, Lint, and Dev Commands
 
-- Use Node >= 20 and pnpm >= 10 (see `engines` in `package.json`).
+- Use Node >= 22 and pnpm >= 10 (see `engines` in `package.json`).
 - Install dependencies with `pnpm install`.
 - `pnpm start` — local dev server at `http://localhost:3000`.
 - `pnpm build` — full production build (run before finishing substantial changes).
@@ -25,10 +25,7 @@ This project follows the organization-wide [Z-Shell Organization Guidelines](htt
     contributing, the Zsh handbook/plugin standard, and ZUnit.
   - `ecosystem/` → `/ecosystem` — third-party catalog: annexes, packages, plugins.
 - **Maintainer, operational, and infrastructure runbooks do not belong on the
-  public wiki.** They live in `z-shell/.github/runbooks/` (e.g.
-  `runbooks/supabase-knowledge-search.md`). Feature implementation code
-  (Edge Functions, migrations, scripts under `supabase/` and `scripts/`) still
-  lives here in the wiki repo.
+  public wiki.** They live in `z-shell/.github/runbooks/`.
 - Each content root uses the shared `sidebars.ts` (autogenerated from directory structure) plus local `_category_.json` files for ordering.
 - Site config, plugins, and routing: `docusaurus.config.ts`. See `.github/instructions/docusaurus-config.instructions.md` for config structure, feature flags, and constraints.
 - Docusaurus client API (components, hooks, theme imports): `.github/instructions/docusaurus-api.instructions.md` — prefer native Docusaurus components over raw HTML equivalents.