ci: improve cross-platform workflow

.github/dependabot.yml

@@ -0,0 +1,62 @@
+version: 2
+
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Rome
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+    open-pull-requests-limit: 5
+    groups:
+      rust-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: npm
+    directory: "/crates/needle-app/web"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:15"
+      timezone: Europe/Rome
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+    open-pull-requests-limit: 5
+    groups:
+      frontend-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:30"
+      timezone: Europe/Rome
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci(deps)"

.github/workflows/ci.yml

@@ -22,63 +22,64 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          toolchain: 1.90.0
-          components: rustfmt, clippy
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-      - uses: actions/setup-node@v7
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
           cache-dependency-path: crates/needle-app/web/package-lock.json
-      - name: Cache Rust dependencies and build
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-rust-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-rust-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}-
-            ${{ runner.os }}-rust-
       - name: Install web dependencies
         working-directory: crates/needle-app/web
         run: npm ci
-      - name: Verify web unit tests, lint and production bundle
+      - name: Test, type-check, lint, and build the web control plane
         working-directory: crates/needle-app/web
         run: |
           npm test
+          npm run typecheck
           npm run lint
           npm run build
-      - run: cargo clippy --locked --workspace --all-targets -- -D warnings
       - name: Upload web production bundle
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: web-dist
           path: crates/needle-app/web/dist
           retention-days: 1
           if-no-files-found: error
 
-  checks:
-    needs: frontend-quality
+  rust-format:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: 1.90.0
+          components: rustfmt
+      - name: Check Rust formatting
+        run: cargo fmt --all -- --check
+
+  platform-checks:
+    needs: [frontend-quality, rust-format]
     strategy:
       fail-fast: false
       matrix:
-        os: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || '["windows-latest", "ubuntu-latest", "macos-latest"]') }}
+        os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
         with:
           toolchain: 1.90.0
           components: clippy
       - name: Cache Rust dependencies and build
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -89,11 +90,11 @@ jobs:
             ${{ runner.os }}-rust-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}-
             ${{ runner.os }}-rust-
       - name: Download web production bundle
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: web-dist
           path: crates/needle-app/web/dist
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         if: matrix.os == 'ubuntu-latest'
         with:
           node-version: 22
@@ -103,14 +104,16 @@ jobs:
         if: matrix.os == 'ubuntu-latest'
         working-directory: crates/needle-app/web
         run: npm ci
-      - name: Check Windows-specific lints
-        if: matrix.os == 'windows-latest'
+      - name: Check Rust lints
+        if: matrix.os == 'ubuntu-latest' || matrix.os == 'windows-latest'
         run: cargo clippy --locked --workspace --all-targets -- -D warnings
-      - run: cargo test --locked --workspace
-      - run: cargo build --locked --workspace
+      - name: Test the Rust workspace
+        run: cargo test --locked --workspace
+      - name: Build the Rust workspace
+        run: cargo build --locked --workspace
       - name: Cache Playwright browsers
         if: matrix.os == 'ubuntu-latest'
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('crates/needle-app/web/package-lock.json') }}
@@ -124,5 +127,38 @@ jobs:
         if: matrix.os == 'ubuntu-latest'
         working-directory: crates/needle-app/web
         run: npm run test:e2e:local
-      - run: cargo run --locked -p needle-app -- plugin package --output ci-plugin
-      - run: cargo run --locked -p needle-app -- plugin package --benchmark --output ci-benchmark-plugin
+      - name: Validate product and benchmark plugins
+        run: |
+          cargo run --locked -p needle-app -- plugin validate
+          cargo run --locked -p needle-app -- plugin validate --benchmark
+      - name: Package product and benchmark plugins
+        run: |
+          cargo run --locked -p needle-app -- plugin package --output ci-plugin
+          cargo run --locked -p needle-app -- plugin package --benchmark --output ci-benchmark-plugin
+
+  # Single required check covering every CI stage and operating system.
+  ci-required:
+    name: ci-required
+    if: always()
+    needs: [frontend-quality, rust-format, platform-checks]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every CI stage
+        env:
+          FRONTEND_RESULT: ${{ needs['frontend-quality'].result }}
+          RUST_FORMAT_RESULT: ${{ needs['rust-format'].result }}
+          PLATFORM_RESULT: ${{ needs['platform-checks'].result }}
+        run: |
+          if [[ "$FRONTEND_RESULT" != "success" ]]; then
+            echo "::error::Frontend quality failed: $FRONTEND_RESULT"
+            exit 1
+          fi
+          if [[ "$RUST_FORMAT_RESULT" != "success" ]]; then
+            echo "::error::Rust formatting failed: $RUST_FORMAT_RESULT"
+            exit 1
+          fi
+          if [[ "$PLATFORM_RESULT" != "success" ]]; then
+            echo "::error::One or more platform checks failed: $PLATFORM_RESULT"
+            exit 1
+          fi

.github/workflows/codeql.yml

@@ -0,0 +1,54 @@
+name: codeql
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "19 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    name: analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: rust
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+          - language: actions
+            build-mode: none
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        if: matrix.language == 'rust'
+        with:
+          toolchain: 1.90.0
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+      - name: Analyze
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/coverage.yml

@@ -0,0 +1,52 @@
+name: coverage
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: coverage-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  rust-coverage:
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: crates/needle-app/web/package-lock.json
+      - name: Build embedded frontend assets
+        working-directory: crates/needle-app/web
+        run: |
+          npm ci
+          npm run build
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: 1.90.0
+          components: llvm-tools-preview
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2.85.7
+        with:
+          tool: cargo-llvm-cov
+      - name: Generate Rust coverage
+        run: cargo llvm-cov --locked --workspace --lcov --output-path lcov.info
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          files: lcov.info
+          flags: rust
+          name: rust
+          use_oidc: true
+          fail_ci_if_error: false

.github/workflows/dependency-review.yml

@@ -0,0 +1,24 @@
+name: dependency-review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          vulnerability-check: true
+          license-check: true
+          show-patched-versions: true
+          retry-on-snapshot-warnings: true