Release v0.10.0: extension updates, releases page, and consent improvements

.claude/settings.json

@@ -25,5 +25,19 @@
       "mcp__claude_ai_Postiz__integrationList",
       "mcp__Mzizi__mzizi_get_tokens"
     ]
+  },
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "mcp__github__merge_pull_request",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/scripts/clean.mjs\" --hook",
+            "timeout": 120
+          }
+        ]
+      }
+    ]
   }
 }

.githooks/post-merge

@@ -0,0 +1,5 @@
+#!/bin/sh
+# After a `git pull` that merges: keep the clone light (scripts/clean.mjs).
+# Turned on by `npm ci` (scripts/install-hooks.mjs). It never fails a pull.
+command -v node >/dev/null 2>&1 || exit 0
+node scripts/clean.mjs --quiet || true

.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Keeps the actions pinned in .github/workflows current. They are pinned to
+# full commit SHAs, with the version in a comment, so a moved tag cannot
+# change what runs; Dependabot updates the SHA and the comment together.
+#
+# npm dependencies are not listed here: no entry existed before, and adding
+# one is a separate decision about how many pull requests this repo wants.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # A release has a week to be pulled or found bad before a pin moves to it.
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci

.github/workflows/build.yml

@@ -3,10 +3,11 @@ name: build
 on:
   pull_request:
   push:
-    branches: [master]
+    branches: [main, staging]
 
-permissions:
-  contents: read
+# Nothing at the workflow level: each job asks for what it uses, and no job
+# here pushes, tags or comments, so each reads the repository and no more.
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,11 +16,17 @@ concurrency:
 jobs:
   check:
     name: astro check + tests + build
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          # Nothing here pushes, so the token is not left in .git/config for
+          # every later step (and every npm install script) to read.
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -30,20 +37,26 @@ jobs:
       - name: Type-check
         run: npm run check
 
-      # `npm test` runs vitest, builds the site, and then verifies that every
-      # inline script in the build is covered by the CSP hash allowlist in
-      # vercel.json — so an edit to the theme bootstrap cannot ship a page the
-      # browser will refuse to run.
+      # `npm test` builds the site, runs the tests (vp test), and then verifies
+      # that every inline script in the build is covered by the CSP hash
+      # allowlist in vercel.json — so an edit to an inline script cannot ship
+      # a page the browser will refuse to run.
       - name: Tests, build, and CSP check
         run: npm test
 
   audit:
     name: npm audit
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          # Nothing here pushes, so the token is not left in .git/config for
+          # every later step (and every npm install script) to read.
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -62,16 +75,11 @@ jobs:
       - name: Audit what ships
         run: node scripts/audit.mjs
 
-      # Build and test tooling, reported but not blocking.
-      #
-      # vitest currently carries an advisory with no installable fix: every
-      # published version up to 4.1.10 is affected, and 4.1.11 — the fix —
-      # cannot be installed, because it trips a resolver bug in npm 10.9
-      # ("Cannot read properties of null (reading 'edgesOut')") that aborts
-      # `npm install` outright. Blocking on it would pin this job red until
-      # npm ships a fix, which trains everyone to ignore it. So it is surfaced
-      # in the log instead, and this step goes back to blocking the moment
-      # vitest 4.1.11 installs cleanly.
+      # Build and test tooling, reported but not blocking. None of it ships:
+      # the site is static HTML. Blocking on an advisory in a build tool with
+      # no non-breaking fix would pin this job red and train everyone to
+      # ignore it, so it is surfaced in the log instead. Today that is
+      # postcss-selector-parser, through @tailwindcss/typography.
       - name: Report advisories in build and test tooling
         continue-on-error: true
         run: npm audit --audit-level=moderate

.github/workflows/main-version.yml

@@ -0,0 +1,36 @@
+# Versioning policy (nyuchi/.github#80): every release to `main` is the next
+# MINOR, tagged on the merged commit, with a GitHub release. Staging merges are
+# patches (staging-version.yml); a major is only ever by hand.
+name: Main version
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Override the bump (major is only ever manual).
+        type: choice
+        options: [minor, major]
+        default: minor
+
+# Nothing at the workflow level: the one job below asks for the write access
+# that tagging needs, and only it.
+permissions: {}
+
+jobs:
+  version:
+    # Only main: a manual run started from another branch tags nothing.
+    if: github.ref == 'refs/heads/main'
+    uses: nyuchi/.github/.github/workflows/reusable-auto-tag.yml@924e5b4d0983d31379aedbec02b990793f29c792 # main, 2026-10-04
+    with:
+      # Empty: the version is computed from the tags (package.json's version
+      # is not the release version).
+      version-command: ""
+      channel: main
+      bump: ${{ inputs.bump || '' }}
+      create-release: true
+    secrets:
+      token: ${{ secrets.RELEASE_BUMP_TOKEN }}
+    permissions:
+      contents: write

.github/workflows/staging-version.yml

@@ -0,0 +1,28 @@
+# Versioning policy (nyuchi/.github#80): every merge into `staging` is
+# released as the next PATCH, tagged on the merged commit.
+name: Staging version
+
+on:
+  push:
+    branches: [staging]
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Override the bump (major is only ever manual).
+        type: choice
+        options: [patch, minor, major]
+        default: patch
+
+# Nothing at the workflow level: the one job below asks for the write access
+# that tagging needs, and only it.
+permissions: {}
+
+jobs:
+  version:
+    # Only staging: a manual run started from another branch tags nothing.
+    if: github.ref == 'refs/heads/staging'
+    uses: nyuchi/.github/.github/workflows/reusable-staging-release.yml@924e5b4d0983d31379aedbec02b990793f29c792 # main, 2026-10-04
+    with:
+      bump: ${{ inputs.bump || '' }}
+    permissions:
+      contents: write