chore: add minimal Github actions

.github/auto-assign.yml

@@ -0,0 +1,15 @@
+addReviewers: true
+addAssignees: true
+
+# todo to be replaced with teams
+reviewers:
+  - volnei
+
+# todo to be replaced with teams
+assignees:
+  - volnei
+
+numberOfReviewers: 1
+skipKeywords:
+  - "WIP"
+  - "DO NOT MERGE"

.github/labeler.yml

@@ -0,0 +1,38 @@
+"area:apps/origin":
+  - changed-files:
+      - any-glob-to-any-file: "apps/origin/**"
+
+"area:apps/ui":
+  - changed-files:
+      - any-glob-to-any-file: "apps/ui/**"
+
+"area:apps/www":
+  - changed-files:
+      - any-glob-to-any-file: "apps/www/**"
+
+"pkg:ui":
+  - changed-files:
+      - any-glob-to-any-file: "packages/ui/**"
+
+"pkg:tsconfig":
+  - changed-files:
+      - any-glob-to-any-file: "packages/typescript-config/**"
+
+"area:config":
+  - changed-files:
+      - any-glob-to-any-file: ".github/**"
+      - any-glob-to-any-file: "biome.json"
+      - any-glob-to-any-file: "turbo.json"
+      - any-glob-to-any-file: "tsconfig.json"
+      - any-glob-to-any-file: "bunfig.toml"
+      - any-glob-to-any-file: "lint-staged.config.mjs"
+
+"docs":
+  - changed-files:
+      - any-glob-to-any-file: "**/*.md"
+
+"deps":
+  - changed-files:
+      - any-glob-to-any-file: "package.json"
+      - any-glob-to-any-file: "bun.lock"
+      - any-glob-to-any-file: "packages/**/package.json"

.github/workflows/build.yml

@@ -0,0 +1,33 @@
+name: Build
+
+on:
+  workflow_call:
+
+env:
+  BUN_VERSION: 1.3.1
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Run build
+        run: bun run build

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  format:
+    name: Format Check
+    uses: ./.github/workflows/format.yml
+    secrets: inherit
+
+  lint:
+    name: Lint
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+
+  test:
+    name: Test
+    uses: ./.github/workflows/test.yml
+    secrets: inherit
+
+  build:
+    name: Build
+    needs: [lint, test, format]
+    uses: ./.github/workflows/build.yml
+    secrets: inherit

.github/workflows/format.yml

@@ -0,0 +1,33 @@
+name: Format
+
+on:
+  workflow_call:
+
+env:
+  BUN_VERSION: 1.3.1
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Verify formatting
+        run: bunx biome check --linter-enabled=false --organize-imports-enabled=false .

.github/workflows/labeler.yml

@@ -0,0 +1,25 @@
+name: PR Labeler
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          configuration-path: .github/labeler.yml

.github/workflows/lint.yml

@@ -0,0 +1,50 @@
+name: Lint
+
+on:
+  workflow_call:
+
+env:
+  BUN_VERSION: 1.3.1
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Run lint
+        id: lint
+        run: bun run lint
+
+      - name: Lint summary
+        if: always()
+        env:
+          STEP_STATUS: ${{ steps.lint.outcome }}
+          LOG_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          STATUS=$(echo "${STEP_STATUS}" | tr '[:lower:]' '[:upper:]')
+          {
+            echo "## Lint"
+            echo ""
+            echo "- Status: ${STATUS}"
+            if [ "${STEP_STATUS}" != "success" ]; then
+              echo "- Logs: ${LOG_URL}"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/publish.yml

@@ -0,0 +1,126 @@
+name: Publish Package
+
+on:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: Name of the package directory inside packages/
+        required: true
+        default: ui
+        type: choice
+        options:
+          - ui
+      release_type:
+        description: Semver bump type to apply before publishing
+        required: true
+        default: patch
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  BUN_VERSION: 1.3.1
+
+jobs:
+  format:
+    uses: ./.github/workflows/format.yml
+    secrets: inherit
+
+  lint:
+    needs: format
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+
+  test:
+    needs: lint
+    uses: ./.github/workflows/test.yml
+    secrets: inherit
+
+  build:
+    needs: [lint, test]
+    uses: ./.github/workflows/build.yml
+    secrets: inherit
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+    env:
+      PACKAGE_DIR: packages/${{ inputs.package }}
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Resolve package metadata
+        id: pkg
+        run: |
+          PACKAGE_JSON="${{ env.PACKAGE_DIR }}/package.json"
+          if [ ! -f "$PACKAGE_JSON" ]; then
+            echo "::error::Package manifest not found at $PACKAGE_JSON"
+            exit 1
+          fi
+          NAME=$(node -p "require('./${{ env.PACKAGE_DIR }}/package.json').name")
+          VERSION=$(node -p "require('./${{ env.PACKAGE_DIR }}/package.json').version")
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+          echo "current_version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Build target package
+        run: bunx turbo run build --filter=${{ steps.pkg.outputs.name }}
+
+      - name: Bump package version
+        id: bump
+        working-directory: ${{ env.PACKAGE_DIR }}
+        run: |
+          npm version ${{ inputs.release_type }} --no-git-tag-version --no-commit > /dev/null
+          NEW_VERSION=$(node -p "require('./package.json').version")
+          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Verify npm token
+        run: |
+          if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
+            echo "::error::NPM_TOKEN secret is not configured"
+            exit 1
+          fi
+
+      - name: Publish to npm
+        working-directory: ${{ env.PACKAGE_DIR }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public --provenance
+
+      - name: Commit version bump
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add "${{ env.PACKAGE_DIR }}/package.json"
+          git commit -m "chore(release): ${{ steps.pkg.outputs.name }} v${{ steps.bump.outputs.version }}"
+
+      - name: Push changes
+        run: |
+          git push origin HEAD:${GITHUB_REF_NAME}
+
+      - name: Tag release
+        run: |
+          TAG="${{ steps.pkg.outputs.name }}@${{ steps.bump.outputs.version }}"
+          git tag "$TAG"
+          git push origin "$TAG"