Merge branch 'main' into issue-3351

Keep the weekly-summary CommitActivityWidget wiring and drop the workflow and modal changes that already landed on main.

Author: nyxsky404

.github/workflows/automated-tests.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   validate-and-test:
     name: Continuous Integration Security & Audit Suite
@@ -28,14 +31,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Run Automated Unit Testing Framework Suites
-        id: unit-tests
-        continue-on-error: true
         run: pnpm test
 
-      - name: Report Unit Testing Framework Suite Status
-        if: steps.unit-tests.outcome == 'failure'
-        run: |
-          echo "::warning title=Unit test suite reported failures::The strict CI gates are covered by ci.yml. This compatibility suite is informational until the repository-wide Vitest failures are resolved."
-
       - name: Log Security & Code Quality Audit Placeholder
         run: echo "Security/code-quality audits are not currently executed in this workflow."

.github/workflows/ci.yml

@@ -7,6 +7,10 @@ on:
     branches: [main]
     types: [opened, synchronize, reopened]
 
+# Default to read-only; jobs that need more raise it themselves.
+permissions:
+  contents: read
+
 # Cancel outdated runs on the same PR/branch to save CI minutes.
 concurrency:
   group: ci-${{ github.ref }}

.github/workflows/codeql.yml

@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: '0 3 * * 1'
 
+# Default to read-only; the analyze job raises what it needs.
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/e2e.yml

@@ -6,6 +6,9 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/labeler.yml

@@ -1,6 +1,12 @@
 name: PR Labeler
 on:
   pull_request_target:
+
+# pull_request_target runs with a privileged token, so default it to read-only
+# and let the label job raise only what it needs.
+permissions:
+  contents: read
+
 jobs:
   label:
     permissions:

.github/workflows/stale.yml

@@ -5,11 +5,16 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           stale-issue-message: >
             This issue has been inactive for 21 days. If you are still working on it or it is still relevant, please leave a comment — otherwise it will be closed in 7 days.

.github/workflows/typecheck.yml

@@ -5,6 +5,8 @@ name: Type Check (DEPRECATED - see ci.yml)
 on:
   pull_request:
     branches: []
+permissions:
+  contents: read
 jobs:
   typecheck:
     runs-on: ubuntu-latest

.github/workflows/visual-regression.yml

@@ -16,6 +16,9 @@ on:
       - ".github/workflows/visual-regression.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: visual-regression-${{ github.ref }}
   cancel-in-progress: true

.gitignore

@@ -64,3 +64,6 @@ screenshot.png
 
 # Prevent npm lockfile conflicts
 package-lock.json
+
+# code-analysis output
+.jscpd-report/

Dockerfile

@@ -76,4 +76,9 @@ EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
 
+# Probe with node rather than curl/wget - neither ships in node:20-alpine, and
+# /api/debug/health is auth-gated, so hit the landing page instead.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD node -e "require('http').get({host:'127.0.0.1',port:process.env.PORT||3000,path:'/'},r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"
+
 CMD ["node", "server.js"]