chore(ci): fix the daily CI failures — Node 22, vitest 4 config, Dependabot (#54)

* ci: run on Node 22 via .nvmrc instead of Node 18

The locked toolchain requires Node >= 20.19 (vite 8, rolldown 1.1,
@vitejs/plugin-react 5, vitest 4, pdfjs-dist 4). On Node 18 `npm test`
died at config load with:

  SyntaxError: The requested module 'node:util' does not provide an
  export named 'styleText'

`styleText` does not exist in Node 18. This is the root cause of both
the failing `test` job in ci.yml and the failing "Run tests after
updates" step in the nightly dependency-updates job.

Pin the version once in .nvmrc and read it via node-version-file in all
seven setup-node steps, so local and CI can't drift.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* test: migrate vitest.config.ts to vitest 4, emit lcov coverage

vitest 4 removed poolOptions entirely (Tinypool is gone); singleThread
and maxThreads collapse into a top-level maxWorkers, and minThreads has
no replacement. The stale block was a real `tsc --noEmit` error:

  vitest.config.ts(24,5): error TS2769: No overload matches this call.
  'poolOptions' does not exist in type 'InlineConfig'.

Keep isolate: true. The upstream migration note maps singleThread to
"maxWorkers: 1, isolate: false", but that is a performance recipe, not a
semantic equivalence -- the old config set singleThread AND isolate, and
dropping isolation here would share src/test/setup.ts's non-configurable
global `process` replacement across files and leak logger.test.ts's
console spies (it never calls restoreAllMocks).

Also set coverage.reporter to ['text', 'lcov']. vitest's default set is
text/html/clover/json, so coverage/lcov.info never existed and the
Codecov upload in ci.yml has always been a silent no-op.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: drop the Vercel deploy and Lighthouse jobs

deploy-preview, deploy-production, and performance-audit have never
executed -- they sit behind `needs: [build]`, and build has been blocked
by the failing test job. Fixing the tests would have made them run for
the first time and go red.

Nothing in this repo deploys to Vercel: the repo has zero secrets, zero
variables, and zero environments; there is no vercel.json and no
.vercel/; `gh api repos/gojiplus/reader/deployments` returns empty; and
README.md, CLAUDE.md, and firebase.json all describe a Firebase project.
Vercel appeared nowhere outside this file.

performance-audit was broken independently: lighthouserc.json sets
startServerReadyPattern to "ready on", which Next 15 never prints (it
prints "Ready in ..."), so LHCI would block until its start-server
timeout. lighthouserc.json is left in place for manual `npx lhci
autorun`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: bump actions to latest, fix codecov input, make type-check a real gate

Action bumps (every `uses:` in both workflows):

  actions/checkout               v4 -> v7
  actions/setup-node             v4 -> v7
  actions/upload-artifact        v4 -> v7
  github/codeql-action/*         v3 -> v4   (v3 deprecates Dec 2026)
  codecov/codecov-action         v4 -> v7
  peter-evans/create-pull-request v5 -> v8
  aquasecurity/trivy-action  master -> 0.36.0

This clears the "Node.js 20 is deprecated" annotation on every run, and
pinning trivy-action off `master` closes an unpinned-ref supply-chain
exposure.

codecov-action v5 removed the `file` input in favour of `files`. Left
unchanged, v7 would have failed on an unknown input. Verified against
the action.yml at v7: there is no `file`.

Remove continue-on-error from type-check. The only error it was masking
was the vitest.config.ts poolOptions overload, fixed in the previous
commit; `npx tsc --noEmit` is now clean. This matters because
next.config.ts sets typescript.ignoreBuildErrors, so this job is the
repo's only type gate.

Exclude .next/cache from the build artifact. The build job has never run
to completion, so `path: .next/` has never actually uploaded -- on a
Next 15 build that is a few hundred MB of webpack cache for a 1-day
retention artifact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: collapse CodeQL matrix to a single javascript-typescript job

GitHub annotated every run:

  CodeQL language 'javascript' is referenced by more than one entry in
  the 'language' matrix parameter for job 'codeql-analysis'. This may
  result in duplicate alerts.

They are the same language. The two jobs each spent ~2m40s producing
duplicate alerts. javascript-typescript is the canonical single value --
it is what this repo's own code-scanning API reports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: fix the nightly dependency-updates job, untrack outdated.json

Three bugs in one job.

1. `npm outdated --json` prints `{}` when nothing is outdated, and `{}`
   is 3 bytes, so `[ -s outdated.json ]` was always true and
   updates_available was effectively hardcoded to true.

2. The job wrote outdated.json into the working tree and then used
   `git status --porcelain` over the whole tree to decide changes_made,
   so its own scratch file influenced the answer.

3. Because create-pull-request had no add-paths, that scratch file got
   swept into the commit. outdated.json is tracked in git today and this
   workflow has committed it to main five times (#28, #29, #47, ...).

Scratch now goes to $RUNNER_TEMP, the {} case is handled, changes_made
is scoped to package.json and package-lock.json, and add-paths pins the
PR contents to those two files.

Also allow workflow_dispatch. Under `if: github.event_name ==
'schedule'` this job could not be tested without waiting for 2 AM UTC.

`npx --yes` because the log shows npm-check-updates being resolved via
an interactive install prompt, and the step is renamed to match what
`--target patch` actually does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: correct trivy tag and make the build artifact non-empty

trivy-action tags are v-prefixed from 0.33.0 onward; @0.36.0 does not
resolve and failed the Security Scan job at set-up.

The build artifact uploaded nothing: ".next" is a dotfile directory and
upload-artifact skips hidden paths unless include-hidden-files is set.
This was pre-existing -- the build job had never run to completion, so
it had never been observed.

Verified the path patterns directly against @actions/glob (the library
upload-artifact uses): with hidden files included, ".next/" matches 202
entries and the "!.next/cache/" exclusion brings that to 140.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: replace the nightly updater with Dependabot, keep CodeQL weekly

The "Security & Updates" workflow had three jobs and only one of them
was pulling its weight.

- audit-dependencies ran `npm audit` behind continue-on-error and
  uploaded a JSON report as a 30-day artifact. It could not fail and
  nothing consumed the artifact -- it just produced the "exit code 1"
  annotation on every nightly run.

- dependency-updates hand-rolled `npm-check-updates` in bash to open a
  patch-bump PR. Dependabot is already active on this repo and does the
  same thing with rebasing and conflict handling. The bash version had
  no rebase story, and its own scratch file kept landing in main.

- codeql-analysis is the one worth keeping, but daily is far more often
  than this repo changes.

So: add .github/dependabot.yml covering npm weekly (grouped, so a week
of bumps is one or two PRs) plus github-actions weekly -- the latter is
what would have flagged the Node 20 deprecation on checkout/setup-node
before it became an annotation on every run. Until now Dependabot was
only doing security updates from repo settings, with no config file,
which is why the bash updater existed at all.

The workflow is now CodeQL-only and renamed to match, running Mondays.
Its permissions drop to contents: read now that nothing pushes branches.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: soodoku

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: '/'
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    # Grouped so a week of bumps is one or two PRs to review, not fifteen.
+    # Major production bumps stay ungrouped and get their own PR.
+    groups:
+      radix-ui:
+        patterns:
+          - '@radix-ui/*'
+      dev-dependencies:
+        dependency-type: development
+      production-minor-patch:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+
+  # Workflow actions go stale silently; this is what would have caught the
+  # Node 20 deprecation on checkout/setup-node before it became an annotation
+  # on every run.
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      actions:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -17,12 +17,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '18'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies
@@ -40,12 +40,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '18'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies
@@ -55,9 +55,9 @@ jobs:
         run: npm test -- --coverage
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v7
         with:
-          file: ./coverage/lcov.info
+          files: ./coverage/lcov.info
           fail_ci_if_error: false
 
   type-check:
@@ -66,20 +66,19 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '18'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
 
       - name: Run type check
         run: npm run typecheck
-        continue-on-error: true # Allow to continue while we fix existing type issues
 
   build:
     name: Build Application
@@ -88,12 +87,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '18'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies
@@ -112,10 +111,15 @@ jobs:
           GOOGLE_GENAI_API_KEY: ${{ secrets.GOOGLE_GENAI_API_KEY || 'mock-genai-key' }}
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: build-files
-          path: .next/
+          path: |
+            .next/
+            !.next/cache/
+          # .next is a dotfile directory, and upload-artifact skips hidden
+          # paths by default -- without this the artifact is empty.
+          include-hidden-files: true
           retention-days: 1
 
   security-scan:
@@ -124,74 +128,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
           format: 'sarif'
           output: 'trivy-results.sarif'
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
-
-  deploy-preview:
-    name: Deploy Preview (Vercel)
-    runs-on: ubuntu-latest
-    needs: [build]
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Deploy to Vercel (Preview)
-        uses: amondnet/vercel-action@v25
-        with:
-          vercel-token: ${{ secrets.VERCEL_TOKEN }}
-          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
-          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
-          github-comment: true
-
-  deploy-production:
-    name: Deploy to Production (Vercel)
-    runs-on: ubuntu-latest
-    needs: [build]
-    if: github.ref == 'refs/heads/main'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Deploy to Vercel (Production)
-        uses: amondnet/vercel-action@v25
-        with:
-          vercel-token: ${{ secrets.VERCEL_TOKEN }}
-          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
-          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
-          vercel-args: '--prod'
-          github-comment: false
-
-  performance-audit:
-    name: Performance Audit
-    runs-on: ubuntu-latest
-    needs: [deploy-preview]
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Wait for deployment
-        run: sleep 30
-
-      - name: Run Lighthouse CI
-        uses: treosh/lighthouse-ci-action@v10
-        with:
-          uploadArtifacts: true
-          temporaryPublicStorage: true

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+name: CodeQL
+
+on:
+  schedule:
+    # Mondays at 2 AM UTC
+    - cron: '0 2 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  codeql-analysis:
+    name: CodeQL Security Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          # CodeQL treats JS and TS as one language; listing both duplicated
+          # every alert and doubled the runtime.
+          languages: javascript-typescript
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build for analysis
+        run: npm run build
+        env:
+          NEXT_PUBLIC_FIREBASE_API_KEY: 'mock-api-key'
+          NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: 'mock.firebaseapp.com'
+          NEXT_PUBLIC_FIREBASE_PROJECT_ID: 'mock-project'
+          NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: 'mock.appspot.com'
+          NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: '123456789'
+          NEXT_PUBLIC_FIREBASE_APP_ID: 'mock-app-id'
+          GOOGLE_GENAI_API_KEY: 'mock-genai-key'
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4