🔧 ⬆️ ♻️ add better tooling

.github/workflows/_publish-code.yml

@@ -19,14 +19,14 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: 26
           cache: "npm"
 
       - name: Install Node.js dependencies
         run: npm ci
 
       - name: Build
-        run: npm run build-for-dist
+        run: npm run build:dist
 
       - name: Publish
         run: |

.github/workflows/_publish-docs.yml

@@ -16,15 +16,15 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: 26
           cache: "npm"
 
       - name: Install Node.js dependencies
         run: npm ci
 
       - name: Generate docs
         run: |
-          npm run docs-for-dist
+          npm run docs:dist
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3

.github/workflows/_static-analysis.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: 26
           cache: "npm"
 
       - name: Install Node.js dependencies
@@ -24,8 +24,11 @@ jobs:
       - name: Test lint
         run: npm run lint
 
-      - name: Install NPM License Checker
-        run: npm install -g license-checker
+      - name: Test lint for dist
+        run: npm run lint:package
 
-      - name: Check licences, no GPL or APGL allowed
-        run: license-checker | grep -P -B1 '(?<=[A\W])GPL' && exit 1 || exit 0
+      - name: Check for secrets
+        run: npm run lint:secrets
+
+      - name: Test licenses
+        run: npm run license:check

.github/workflows/_test-integrations.yml

@@ -28,7 +28,8 @@ jobs:
           - "macos-latest"
         node-version:
           - "20"
-          - "24"
+          - "22"
+          - "26"
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -65,7 +66,7 @@ jobs:
         run: npm run build
 
       - name: Test code
-        run: npm run test-integration
+        run: npm run test:integration
 
 
   run-tests-without-optional-dependencies:
@@ -101,4 +102,4 @@ jobs:
         run: npm run build
 
       - name: Test code
-        run: npm run test-integration-light
+        run: npm run test:integration:light

.github/workflows/_test-smoke.yml

@@ -21,9 +21,9 @@ jobs:
     strategy:
       matrix:
         node-version:
-          - "20"
           - "22"
           - "24"
+          - "26"
 
     steps:
       - name: Check out Git repository
@@ -41,7 +41,7 @@ jobs:
         run: npm ci
 
       - name: Build
-        run: npm run build-for-dist
+        run: npm run build:dist
 
       - name: Tests v2 sample code
         run: |

.github/workflows/_test-units.yml

@@ -14,6 +14,7 @@ jobs:
           - "20"
           - "22"
           - "24"
+          - "26"
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -52,6 +53,7 @@ jobs:
           - "20"
           - "22"
           - "24"
+          - "26"
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -73,4 +75,4 @@ jobs:
         run: npm run build
 
       - name: Test code
-        run: npm run test-light
+        run: npm run test:light

.husky/pre-commit

@@ -0,0 +1 @@
+npm run lint:full

.husky/pre-push

@@ -0,0 +1,4 @@
+npm test
+npm run lint:full
+npm run license:check
+npm run docs

.secretlintrc.json

@@ -0,0 +1,7 @@
+{
+  "rules": [
+    {
+      "id": "@secretlint/secretlint-rule-preset-recommend"
+    }
+  ]
+}

eslint.config.mjs

@@ -1,11 +1,13 @@
 import typescriptEslint from "@typescript-eslint/eslint-plugin";
 import jsdoc from "eslint-plugin-jsdoc";
+import security from "eslint-plugin-security";
+import sonarjs from "eslint-plugin-sonarjs";
 import globals from "globals";
 import tsParser from "@typescript-eslint/parser";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import {fileURLToPath} from "node:url";
 import js from "@eslint/js";
-import { FlatCompat } from "@eslint/eslintrc";
+import {FlatCompat} from "@eslint/eslintrc";
 
 /* eslint-disable @typescript-eslint/naming-convention */
 
@@ -19,10 +21,12 @@ const compat = new FlatCompat({
 
 export default [{
   ignores: [],
-}, ...compat.extends("eslint:recommended", "plugin:@typescript-eslint/recommended"), {
+}, ...compat.extends("eslint:recommended", "plugin:@typescript-eslint/recommended"),
+  sonarjs.configs.recommended, security.configs.recommended, {
   plugins: {
     "@typescript-eslint": typescriptEslint,
     jsdoc,
+    security,
   },
 
   languageOptions: {
@@ -33,7 +37,6 @@ export default [{
     },
     parser: tsParser,
   },
-
   rules: {
     "max-len": ["error", {
       code: 120,
@@ -44,6 +47,7 @@ export default [{
     "jsdoc/check-param-names": "error",
     "jsdoc/check-types": "error",
     "jsdoc/no-undefined-types": "error",
+    "jsdoc/require-jsdoc": "error",
     "@typescript-eslint/no-unused-vars": "error",
     "@typescript-eslint/no-explicit-any": "off",
     "@typescript-eslint/no-inferrable-types": "off",
@@ -78,5 +82,19 @@ export default [{
     indent: ["error", 2],
     "eol-last": "error",
     "preserve-caught-error": "off",
+    "security/detect-non-literal-fs-filename": "off",
+    "security/detect-object-injection": "off",
+    "no-restricted-imports": ["error", {
+      "patterns": [{
+        "group": ["../*"],
+        "message": "Import can be shortened. Please use the @/ path alias instead of relative parent paths."
+      }]
+    }],
   },
+},
+{
+  files: ["tests/**/*"],
+  rules: {
+    "no-restricted-imports": "off"
+  }
 }];