tooling: formatting baseline — EditorConfig + Prettier + markdownlint (closes #16)

.editorconfig

@@ -0,0 +1,20 @@
+# EditorConfig — whitespace/EOL baseline across every file surface (#16).
+# https://editorconfig.org  ·  Complements Prettier (CSS/JS/JSON/YAML/MD) and markdownlint;
+# also governs the Hugo Go-template layouts, which Prettier deliberately leaves alone.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+# Python (scripts/) conventionally uses 4-space indent.
+[*.py]
+indent_size = 4
+
+# Markdown uses two trailing spaces for a hard line break — don't strip them.
+[*.md]
+trim_trailing_whitespace = false

.github/ISSUE_TEMPLATE/bug_report.md

@@ -3,7 +3,7 @@ name: Bug report
 about: Report something broken on the site — a rendering glitch, broken link, or display issue
 title: "[Bug] "
 labels: bug
-assignees: ''
+assignees: ""
 ---
 
 ## What happened?
@@ -12,7 +12,7 @@ A clear description of the bug — what you expected to see, and what actually h
 
 ## Where?
 
-- **Page / URL:** (e.g. https://p2pool-starter-stack.github.io/#roadmap)
+- **Page / URL:** (e.g. <https://p2pool-starter-stack.github.io/#roadmap>)
 - **Section or element:** (hero, project card, FAQ, footer, …)
 
 ## Steps to reproduce

.github/ISSUE_TEMPLATE/content_fix.md

@@ -3,7 +3,7 @@ name: Content fix
 about: A typo, wording, broken/outdated link, or factual correction in the site copy
 title: "[Content] "
 labels: documentation
-assignees: ''
+assignees: ""
 ---
 
 ## What needs fixing?

.github/ISSUE_TEMPLATE/feature_request.md

@@ -3,7 +3,7 @@ name: Feature request
 about: Suggest an idea or improvement for the site
 title: "[Feature] "
 labels: enhancement
-assignees: ''
+assignees: ""
 ---
 
 ## Problem / motivation

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,6 +10,7 @@ For anything non-trivial, open an issue first to discuss the change.
 ## Related issue
 
 <!-- e.g. Closes #123 -->
+
 Closes #
 
 ## Checklist

.github/dependabot.yml

@@ -1,10 +1,10 @@
-# Keep the SHA-pinned GitHub Actions current. Dependabot bumps the commit pin AND the trailing
-# "# vX.Y.Z" comment together, and opens PRs for any security advisories affecting an action we use.
+# Keep dependencies current and surface security advisories — grouped weekly PRs.
 #
-# Scope is github-actions ONLY (#11): this repo is a static Hugo site with no app dependencies —
-# no package.json, go.mod, pip, or docker to track. Hugo itself is installed by version-pinned
-# `wget` of a release .deb in the workflows (HUGO_VERSION), which Dependabot cannot see, so Hugo
-# bumps stay manual (see #15).
+# Two ecosystems:
+#   - github-actions (#11): bumps the SHA pins in .github/workflows/ and their "# vX.Y.Z" comments.
+#   - npm (#16): the Prettier + markdownlint formatting toolchain in package.json (repo root).
+# No pip/go/docker here. Hugo is installed by version-pinned `wget` of a release .deb in the
+# workflows (HUGO_VERSION), which Dependabot cannot see, so Hugo bumps stay manual (see #15).
 version: 2
 updates:
   - package-ecosystem: "github-actions"
@@ -21,3 +21,16 @@ updates:
       github-actions:
         patterns:
           - "*"
+  - package-ecosystem: "npm"
+    directory: "/" # package.json (Prettier + markdownlint) lives at the repo root
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "build" # -> "build(deps): bump prettier ..."
+      include: "scope"
+    labels:
+      - "infra"
+    groups:
+      npm:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ name: CI
 
 on:
   push:
-    branches-ignore: [main]   # main is covered by deploy.yml's build step
+    branches-ignore: [main] # main is covered by deploy.yml's build step
   pull_request:
   workflow_dispatch:
 
@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
-          persist-credentials: false   # zizmor: artipacked
+          persist-credentials: false # zizmor: artipacked
 
       - name: Install Hugo (extended)
         run: |
@@ -52,3 +52,23 @@ jobs:
 
       - name: Check internal links, anchors & images
         run: htmltest
+
+  format:
+    name: Format & lint (Prettier + markdownlint)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false # zizmor: artipacked
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: npm
+      - name: Install toolchain (pinned via package-lock.json)
+        run: npm ci
+      - name: Prettier (check mode)
+        run: npm run format:check
+      - name: markdownlint
+        run: npm run lint:md

.github/workflows/deploy.yml

@@ -39,7 +39,7 @@ jobs:
         with:
           submodules: recursive
           fetch-depth: 0
-          persist-credentials: false   # zizmor: artipacked
+          persist-credentials: false # zizmor: artipacked
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

.gitignore

@@ -6,6 +6,9 @@
 # htmltest cache / log output
 /tmp/
 
+# Node toolchain (formatting/lint — Prettier + markdownlint)
+/node_modules/
+
 # OS / editor cruft
 .DS_Store
 *.swp

.htmltest.yml

@@ -9,7 +9,7 @@
 DirectoryPath: "public"
 CheckExternal: false
 CheckInternal: true
-CheckInternalHash: true        # verify nav anchors resolve to a real id
+CheckInternalHash: true # verify nav anchors resolve to a real id
 CheckImages: true
 CheckScripts: true
 CheckLinks: true

.markdownlint-cli2.jsonc

@@ -0,0 +1,11 @@
+{
+  // Markdown lint rules for the site. https://github.com/DavidAnson/markdownlint
+  "config": {
+    "default": true,
+    "MD013": false, // line length — long lines, tables, and links are fine here
+    "MD033": false, // inline HTML — issue/PR templates use HTML comments; copy may use inline HTML
+    "MD041": false, // first line need not be H1 — issue templates open at H2 after YAML front matter
+  },
+  // Lint every Markdown file except dependencies / build output.
+  "globs": ["**/*.md", "!node_modules", "!public", "!resources"],
+}

.pre-commit-config.yaml

@@ -3,10 +3,20 @@
 #   pipx install pre-commit   # or: pip install pre-commit
 #   pre-commit install
 #
-# Scope here is the secret-scanning gate from #11: gitleaks, pinned to the SAME version CI runs
-# (.github/workflows/security.yml) so a leak is caught locally before it's ever pushed.
+# Each hook is pinned in lockstep with its CI counterpart:
+#   - gitleaks     — secret scan (#11), same version as .github/workflows/security.yml
+#   - prettier     — formatting (#16), same version as package.json; respects .prettierignore
+#   - markdownlint — Markdown lint (#16), same version as package.json; uses .markdownlint-cli2.jsonc
 repos:
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.1 # keep in lockstep with GITLEAKS_VERSION in .github/workflows/security.yml
     hooks:
       - id: gitleaks
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.8.4 # keep in lockstep with the prettier version in package.json
+    hooks:
+      - id: prettier
+  - repo: https://github.com/DavidAnson/markdownlint-cli2
+    rev: v0.22.1 # keep in lockstep with markdownlint-cli2 in package.json
+    hooks:
+      - id: markdownlint-cli2

.prettierignore

@@ -0,0 +1,16 @@
+# Generated / build output & dependencies
+public/
+resources/
+node_modules/
+
+# Hugo Go-template layouts — Prettier's HTML parser mangles {{ }} syntax, and the
+# whitespace between inline elements here is visually significant. Governed by .editorconfig.
+layouts/
+
+# Generated data (refreshed from the GitHub API by scripts/refresh-releases.py)
+data/releases.json
+
+# Lockfile + vendored / binary assets Prettier shouldn't touch
+package-lock.json
+static/
+*.svg

.prettierrc.json

@@ -0,0 +1,4 @@
+{
+  "printWidth": 100,
+  "proseWrap": "preserve"
+}

CONTRIBUTING.md

@@ -32,6 +32,7 @@ not in the templates. See the [README](README.md#where-the-content-lives) for th
    hugo --gc --minify --panicOnWarning --baseURL "http://localhost/"   # strict build
    htmltest                                                            # link/anchor/image check
    ```
+
 4. Update the README or other docs for any user-facing change.
 
 ## Secret scanning

README.md

@@ -42,7 +42,7 @@ flakes on a third-party outage — run `htmltest` with `CheckExternal: true` to
 All landing-page copy is in **[`data/content.yaml`](data/content.yaml)** — edit text there, not in the
 templates. The page is assembled by [`layouts/index.html`](layouts/index.html) from that data.
 
-```
+```text
 data/content.yaml        ← all copy (hero, stats, projects, roadmap, ethos, FAQ, CTA)
 data/releases.json       ← latest pithead / rigforge release tags (version badges)
 layouts/index.html       ← single-page assembly

SECURITY.md

@@ -12,7 +12,7 @@ The live site is whatever is on the latest `main` — it deploys on every push.
 branches; please check against current `main` before reporting.
 
 | Version        | Supported          |
-|----------------|--------------------|
+| -------------- | ------------------ |
 | latest `main`  | ✅                 |
 | anything older | ❌ (please update) |