feat!: v2 WXT rewrite with professional CI/CD

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{reg,plist,mobileconfig}]
+end_of_line = crlf

.gitattributes

@@ -0,0 +1,14 @@
+# Normalize line endings to LF in the repository (prevents CRLF/LF drift).
+* text=auto eol=lf
+
+# Binary assets — never normalize.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.ico binary
+*.gif binary
+*.pem binary
+*.crx binary
+
+# Windows registry files need CRLF.
+*.reg text eol=crlf

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# This is the CODEOWNERS file for the repository.
+# It defines who is responsible (owner) for reviewing changes to certain files or folders.
+# When someone opens a pull request that modifies these files,
+# GitHub will automatically request a review from the listed owners.
+
+# Syntax:
+#   pattern   owner(s)
+# - Patterns work like .gitignore rules (wildcards, folders, extensions).
+# - Owners can be GitHub usernames (@username) or organization teams (@org/team).
+# - Multiple owners can be assigned, separated by spaces.
+
+# -------------------------------------------------------------------
+# Default rule: assign all files (*) in the repository to @bauer-group/core.
+# This means every pull request will automatically request a review from you,
+# unless a more specific rule matches first.
+*   @bauer-group/core

.github/config/commitlint.config.js

@@ -0,0 +1,16 @@
+/**
+ * Conventional Commits enforcement, read by
+ * bauer-group/automation-templates/.github/workflows/modules-pr-validation.yml.
+ *
+ * Kept in sync with the root commitlint.config.js, which serves the local
+ * simple-git-hooks commit-msg hook. Two files because the two consumers look in
+ * different places; without this one the CI commitlint step degrades silently
+ * (the module runs it under continue-on-error).
+ */
+export default {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'subject-case': [0],
+    'body-max-line-length': [0],
+  },
+};

.github/config/release/semantic-release.json

@@ -0,0 +1,27 @@
+{
+  "branches": ["main"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogFile": "CHANGELOG.md"
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "npmPublish": false
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["CHANGELOG.md", "package.json", "package-lock.json"],
+        "message": "chore(release): ${nextRelease.version}\n\n${nextRelease.notes}"
+      }
+    ],
+    "@semantic-release/github"
+  ]
+}

.github/dependabot.yml

@@ -0,0 +1,74 @@
+# =============================================================================
+# Dependabot Configuration
+# =============================================================================
+# Watches:
+#   1. GitHub Actions versions
+#   2. npm dependencies (runtime + build tooling)
+#
+# COMMIT PREFIXES DECIDE WHETHER AN UPDATE SHIPS
+#   release.yml only publishes assets when semantic-release actually cuts a
+#   release (`if: needs.release.outputs.release-created == 'true'`). A
+#   `chore(...)` update therefore lands on main but never reaches a published
+#   .crx — it rides along with whatever releasing commit happens to come next,
+#   which for a security patch can be weeks.
+#
+#   So npm uses `fix(deps)` and cuts its own patch: in a bundled extension
+#   nearly everything except pure linting tooling ends up inside the shipped
+#   artifact, the build chain (wxt, vite, tailwind) very much included. GitHub
+#   Actions stays on `chore(ci)` — it never enters the bundle.
+#
+#   Grouping bounds the cost: one PR per ecosystem per week, so at most one
+#   patch release a week originates from dependency traffic.
+# =============================================================================
+
+version: 2
+updates:
+  # ---------------------------------------------------------------------------
+  # GitHub Actions
+  # ---------------------------------------------------------------------------
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'sunday'
+      time: '06:30'
+      timezone: 'Etc/UTC'
+    labels:
+      - 'dependencies'
+      - 'github-actions'
+      - 'dependabot'
+    commit-message:
+      prefix: 'chore(ci)'
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+
+  # ---------------------------------------------------------------------------
+  # npm
+  # ---------------------------------------------------------------------------
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'sunday'
+      time: '06:30'
+      timezone: 'Etc/UTC'
+    labels:
+      - 'dependencies'
+      - 'npm'
+      - 'dependabot'
+    commit-message:
+      prefix: 'fix(deps)'
+    groups:
+      npm:
+        patterns:
+          - '*'
+    ignore:
+      # TypeScript 7 breaks `npm run lint`: typescript-eslint@8 declares peer
+      # `typescript: ">=4.8.4 <6.1.0"`, TS 7 shipped without a stable
+      # programmatic API, and typescript-eslint closed TS7 support as
+      # "not planned". Without this entry the PR arrives weekly looking
+      # entirely harmless. Revisit when typescript-eslint ships TS7 support.
+      - dependency-name: 'typescript'
+        versions: ['>=7']

.github/workflows/ai-issue-summary.yml

@@ -0,0 +1,33 @@
+name: 🤖 Issue AI Summary
+
+on:
+  issues:
+    types: [opened]
+
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  issues: write
+  pull-requests: write
+  contents: read
+  models: read
+
+jobs:
+  summarize-new-issue:
+    name: 🧠 Generate AI Summary
+    if: github.event_name == 'issues' || github.event_name == 'pull_request_target'
+    uses: bauer-group/automation-templates/.github/workflows/modules-ai-issue-summary.yml@main
+    with:
+      summary-type: 'technical'
+      add-labels: true
+      add-priority: true
+      translate: ''
+      comment-template: |
+        ## AI Analysis
+
+        {summary}
+
+        ---
+        *This summary was automatically generated by AI to help with triage and may not be 100% accurate.*
+    secrets: inherit

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+# =============================================================================
+# CI Gate
+# =============================================================================
+# WHAT:  Lint, format, typecheck, test with coverage, audit, and build all three
+#        browser targets.
+# WHY:   These gates used to live inside release.yml and therefore ran AFTER
+#        code had landed on main. This runs them before a merge is possible,
+#        and release.yml reuses this exact file via workflow_call so the
+#        pre-merge gate and the release gate cannot drift apart.
+# WHEN:  Every PR, every push to main, on demand, and as the release gate.
+# =============================================================================
+
+name: 🔍 CI
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+  workflow_dispatch:
+  workflow_call:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    name: 🧪 Quality Gate
+    # nodejs-build.yml calls modules-code-quality.yml, which declares
+    # `pull-requests: write`. GitHub validates a called workflow's permissions
+    # when the run is CREATED — before any job `if:` — so this is required even
+    # though Sonar is off. Omitting the block does not help: a partial block
+    # sets every unnamed scope to none, and the repo default is already
+    # pull-requests: none. Without it: startup_failure, no job, no log.
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: bauer-group/automation-templates/.github/workflows/nodejs-build.yml@main
+    with:
+      package-manager: 'npm'
+      frozen-lockfile: true
+
+      # Node 24 is the floor declared in .nvmrc and engines.node; 26 becomes LTS
+      # on 2026-10-28 and is tested now so the promotion is a non-event.
+      #
+      # The versions are literals here rather than `node-version-file: .nvmrc`
+      # ON PURPOSE, against the usual house rule. nodejs-build.yml resolves the
+      # runtime as:
+      #   node-version: ${{ inputs.node-version-file == '' && (... matrix.node ...) || '' }}
+      # so passing node-version-file blanks node-version and setup-node reads
+      # .nvmrc instead — collapsing BOTH matrix legs onto Node 24. You get two
+      # identical green jobs and no forward coverage at all. The release job in
+      # release.yml is the one that pins .nvmrc, and it must stay single.
+      enable-matrix: true
+      matrix-node: '["24", "26"]'
+
+      run-lint: true
+      lint-command: 'npm run lint'
+      run-format-check: true
+      format-command: 'npm run format:check'
+      run-typecheck: true
+      typecheck-command: 'npm run typecheck'
+
+      # `npm run test:coverage` runs the suite once WITH coverage, and
+      # vitest.config.ts fails it below 80% on src/lib. test-coverage stays
+      # false deliberately: enabling it re-runs the whole suite a second time,
+      # and its `coverage-threshold` input is an unimplemented stub in the
+      # reusable ("# Add coverage threshold check logic here"), so relying on
+      # it would be a gate that silently passes everything.
+      run-tests: true
+      test-command: 'npm run test:coverage'
+      test-coverage: false
+
+      run-audit: true
+      audit-level: 'high'
+
+      # WXT builds one browser per invocation; three sequential builds take a
+      # few seconds each and keep this on the reusable rather than forcing a
+      # hand-rolled matrix.
+      build-command: 'npm run build && npm run build:firefox && npm run build:edge'
+
+      # The reusable's default artifact glob is dist|build|lib|coverage. WXT
+      # emits .output/, so without this nothing would be uploaded while the
+      # step still reported success.
+      upload-artifacts: true
+      artifact-name: 'extension-builds'
+      artifact-path: '.output'
+      artifact-retention-days: 14
+    secrets: inherit