build(deps-dev): bump vite from 5.4.21 to 8.2.2 in /web

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "go"
+
+  - package-ecosystem: "npm"
+    directory: "/web"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "javascript"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "ci"

.github/workflows/ci.yml

@@ -14,6 +14,20 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  repo-refs:
+    name: Repo reference guard
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check for stale/broken repo slug references
+        run: ./scripts/check-repo-refs.sh
+
+      - name: Check the version is consistent everywhere it is written down
+        run: ./scripts/check-version.sh
+
   lint-test:
     name: Lint & Test
     runs-on: ubuntu-latest
@@ -35,21 +49,53 @@ jobs:
           cache: npm
           cache-dependency-path: web/package-lock.json
 
+      # `make web-deps`, not a bare `npm ci`: `npm ci` refuses to run at all when
+      # web/package-lock.json does not match web/package.json, and the lock in this
+      # tree predates the vitest/eslint devDependencies. web-deps tries `npm ci`
+      # first and falls back to `npm install`, printing the real fix either way.
       - name: Install web deps
-        run: cd web && npm ci
+        run: make web-deps
 
-      - name: Build web UI
-        run: cd web && npm run build && mkdir -p ../cmd/slmcode/ui && cp -r dist/* ../cmd/slmcode/ui/
+      - name: Build web UI into the go:embed directory
+        run: make ui-react
 
-      - name: Go Lint
-        run: make lint
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.5.0
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
-      - name: Go Test
-        run: make test
+      - name: make check (fmt, vet, lint, unit+race tests, web lint+build)
+        run: make check
 
       - name: Go Build
         run: make build
 
+      - name: golangci-lint ratchet (blocking — the baseline is zero)
+        run: make lint-strict
+
+      - name: Studio API offline smoke test
+        run: ./scripts/e2e_prime_smoke.sh
+
+  race-and-coverage:
+    name: Race detector & coverage floor
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Race tests (pkg/...)
+        run: make race
+
+      - name: Coverage floor
+        run: make cover
+
   web-check:
     name: Web Frontend Check
     runs-on: ubuntu-latest
@@ -65,8 +111,12 @@ jobs:
           cache: npm
           cache-dependency-path: web/package-lock.json
 
+      # `make web-deps`, not a bare `npm ci`: `npm ci` refuses to run at all when
+      # web/package-lock.json does not match web/package.json, and the lock in this
+      # tree predates the vitest/eslint devDependencies. web-deps tries `npm ci`
+      # first and falls back to `npm install`, printing the real fix either way.
       - name: Install web deps
-        run: cd web && npm ci
+        run: make web-deps
 
       - name: Type check
         run: cd web && npx tsc --noEmit
@@ -100,11 +150,20 @@ jobs:
         with:
           python-version: "3.12"
 
+      # `make web-deps`, not a bare `npm ci`: `npm ci` refuses to run at all when
+      # web/package-lock.json does not match web/package.json, and the lock in this
+      # tree predates the vitest/eslint devDependencies. web-deps tries `npm ci`
+      # first and falls back to `npm install`, printing the real fix either way.
       - name: Install web deps
-        run: cd web && npm ci
+        run: make web-deps
+
+      - name: Build web UI into the go:embed directory
+        run: make ui-react
 
-      - name: Build web UI
-        run: cd web && npm run build && mkdir -p ../cmd/slmcode/ui && cp -r dist/* ../cmd/slmcode/ui/
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.5.0
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
       - name: Run pre-commit
         uses: pre-commit/action@v3.0.1

.github/workflows/govulncheck.yml

@@ -0,0 +1,37 @@
+name: Vulnerability scan
+
+on:
+  schedule:
+    # 06:00 UTC every Monday.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "go.mod"
+      - "go.sum"
+      - ".github/workflows/govulncheck.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...