⚙️ setup: add Biome linter, CodeQL, Dependabot, and consolidate CI workflows by warengonzaga · Pull Request #20 · warengonzaga/tinyclaw

warengonzaga · 2026-02-23T10:26:39Z

This pull request introduces several improvements to the repository's infrastructure, code formatting, and code quality automation. The most significant changes include consolidating and enhancing CI workflows (especially commit linting and security scanning), introducing Biome for linting and formatting, and making code style more consistent across the compactor package. Below are the most important changes grouped by theme:

CI/CD and Automation Improvements

Consolidated the commit message linting job into the main CI workflow (.github/workflows/ci.yml) and removed the separate commit-lint.yml file, ensuring commit messages follow the Clean Commit convention as part of the standard CI process. [1] [2]
Added a new CodeQL workflow for automated security scanning on PRs, pushes, and a weekly schedule, improving vulnerability detection.
Introduced a dependabot.yml configuration to automate dependency update PRs for npm, GitHub Actions, and Docker, with grouping and labeling for better manageability.

Formatting and Linting Enhancements

Added Biome as the code formatter and linter: included biome.json for configuration and updated package.json scripts to run linting and formatting via Biome. [1] [2]

Code Style and Consistency

Refactored various regex patterns and code formatting in the compactor package to use more consistent and readable styles, such as replacing / +/g with / {2,}/g, expanding multi-line function arguments into single lines where appropriate, and improving table parsing logic for Markdown and KV tables. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16]

These changes collectively improve the project's maintainability, code quality, and security posture.

github-advanced-security · 2026-02-23T10:26:41Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

packages/core/src/owner-auth.ts

github-actions · 2026-02-23T10:27:46Z

📦 Package Build Flow — Monorepo Build

🔀 Pull Request Build — Pre-release package for testing PR changes

Package	Version	Status	Install
@tinyclaw/plugins	`2.0.0-dev.5772a1f`	✅ Published	`npm i @tinyclaw/plugins@2.0.0-dev.5772a1f`
@tinyclaw/types	`2.0.0-dev.5772a1f`	✅ Published	`npm i @tinyclaw/types@2.0.0-dev.5772a1f`
tinyclaw	`2.0.0-dev.5772a1f`	✅ Published	`npm i tinyclaw@2.0.0-dev.5772a1f`
@tinyclaw/plugin-channel-discord	`2.0.0-dev.5772a1f`	✅ Published	`npm i @tinyclaw/plugin-channel-discord@2.0.0-dev.5772a1f`
@tinyclaw/plugin-channel-friends	`2.0.0-dev.5772a1f`	✅ Published	`npm i @tinyclaw/plugin-channel-friends@2.0.0-dev.5772a1f`
@tinyclaw/plugin-provider-openai	`2.0.0-dev.5772a1f`	✅ Published	`npm i @tinyclaw/plugin-provider-openai@2.0.0-dev.5772a1f`

📥 Quick Install (changed packages)

npm i @tinyclaw/types@2.0.0-dev.5772a1f @tinyclaw/plugins@2.0.0-dev.5772a1f @tinyclaw/plugin-channel-discord@2.0.0-dev.5772a1f @tinyclaw/plugin-channel-friends@2.0.0-dev.5772a1f @tinyclaw/plugin-provider-openai@2.0.0-dev.5772a1f tinyclaw@2.0.0-dev.5772a1f

This package was built automatically by the Package Build Flow action.

Copilot

Pull request overview

This PR introduces Biome for linting and formatting, consolidates CI workflows by merging commit linting into the main CI workflow, and adds CodeQL security scanning and Dependabot dependency management. The changes primarily consist of automated formatting fixes across the entire TypeScript/JavaScript codebase to ensure consistency.

Changes:

Added Biome linter/formatter configuration and integrated it into the CI pipeline
Consolidated commit message linting into the main CI workflow and removed the separate workflow file
Added CodeQL workflow for automated security vulnerability scanning
Added Dependabot configuration for automated dependency updates (npm, GitHub Actions, Docker)
Applied consistent formatting across all TypeScript/JavaScript files (import ordering, semicolons, quote style, multi-line formatting)

Reviewed changes

Copilot reviewed 150 out of 151 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
biome.json	Biome linter/formatter configuration with recommended rules
.github/dependabot.yml	Dependabot config for npm, GitHub Actions, and Docker updates
.github/workflows/codeql.yml	CodeQL security scanning workflow
.github/workflows/ci.yml	Consolidated CI workflow including commit linting and Biome checks
.github/workflows/commit-lint.yml	Removed (consolidated into ci.yml)
package.json	Added Biome scripts (lint, lint:fix, format)
packages/*/.ts	Formatting changes: imports, semicolons, quotes, multi-line
src/*/.ts, src/*/.js	Formatting changes across web, landing, and CLI
plugins/*/.ts	Formatting changes in provider and channel plugins

github-actions · 2026-02-23T10:39:13Z

🛠️ Container Build Complete - Dev Build

Build Status: ✅ Success
Flow Type: dev
Description: Development and testing

📦 Pull Image

Docker Hub: docker pull warengonzaga/tinyclaw:dev-9d6e531

GHCR: docker pull ghcr.io/warengonzaga/tinyclaw:dev-9d6e531

📋 Build Details

Property	Value
Flow Type	`dev`
Commit	`e2d9b28`
Registry	Docker Hub + GHCR

🏷️ Image Tags

• warengonzaga/tinyclaw:dev-9d6e531
• ghcr.io/warengonzaga/tinyclaw:dev-9d6e531

🔍 Testing Your Changes

Pull the image using one of the commands above
Run the container with your test configuration
Verify the changes work as expected
Report any issues in this PR

🚀 Quick Start

# Pull and run the container
Docker Hub: docker pull warengonzaga/tinyclaw:dev-9d6e531
docker run <your-options> <image>

🔒 Security Scan Results

📋 Pre-Build Security Checks

✅ Source Code Scan: 0 vulnerabilities found
✅ Dockerfile Scan: 0 misconfigurations found

🐳 Container Image Vulnerabilities

Severity	Count
Total	0

📊 Detailed Security Reports

View detailed vulnerability reports in the GitHub Security tab.

_{🤖 Powered by Container Build Flow Action v1.2.0

💻 with ❤️ by Waren Gonzaga under WG Technology Labs, and Him 🙏}

…eset (#22) * Initial plan * 🔧 update (release): use GH_PAT token in checkout to bypass branch ruleset Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

github-actions · 2026-02-23T11:11:54Z

📦 Package Build Flow — Monorepo Build

🔀 Pull Request Build — Pre-release package for testing PR changes

Package	Version	Status	Install
@tinyclaw/plugins	`2.0.0-dev.c03f78a`	✅ Published	`npm i @tinyclaw/plugins@2.0.0-dev.c03f78a`
@tinyclaw/types	`2.0.0-dev.c03f78a`	✅ Published	`npm i @tinyclaw/types@2.0.0-dev.c03f78a`
tinyclaw	`2.0.0-dev.c03f78a`	✅ Published	`npm i tinyclaw@2.0.0-dev.c03f78a`
@tinyclaw/plugin-channel-discord	`2.0.0-dev.c03f78a`	✅ Published	`npm i @tinyclaw/plugin-channel-discord@2.0.0-dev.c03f78a`
@tinyclaw/plugin-channel-friends	`2.0.0-dev.c03f78a`	✅ Published	`npm i @tinyclaw/plugin-channel-friends@2.0.0-dev.c03f78a`
@tinyclaw/plugin-provider-openai	`2.0.0-dev.c03f78a`	✅ Published	`npm i @tinyclaw/plugin-provider-openai@2.0.0-dev.c03f78a`

📥 Quick Install (changed packages)

npm i @tinyclaw/types@2.0.0-dev.c03f78a @tinyclaw/plugins@2.0.0-dev.c03f78a @tinyclaw/plugin-channel-discord@2.0.0-dev.c03f78a @tinyclaw/plugin-channel-friends@2.0.0-dev.c03f78a @tinyclaw/plugin-provider-openai@2.0.0-dev.c03f78a tinyclaw@2.0.0-dev.c03f78a

This package was built automatically by the Package Build Flow action.

* ☕ chore: initial plan for lint fixes * ☕ chore: fix all 14 bun lint errors using Biome * 🔧 update: address code review comments on dead code and invariant handling * 🔧 update: fix regex pattern in correction patterns for better matching * ⚙️ setup: add CI tolerance for bot commits and update AGENTS.md * 🔧 update: reorder correction patterns for consistency --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Waren Gonzaga <opensource@warengonzaga.com>

github-actions · 2026-02-24T11:54:51Z

📦 Package Build Flow — Monorepo Build

🔀 Pull Request Build — Pre-release package for testing PR changes

Package	Version	Status	Install
@tinyclaw/plugins	`2.0.0-dev.d977929`	✅ Published	`npm i @tinyclaw/plugins@2.0.0-dev.d977929`
@tinyclaw/types	`2.0.0-dev.d977929`	✅ Published	`npm i @tinyclaw/types@2.0.0-dev.d977929`
tinyclaw	`2.0.0-dev.d977929`	✅ Published	`npm i tinyclaw@2.0.0-dev.d977929`
@tinyclaw/plugin-channel-discord	`2.0.0-dev.d977929`	✅ Published	`npm i @tinyclaw/plugin-channel-discord@2.0.0-dev.d977929`
@tinyclaw/plugin-channel-friends	`2.0.0-dev.d977929`	✅ Published	`npm i @tinyclaw/plugin-channel-friends@2.0.0-dev.d977929`
@tinyclaw/plugin-provider-openai	`2.0.0-dev.d977929`	✅ Published	`npm i @tinyclaw/plugin-provider-openai@2.0.0-dev.d977929`

📥 Quick Install (changed packages)

npm i @tinyclaw/types@2.0.0-dev.d977929 @tinyclaw/plugins@2.0.0-dev.d977929 @tinyclaw/plugin-channel-discord@2.0.0-dev.d977929 @tinyclaw/plugin-channel-friends@2.0.0-dev.d977929 @tinyclaw/plugin-provider-openai@2.0.0-dev.d977929 tinyclaw@2.0.0-dev.d977929

This package was built automatically by the Package Build Flow action.

github-actions · 2026-02-24T12:35:56Z

📦 Package Build Flow — Monorepo Build

🔀 Pull Request Build — Pre-release package for testing PR changes

Package	Version	Status	Install
@tinyclaw/plugins	`2.0.0-dev.ee8f821`	✅ Published	`npm i @tinyclaw/plugins@2.0.0-dev.ee8f821`
@tinyclaw/types	`2.0.0-dev.ee8f821`	✅ Published	`npm i @tinyclaw/types@2.0.0-dev.ee8f821`
tinyclaw	`2.0.0-dev.ee8f821`	✅ Published	`npm i tinyclaw@2.0.0-dev.ee8f821`
@tinyclaw/plugin-channel-discord	`2.0.0-dev.ee8f821`	✅ Published	`npm i @tinyclaw/plugin-channel-discord@2.0.0-dev.ee8f821`
@tinyclaw/plugin-channel-friends	`2.0.0-dev.ee8f821`	✅ Published	`npm i @tinyclaw/plugin-channel-friends@2.0.0-dev.ee8f821`
@tinyclaw/plugin-provider-openai	`2.0.0-dev.ee8f821`	✅ Published	`npm i @tinyclaw/plugin-provider-openai@2.0.0-dev.ee8f821`

📥 Quick Install (changed packages)

npm i @tinyclaw/types@2.0.0-dev.ee8f821 @tinyclaw/plugins@2.0.0-dev.ee8f821 @tinyclaw/plugin-channel-discord@2.0.0-dev.ee8f821 @tinyclaw/plugin-channel-friends@2.0.0-dev.ee8f821 @tinyclaw/plugin-provider-openai@2.0.0-dev.ee8f821 tinyclaw@2.0.0-dev.ee8f821

This package was built automatically by the Package Build Flow action.

- use QueryTier type instead of any for tier casts in background.ts and tools.ts - use err instanceof Error guard instead of err: any in runner.ts - use Parameters<TemplateManager['update']>[1] for template updates - replace non-null assertions with optional chaining in templates.test.ts Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- type PulseJob extension instead of any for __touchActivity property - import and use OutboundSource type in categoryToSource return type - map companion category to agent source value - replace any with unknown in intercom handler signatures Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…is access Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- use nullish coalescing instead of non-null assertion for toolName - reformat keywords chain for readability - add biome-ignore comments for intentional any usage in tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- use nullish coalescing for non-null assertions in setup.ts, supervisor.ts, banner.ts - use typed record cast for dynamic property access in start.ts shutdown handlers - replace any with unknown in test mock signatures Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- add typed server parameter for getClientIP instead of any - use explicit fallback instead of non-null assertion for claimToken - add null check before returning recovery attempt record in security-db - replace any with unknown in test mock signatures Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-02-24T13:28:23Z

📦 Package Build Flow — Monorepo Build

🔀 Pull Request Build — Pre-release package for testing PR changes

Package	Version	Status	Install
@tinyclaw/plugins	`2.0.0-dev.9d6e531`	✅ Published	`npm i @tinyclaw/plugins@2.0.0-dev.9d6e531`
@tinyclaw/types	`2.0.0-dev.9d6e531`	✅ Published	`npm i @tinyclaw/types@2.0.0-dev.9d6e531`
tinyclaw	`2.0.0-dev.9d6e531`	✅ Published	`npm i tinyclaw@2.0.0-dev.9d6e531`
@tinyclaw/plugin-channel-discord	`2.0.0-dev.9d6e531`	✅ Published	`npm i @tinyclaw/plugin-channel-discord@2.0.0-dev.9d6e531`
@tinyclaw/plugin-channel-friends	`2.0.0-dev.9d6e531`	✅ Published	`npm i @tinyclaw/plugin-channel-friends@2.0.0-dev.9d6e531`
@tinyclaw/plugin-provider-openai	`2.0.0-dev.9d6e531`	✅ Published	`npm i @tinyclaw/plugin-provider-openai@2.0.0-dev.9d6e531`

📥 Quick Install (changed packages)

npm i @tinyclaw/types@2.0.0-dev.9d6e531 @tinyclaw/plugins@2.0.0-dev.9d6e531 @tinyclaw/plugin-channel-discord@2.0.0-dev.9d6e531 @tinyclaw/plugin-channel-friends@2.0.0-dev.9d6e531 @tinyclaw/plugin-provider-openai@2.0.0-dev.9d6e531 tinyclaw@2.0.0-dev.9d6e531

This package was built automatically by the Package Build Flow action.

warengonzaga added 5 commits February 23, 2026 14:12

⚙️ setup: add Biome linter with CI integration

32bfbcc

☕ chore: apply Biome lint and formatting fixes across codebase

dfe6906

⚙️ setup: add CodeQL analysis and Dependabot dependency scanning

35fc4b9

🔧 update (ci): merge commit lint into CI workflow as commits job

0c573e0

🔧 update (ci): change Dependabot labels to security and infra

56553d9

Copilot AI review requested due to automatic review settings February 23, 2026 10:26

github-advanced-security bot found potential problems Feb 23, 2026

View reviewed changes

packages/core/src/owner-auth.ts Fixed Show fixed Hide fixed

Copilot started reviewing on behalf of warengonzaga February 23, 2026 10:27 View session

warengonzaga self-assigned this Feb 23, 2026

Copilot AI reviewed Feb 23, 2026

View reviewed changes

warengonzaga added 2 commits February 24, 2026 20:22

🔧 update: optimize Base32 decoding by trimming trailing '=' characters

073d09a

🔧 update: improve condition evaluation by refining keyword extraction

eb41039

warengonzaga and others added 10 commits February 24, 2026 21:12

🔧 update (config): use nullish coalescing instead of non-null assertion

5097f79

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

🔧 update (heartware): use typed error intersection instead of any cast

7e95e19

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

🔧 update (sandbox): use typed record cast instead of any for globalTh…

2e4ece5

…is access Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

🔧 update (discord): add biome-ignore comment for intentional any in test

4c95de3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

⚙️ setup: update husky prepare script to ensure compatibility

d879f57

🔧 update (nudge): add IntercomEvent interface to fix TS18046 errors

e2d9b28

warengonzaga merged commit aecdd41 into main Feb 24, 2026
17 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comments

⚙️ setup: add Biome linter, CodeQL, Dependabot, and consolidate CI workflows#20

⚙️ setup: add Biome linter, CodeQL, Dependabot, and consolidate CI workflows#20
warengonzaga merged 20 commits intomainfrom
dev

warengonzaga commented Feb 23, 2026

Uh oh!

github-advanced-security bot commented Feb 23, 2026

Uh oh!

Uh oh!

github-actions bot commented Feb 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 23, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Comments

Conversation

warengonzaga commented Feb 23, 2026

Uh oh!

github-advanced-security bot commented Feb 23, 2026

Uh oh!

Uh oh!

github-actions bot commented Feb 23, 2026

📦 Package Build Flow — Monorepo Build

📥 Quick Install (changed packages)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛠️ Container Build Complete - Dev Build

📦 Pull Image

📋 Build Details

🏷️ Image Tags

🔍 Testing Your Changes

🚀 Quick Start

🔒 Security Scan Results

📋 Pre-Build Security Checks

🐳 Container Image Vulnerabilities

📊 Detailed Security Reports

Uh oh!

github-actions bot commented Feb 23, 2026

📦 Package Build Flow — Monorepo Build

📥 Quick Install (changed packages)

Uh oh!

github-actions bot commented Feb 24, 2026

📦 Package Build Flow — Monorepo Build

📥 Quick Install (changed packages)

Uh oh!

github-actions bot commented Feb 24, 2026

📦 Package Build Flow — Monorepo Build

📥 Quick Install (changed packages)

Uh oh!

github-actions bot commented Feb 24, 2026

📦 Package Build Flow — Monorepo Build

📥 Quick Install (changed packages)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Feb 23, 2026 •

edited

Loading