build!: binden monorepo with npm workspaces and lockstep releases

.c8rc.json

@@ -0,0 +1,10 @@
+{
+  "all": true,
+  "include": ["packages/*/index.ts", "packages/*/src/**/*.ts"],
+  "reporter": ["lcov", "text"],
+  "check-coverage": true,
+  "lines": 100,
+  "branches": 100,
+  "functions": 100,
+  "statements": 100
+}

.editorconfig

@@ -0,0 +1,14 @@
+# The settings of Prettier (which reads this file too), for the other editors
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+# Two trailing spaces may be a line break
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# The maintainers review every change of the repository
+* @vansergen

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,18 +1,20 @@
 ---
 name: Bug report
-about: Create a report to help us improve
+about: Report a bug of binden or of one of the @binden packages
 title: "[BUG]"
 labels: bug
 ---
 
+<!-- Do not report a vulnerability here: see SECURITY.md (Security → Report a vulnerability). -->
+
 **Describe the bug**
 A clear and concise description of what the bug is.
 
 **To Reproduce**
-Steps to reproduce the behavior (add some code):
+Steps to reproduce the behavior (a minimal server, and the request that it gets):
 
 ```typescript
-import * as binden from "binden";
+import { Binden } from "binden";
 // more code to reproduce the problem
 ```
 
@@ -21,9 +23,10 @@ A clear and concise description of what you expected to happen.
 
 **Please complete the following information:**
 
-- Node.js version: [e.g. v16.4.2]
-- NPM version: [e.g. 16.4.2]
-- `binden` version [e.g. 1.0.0]
+- Node.js version: [e.g. 24.14.1]
+- npm version: [e.g. 11.11.0]
+- Packages and versions: [e.g. `binden` 4.0.0, `@binden/body` 4.0.0]
+- Operating system: [e.g. Ubuntu 24.04]
 
 **Additional context**
-Add any other context about the problem here.
+Add any other context about the problem here (e.g. the reverse proxy in front of the server).

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a vulnerability
+    url: https://github.com/binden-js/binden/security/advisories/new
+    about: Report a vulnerability privately, never in a public issue (see SECURITY.md).

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,6 +1,6 @@
 ---
 name: Feature request
-about: Suggest an idea for this project
+about: Suggest an idea for binden or one of the @binden packages
 title: "[FEATURE-REQUEST]"
 labels: enhancement
 ---

.github/dependabot.yml

@@ -7,6 +7,25 @@ updates:
       interval: daily
     allow:
       - dependency-type: direct
+    # One pull request for the dependencies of the published packages, one for the tooling
+    groups:
+      production:
+        dependency-type: production
+      development:
+        dependency-type: development
+    ignore:
+      # Workspace packages are released in lockstep by scripts/release.mjs
+      - dependency-name: binden
+      - dependency-name: "@binden/*"
+      # Held back on purpose (see "Dependencies" in the README): the tooling does not
+      # support TypeScript 7 yet, the types follow the oldest supported Node.js (24), and
+      # the version 10 of the preset breaks the release notes of semantic-release 25
+      - dependency-name: typescript
+        versions: [">=7"]
+      - dependency-name: "@types/node"
+        versions: [">=25"]
+      - dependency-name: conventional-changelog-conventionalcommits
+        versions: [">=10"]
     assignees:
       - vansergen
     versioning-strategy: increase
@@ -21,6 +40,10 @@ updates:
     directory: /
     schedule:
       interval: daily
+    groups:
+      actions:
+        patterns:
+          - "*"
     assignees:
       - vansergen
     labels:

.github/pull_request_template.md

@@ -0,0 +1,12 @@
+## Description
+
+<!-- What changes, and why. Link the issue that it resolves (e.g. "Closes #123"). -->
+
+## Checklist
+
+- [ ] An issue has discussed the problem and the solution (for a significant change): <!-- link, or N/A -->
+- [ ] Every change of behaviour has a test, and the coverage stays at 100%.
+- [ ] The README of the package (and the JSDoc of the exported symbols) describes the change.
+- [ ] The commits follow [Conventional Commits](https://conventionalcommits.org), with a `!` and a
+      `BREAKING CHANGE:` footer for a breaking change (see [CONTRIBUTING.md](https://github.com/binden-js/binden/blob/main/CONTRIBUTING.md)).
+- [ ] `npm run ci:all` passes locally.

.github/secret_scanning.yml

@@ -0,0 +1,6 @@
+# Secret scanning (https://docs.github.com/en/code-security/secret-scanning):
+# the private key of the TLS tests of binden is a throwaway key, generated for
+# them and published on purpose. Only that file is excluded; no tarball contains
+# it (scripts/pack-check.mjs refuses keys and tests).
+paths-ignore:
+  - "packages/binden/test/cert/key.pem"