fix: use upstream third-party container images [skip ci]

## Summary

- **Cloudflare R2 Migration**:
- Migrated `static.ermnvldmr.com` asset storage to Cloudflare R2 bucket
`com-ermnvldmr-static` (location `WEUR`).
- Added support for `COM_ERMNVLDMR_STATIC_PUBLIC_URL` fallback in
`@ermnvldmr/cli` to properly format public asset URLs for non-dotted
bucket names.
- Relocated public CA cert to
`/dev/ssl/certs/ErmnvldmrDevelopmentRootCA.pem` and updated
`REMOTE_ROOT_CA_URL` references in `@ermnvldmr/rsbuild-config` and
`ensure-dev-certs.mjs`.
- Configured R2 CORS policies using wildcards
(`https://*.ermnvldmr.com`, `https://ermnvldmr.com`,
`https://localhost.ermnvldmr.com*`, `http://localhost*`,
`https://direct.yandex.ru`, `https://*.direct.yandex.ru`,
`https://localhost.yandex.ru*`).
  - Enforced minimum TLS 1.2 on zone `ermnvldmr.com`.
- Updated encrypted `.env.dev` and GitHub secrets in both
`deytenit/ermnvldmr.com` and `deytenit/apex.ermnvldmr.com`.

- **Multi-locale SSG Support**:
- Added `NormalModuleReplacementPlugin` to SSR runner in
`@ermnvldmr/ssg` for automatic `.en.mdx` -> `.${locale}.mdx`
substitution during Russian builds.
- Added page metadata extraction (`getPageOptions`) in `@ermnvldmr/ssg`
for pre-rendered `<title>` and `<meta name="description">` tags.
- Added unit test suite for `createPage` and updated `services/www`
build scripts (`build:all`, `build:en`, `build:ru`, `dev:en`, `dev:ru`).

.env.dev

@@ -12,10 +12,11 @@ DOTENV_PUBLIC_KEY_DEV="02a9d0f6522086b04ac7763e008a6ad0273c58258715e613c977fd6c8
 DOTENV_PUBLIC_KEY="02a9d0f6522086b04ac7763e008a6ad0273c58258715e613c977fd6c82a2030d92"
 
 # .env
-COM_ERMNVLDMR_STATIC_S3_BUCKET="encrypted:BL1vJLB9uPSvsUvrJah4UegRU8uPdFjE7sya+Fae3rwOmVzWsK5+TP4z4YzigTAuwit4FANvANvhRV46se+ZgprYplU8Cw1tZ5mHKO4rWAjif2sJCnsGXUKp8GZ2J7PrMH35MY0YrXX4NVqe18b2NEv2B9K7"
+COM_ERMNVLDMR_STATIC_S3_BUCKET="encrypted:BE65d5I9m1jrHGVNKDmfGL3Cjb7LjhB4tVWyNzSPU1Zu5Y00+R8NXgqSBrzBnXVj3vVinibjihVt3fStegyiqI52GtSycX1NlFSVJlRFWadUJ6SVK+SYfB7sFKSJ2jKGfwRaXKMzaKCdPWY+ni685oPXU9Rp"
-COM_ERMNVLDMR_STATIC_S3_REGION="encrypted:BAj3iuo7tWWNR2V4yQ+LHnFCB4JcZp7TTfUtvv+2FPntNhwc/fV95IeFWz6S0z6aPRkDG+UQzPXNwdMz7y8ZbTHbduDDrgydHu1fST1NfQd2s1Bbpf+yJTG7dPBSc5RSNKZkkpB4v55qg/UC"
+COM_ERMNVLDMR_STATIC_S3_REGION="encrypted:BPQ2+ms76A+PLFUeKL1Cnz8bdOcsJou03e8AyGwzdhozpcAwhP5yWXSqhTK8ZccAvmfjJcM4NK+x2a2r4g0ALd/UaQDa9xy2eZ6QnXwkoHXu2ce+F86/HuFnzX0qWqYTWi4q+N4="
-COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL="encrypted:BNkQrgsrxtz544vuJbgwWUh5cPjHG5wbmHNcxTUWrzbFJJsdncaAitviCvIrS7Q41w+FiWkssv3D05Tu8Inn2P62E6G3PU4gNxO2oLdmGEdrzUqB/xvxOvLvos42j54QOZf7lOqMPKH6SL2/rheCAo10gSCicCqkfh4xsCAbYpyL"
+COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL="encrypted:BCcK2ih1QrABMImpUj31KIQYlbp9zhnafzrXINAwvyCaCjbOst6UGnhhi5M3LtQ+Fhgpx52ZKGjmke1oVxnvU6BBGz/lAbSD5euhHNbJ6EIoSqc25XpcmgucIQGx1cfiJxsL4sDR95FyR3fNaS9KGr005DwQaIRKGg86gALUCPhaLekq/Sd6Nn+TDoqmigLJPozdxp33AFpmWF+EwayYae2u"
-COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID="encrypted:BCsp8p4bp3cB+9grxHo634isRUaFGU3MOc1lr8ClSFRYLjqjqukyrbJCTZWV2Xdo8iQ33EylmbzUltbwzTWMQcjJSvIskesVLyV93q60o/Mu9L9jg/apwHuBgHv4zVuHstJ0zkHWgapbNTIlWD3RCm0ujeX/H1gBH3U="
+COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID="encrypted:BPaBvzNo1eH3Z2ro+NFq4zLi4krZQT48h20r0etBfVFLDNS01gh5Uosy70Ip29rC8sa1JoP4Q8isJ2Xz0pr5Vxxa62vVFOJ9wJ6LkXbYF2bUm+UNyjfsIztJsMyiVZfPEEPEEKcniXZ3faqePwgLwCZSTa/Qry6znNmMV5FshSsP"
-COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY="encrypted:BM7aPliOyiPrqFPZMfqpn534Nu+Y0Nbh/YRoxv2KY6XAi2dNO0LSEf97DqSUQYdsnu9iibZmVNktF2K/D6mtHr9+gumF6KsmaLH65KE7c9ly7NdFQHL9I26wxRq1Sr3Zgrfs954J6oURSlBRKqJFdcTsBltuuupGuqJHyLS9+DE0jD+bl0Qg0lA="
+COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY="encrypted:BFiOxOo/TNvSIMOjyeOswLcl+9AVdqp4axW+I46c1CL0ckSucQS+7CLpO8fNfakmW2bSibqru+xfWUbQT7FDH1YB3CPXUc0qPm1PsG0FiLixDefQuDrC/JHuA0Z3/dOAkn/e94BBuPtyJXxcLRP1v517MijPa0MuNqhI9BS3jFHKjWivqc9AVPs2ybglo14b/nEO1GqlM0TYflPoDhHoWjM="
 SOPS_AGE_KEY="encrypted:BKiJVxKYhiadu0kNCw8wVLYdaEWZreAVu2PaujxhvcXeCowCGjivEuQD/uhduAy/CwwDWyQkgQJ2FJMEKA47e7QDjS9TMdPCXO19/teR7LThgqTf6AbSM3sebln5zalgyplay4A/7cVytPXuOvVkaYyoh9CgzTVsPJKXRq5yMaDEx/9/91Yo8zUMF3z1vq3/preI5baK4/1xXewR3OwfZqnNGyd7LXkdqyT5"
 COM_ERMNVLDMR_DEV_ROOT_CA_KEY="encrypted:BP+GhCwutIMF2hSxIs92VNSoEAvfdhYRFSi5MUpFfCs+pNxJkZ7tFOAadMqSlPiLBcm9+A3yIn/04/oEtRNjXk/jlZQ2G21mt30sd89NARjJO+94ui6XbllW65E5/T+d8fDmRhz4c4OcNoKk70aXcdJqd1CJT7IlYQn++zQvB2el9cp9e7E22rvGtvum40iISEt/pVU84uHyQg6ZeCn+1czM+nLhPiWOAgveTz3EAgExlJW2de1ilDIuBCFXJy5+KvnCj3WNwRTAbIYgCwFnZMOUE5jYlhP6OZ2DQ3sWv7noG/Xaa/P+EomP9dwcamlAU32tRruyA8ZSp/ah9E8hFfmBqgKfSbRlWq3qGkq/F935DZfU/C+PjRcepS/eLZQ0mfD23B21VX2CjOhEkp5V+9I5L8XkXDjDg56JDRGvF/umpdqF/KpmtimqcgB0yDVY1Z3yT1U5IZ6Yf4WlqzhchdJXRWfo0bqK8Tk0b442/6AQgRP3n6DIrCjcpmr4jx+RJiejOr3xv3QtHGafDdkF2gO7DrYztdd6XpRjij0orBUiyYECgPsLHuwd+/2jXnxLVTavVTQ0Ddz0LLNjaYxqr8KK/B+0MeS/iuLXmACs8XCKwQmV8hPYQ0C/JXGiL4GOH0V70r6ghBxCDDMpJjPasCbiCBxSAMLkQ7ZmLbO0WVPPUTMAsZ8aKUy2MLe466zizXN640B4H6bkI7x/KC29sroEJWpUufD7f+t2tnVx/KLeAxAC6afuUCGi4ibFiwLHZjfimYKaYpuMcSZHQ64iONixyfUDIRNIOWQSiX1V5EBJgBDE0JVDnExmQYAIG5isYQEorC/7z6IJeZHc4NuiKDWuvd+jwwj8tN8PVAcACJKpQHpyUU20kvp4dYgBEeiQZpBfXWrnmOJZ0HgDHbvVxPW+SHTL/uoi/Tl9xdKe+z3Q/MoT8iYXggMPcFQIqVemQUTw9Tu0oNsSj3xueR9awJc2Le9aYbKTg54MAtcBnfKXN+3cYQkNVbqC5RfiAe2D3gfbT1OgApTUNz8n8v1dgAzTa+EB0i+w8nTsb3N/N4yAXMNSKdGeUl2rFRuQO7qlWorKc3pE+nBC2ex0sOMEUFYUXcyULaxsKM3ddakCAv9/jesnkrZl2gX7YDp8iqiFzh7l8jMAFHtFCMp3CSXlBAOpfQlGLY80qTSi1e8GrnV9Ow9t0DdS1wP7J6ES9DiNuEep5atHD+0MC6u0Dw0GtmsNnNRp77my/KI8ILhF4VBVBFQ5BiJDfdpAA3RNlANo2gK5ZCKPw4tXCYUknjYdwkqvUaIQCJcr2n+WkE2eCUCqjXTFr/KMvRByY6Fb1vAwcGoCWjP2g0Tliz3hcyh/72+umn05NO3cJSAfDEjfcYBUQZ/LCcy86G0EsHXP3NabgeHNXf/Z/VG7zWqQAPX0KaVrF9XC6I2FLkg1aNGWZfJGv4uohdIny7rWU7FWPaxy9GMk6x7xBh/Hk/5/rrGHCNGs+SegLglDs2+v4P56316k4kg//dmVl/vh3h0KC2P/1xiJZ10I91k7HqZLb2qdXToa4yOHB5Euu49UV/Qtv+cZU03fuT81sEv3YT819OdmwUZgkq0PT/Lrck+pbNDaUOakpgkGAbXy6SCvjM87jYN9Ia7druulWWO0pPi4T8daQ26ZQmZp57gdkpuh/He4kC5m1aWpT2s5STSbapChd9tFNjPhjCG1DZb7h0X8jg1VkxqutDDu17jOXrhElT1ejvYqYy9lIG1b1r7Jmjxo7LgGQuPMX6CIo/BLTsuNJyC5SfSCxEm56LvJgoNk2Vaeq6mLDOaKm2PNwPuYPnJw9xWBM0EetJBnsYMutPDMXhrB7x/8DKy5/hCsKICTfhlsboUHmbSfsikvGPYx7YOaOo8xFh4yAQ73T8hFX7kn2DBfRzGkJm8SQJRPj0Hjsf5mEFUt/OrieK/Jw10HKD6hDoEFmUDv5svC3nUY0FX0fTyi0jRAri+burrCQ0HXk/qj4Xs+WLiJgfQbprV2TwTIlzOdLb/jD8PeiElNzBxmOonRj76QKcbkOnPkCWCMFKapOJskxe0ASJVjYt142D0ndTa6F7oFu72ue5U+hyoToKeb7ONZilhF0+yL7akNfFKURUa/X+cEoewuSM7r8whWwZyG+M2cwGUTRMJiAC9wK7yE8MqdrEuQtILnCA0yRTPOh1Z9ifUY0asL1Tw9cbdGRW8svHH/oVHkWe3P+yepTNrn7xQlX/O1/p4FXRm0gSE3Fdnbli8VZdwVn2SET3WkPH9rJT2F7/hovfhx+lQzBQq9ZBpNLrWRdhXzCpiaC04o7q/eef+8dZwU62A1pd8uZ+0dI5T7lOVXoo03uF863YSOKX8ad2CiYUJ8gMvMA8FSWnsUbxiDaiXPj8kni5TLsvrkH/CKY/okG5SdRCF/XCcRcXP5dxdsS90tIWdd0xi/2wbalmn3CPQ2eVeDI3dP/jCRBkfiNtD70flhxVngZMZW+Rr1c0Cpo//fMCiV5ksDIBGin5AfOPmvSnPYWV5zcU3QEfl2F5fLXgDCbpaYjaOYjyRt9ZTqabSf1Ar4L9yQFBr4N9cNg4jKskvbha4BDmUL8J7xz/F/OXHFnEDV2YkMcpBfGM2XhKDevceOQcjrPkF5/e5LdwQeYhqgzzm6ur42OwHB2HBU7ulXn/LCk2eYCFa2D1f+2F3ExbwAvnDMhymdQdUniF/NzOfG/1L3yplFsqi270T/2gT1LdOQ/Fgp3FA81k/sMLbICcF/qCp/nS3x+iMZn9B+WLjUQvJy2PehXNcpXEvXWM/e1X4PWDUhwQi7+wjJwERX2W5SB1XjQa7n/osZqpOUG2ShssPNpS3mecaV+MTpRPVYTPFiDTIgkG7F/DSND0c2PDWsBLFus0h4jG70L94uDxVNiMJb/xq/7d2+7FMNPh9UJSK75XcKDhrRYJo3iU7mfl1U89vJB179ulGrdMpWd8v5DHWEDrn3NRBa0KWVYKpqeQ0195XXH1YlZjzK7615K/5ooOGUL42PlX2Hw1zxOJubsIl6LZt8V6wa6zJgywuVLsZb+kpjtHTHmVZyhY8IUnAn6Uj8erYXapvZ8rlhUpjvVuosn8gB9JM6vNct5dVn4e8Wbt6KnRcogHYUJT32QRSWsHCaZNEqwbX+dYaLx1FQZ5daYbXSWwiHhtAJRuYutbmWwWCRTVzyNNMh3sMAI1EcmMoOIX0DEhXYNe7daErR6vMyizQ+h5YKUYK4nUu270M0x/YKRHlxwK8WkEqWv8vfhZqzV0YGud1Hwd5JwWhIEZQ7cc1uPeYJJ5kAaIFqCffmwecS2gzVvOgDkNC5eENXSk7SzDpVgm8IcfZV47L17ni75tyJCS/kreODjap6VdpDNTyS1YJaaO2TMX/s4kWiEZ22Ma4CEv2eQq1uGazGamli+ZwExAtehw=="
+COM_ERMNVLDMR_STATIC_PUBLIC_URL="encrypted:BEZbNy1WbNKhgUWmKO648nvuVNyMNXrMnq64WkjsScTOcE/HFtMX3nQktbIvEYiTSNHvoceUeW10E9i4n+C5ZEHKIBi9VUk3nuqVIcwAr6xTfqKjM1cJlRNKFQzwhHbBTYcImLoxFvM56KU4L/9Ei/XuQ/QRz0KTabhvGMM="

.gitea/actions/download-artifact/LICENSE

@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2018 GitHub, Inc. and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

.gitea/actions/download-artifact/UPSTREAM.json

@@ -0,0 +1,8 @@
+{
+  "name": "ci-action-gitea-download-artifact",
+  "source": "https://github.com/christopherhx/gitea-download-artifact.git",
+  "requested_ref": "v4",
+  "commit": "75635f32b4c1c41c4b3d64e8f85210112ed4c9c7",
+  "path": "/private/tmp/gitea-migration-20261105/mirrors/ci-action-gitea-download-artifact.git",
+  "destination": "https://git.ermnvldmr.com/deytenit/ci-action-gitea-download-artifact"
+}

.gitea/actions/download-artifact/action.yml

@@ -0,0 +1,40 @@
+name: 'Download a Build Artifact'
+description: 'Download a build artifact that was previously uploaded in the workflow by the upload-artifact action'
+author: 'GitHub'
+inputs:
+  name:
+    description: 'Name of the artifact to download. If unspecified, all artifacts for the run are downloaded.'
+    required: false
+  path:
+    description: 'Destination path. Supports basic tilde expansion. Defaults to $GITHUB_WORKSPACE'
+    required: false
+  pattern:
+    description: 'A glob pattern matching the artifacts that should be downloaded. Ignored if name is specified.'
+    required: false
+  merge-multiple:
+    description: 'When multiple artifacts are matched, this changes the behavior of the destination directories.
+      If true, the downloaded artifacts will be in the same directory specified by path.
+      If false, the downloaded artifacts will be extracted into individual named directories within the specified path.'
+    required: false
+    default: 'false'
+  github-token:
+    description: 'The GitHub token used to authenticate with the GitHub API.
+      This is required when downloading artifacts from a different repository or from a different workflow run.
+      If this is not specified, the action will attempt to download artifacts from the current repository and the current workflow run.'
+    required: false
+  repository:
+    description: 'The repository owner and the repository name joined together by "/".
+      If github-token is specified, this is the repository that artifacts will be downloaded from.'
+    required: false
+    default: ${{ github.repository }}
+  run-id:
+    description: 'The id of the workflow run where the desired download artifact was uploaded from.
+      If github-token is specified, this is the run that artifacts will be downloaded from.'
+    required: false
+    default: ${{ github.run_id }}
+outputs:
+  download-path:
+    description: 'Path of artifact download'
+runs:
+  using: 'node20'
+  main: 'dist/index.js'

.gitea/actions/download-artifact/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "download-artifact",
+  "version": "4.0.1",
+  "description": "Download an Actions Artifact from a workflow run",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "release": "ncc build src/download-artifact.ts && git add -f dist/",
+    "check-all": "concurrently \"npm:format-check\" \"npm:lint\" \"npm:build\"",
+    "format": "prettier --write **/*.ts",
+    "format-check": "prettier --check **/*.ts",
+    "lint": "eslint **/*.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/download-artifact.git"
+  },
+  "keywords": [
+    "Actions",
+    "GitHub",
+    "Artifacts",
+    "Download"
+  ],
+  "author": "GitHub",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/actions/download-artifact/issues"
+  },
+  "homepage": "https://github.com/actions/download-artifact#readme",
+  "dependencies": {
+    "@actions/artifact": "^2.0.1",
+    "@actions/core": "^1.10.0",
+    "@actions/github": "^5.1.1",
+    "minimatch": "^9.0.3"
+  },
+  "devDependencies": {
+    "@types/node": "^12.12.6",
+    "@typescript-eslint/eslint-plugin": "^6.14.0",
+    "@vercel/ncc": "^0.33.4",
+    "concurrently": "^5.2.0",
+    "eslint": "^8.55.0",
+    "eslint-plugin-github": "^4.10.1",
+    "eslint-plugin-prettier": "^5.0.1",
+    "prettier": "^3.1.1",
+    "typescript": "^5.3.3"
+  }
+}

.gitea/actions/upload-artifact/LICENSE

@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2018 GitHub, Inc. and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

.gitea/actions/upload-artifact/UPSTREAM.json

@@ -0,0 +1,8 @@
+{
+  "name": "ci-action-gitea-upload-artifact",
+  "source": "https://github.com/christopherhx/gitea-upload-artifact.git",
+  "requested_ref": "v4",
+  "commit": "81f940d004763f986ba3582c007fd842dd5cb0d7",
+  "path": "/private/tmp/gitea-migration-20261105/mirrors/ci-action-gitea-upload-artifact.git",
+  "destination": "https://git.ermnvldmr.com/deytenit/ci-action-gitea-upload-artifact"
+}

.gitea/actions/upload-artifact/action.yml

@@ -0,0 +1,61 @@
+name: 'Upload a Build Artifact'
+description: 'Upload a build artifact that can be used by subsequent workflow steps'
+author: 'GitHub'
+inputs:
+  name:
+    description: 'Artifact name'
+    default: 'artifact'
+  path:
+    description: 'A file, directory or wildcard pattern that describes what to upload'
+    required: true
+  if-no-files-found:
+    description: >
+      The desired behavior if no files are found using the provided path.
+
+      Available Options:
+        warn: Output a warning but do not fail the action
+        error: Fail the action with an error message
+        ignore: Do not output any warnings or errors, the action does not fail
+    default: 'warn'
+  retention-days:
+    description: >
+      Duration after which artifact will expire in days. 0 means using default retention.
+
+      Minimum 1 day.
+      Maximum 90 days unless changed from the repository settings page.
+  compression-level:
+    description: >
+      The level of compression for Zlib to be applied to the artifact archive.
+      The value can range from 0 to 9:
+      - 0: No compression
+      - 1: Best speed
+      - 6: Default compression (same as GNU Gzip)
+      - 9: Best compression
+      Higher levels will result in better compression, but will take longer to complete.
+      For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+    default: '6'
+  overwrite:
+    description: >
+      If true, an artifact with a matching name will be deleted before a new one is uploaded.
+      If false, the action will fail if an artifact for the given name already exists.
+      Does not fail if the artifact does not exist.
+    default: 'false'
+
+outputs:
+  artifact-id:
+    description: >
+      A unique identifier for the artifact that was just uploaded. Empty if the artifact upload failed.
+
+      This ID can be used as input to other APIs to download, delete or get more information about an artifact: https://docs.github.com/en/rest/actions/artifacts
+  artifact-url:
+    description: >
+      A download URL for the artifact that was just uploaded. Empty if the artifact upload failed.
+
+      This download URL only works for requests Authenticated with GitHub. Anonymous downloads will be prompted to first login. 
+      If an anonymous download URL is needed than a short time restricted URL can be generated using the download artifact API: https://docs.github.com/en/rest/actions/artifacts#download-an-artifact    
+
+      This URL will be valid for as long as the artifact exists and the workflow run and repository exists. Once an artifact has expired this URL will no longer work.
+      Common uses cases for such a download URL can be adding download links to artifacts in descriptions or comments on pull requests or issues.
+runs:
+  using: 'node20'
+  main: 'dist/index.js'

.gitea/actions/upload-artifact/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "upload-artifact",
+  "version": "4.2.0",
+  "description": "Upload an Actions Artifact in a workflow run",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "release": "ncc build src/upload-artifact.ts && git add -f dist/index.js",
+    "check-all": "concurrently \"npm:format-check\" \"npm:lint\" \"npm:test\" \"npm:build\"",
+    "format": "prettier --write **/*.ts",
+    "format-check": "prettier --check **/*.ts",
+    "lint": "eslint **/*.ts",
+    "test": "jest --testTimeout 10000"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/upload-artifact.git"
+  },
+  "keywords": [
+    "Actions",
+    "GitHub",
+    "Artifacts",
+    "Upload"
+  ],
+  "author": "GitHub",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/actions/upload-artifact/issues"
+  },
+  "homepage": "https://github.com/actions/upload-artifact#readme",
+  "dependencies": {
+    "@actions/artifact": "^2.1.0",
+    "@actions/core": "^1.10.0",
+    "@actions/github": "^6.0.0",
+    "@actions/glob": "^0.3.0",
+    "@actions/io": "^1.1.2"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.2.5",
+    "@types/node": "^18.11.18",
+    "@typescript-eslint/parser": "^5.48.0",
+    "@vercel/ncc": "^0.36.0",
+    "concurrently": "^7.6.0",
+    "eslint": "^8.31.0",
+    "eslint-plugin-github": "^4.6.0",
+    "eslint-plugin-jest": "^27.2.0",
+    "glob": "^8.0.3",
+    "jest": "^29.3.1",
+    "jest-circus": "^29.3.1",
+    "prettier": "^2.8.1",
+    "ts-jest": "^29.0.3",
+    "typescript": "^4.9.4"
+  }
+}

.gitea/known_hosts

@@ -0,0 +1 @@
+[git.ermnvldmr.com]:22222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXcvf3Lds3AKfGHGh00IWR9tSRbBBqrV/CC6JBGmcrD

.gitea/scripts/cache.py

@@ -0,0 +1,87 @@
+import hashlib
+import json
+import os
+import platform
+import subprocess
+import sys
+import tarfile
+import tempfile
+import urllib.error
+import urllib.parse
+import urllib.request
+import zipfile
+from pathlib import Path
+
+SERVER='https://git.ermnvldmr.com'
+
+
+def eligible(run, repository, current_run):
+    if run.get('repository',{}).get('full_name')!=repository:
+        return False
+    if str(run.get('id'))==current_run:
+        return True
+    return run.get('head_branch')=='next' and run.get('event') in ('push','workflow_dispatch') and run.get('status')=='completed' and run.get('conclusion')=='success'
+
+
+def request(url):
+    if not url.startswith(SERVER+'/'):
+        raise ValueError('Unexpected cache artifact host')
+    class LocalRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, req, fp, code, msg, headers, newurl):
+            if not newurl.startswith(SERVER+'/'):
+                raise ValueError('Unexpected cache storage host')
+            return super().redirect_request(req,fp,code,msg,headers,newurl)
+    req=urllib.request.Request(url,headers={'Authorization':'token '+os.environ['CACHE_TOKEN']})
+    return urllib.request.build_opener(LocalRedirect).open(req,timeout=60)
+
+
+def api(path):
+    with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+path) as response:
+        return json.load(response)
+
+
+def main():
+    store=Path(subprocess.check_output(['pnpm','store','path','--silent'],text=True).strip())
+    archive=Path('.ci/pnpm-store.tar')
+    if sys.argv[1]=='pack':
+        archive.parent.mkdir(exist_ok=True)
+        store.mkdir(parents=True,exist_ok=True)
+        with tarfile.open(archive,'w') as target:target.add(store,arcname='.')
+        return
+    versions=subprocess.check_output(['node','--version'],text=True).strip()+'-'+subprocess.check_output(['pnpm','--version'],text=True).strip()
+    key='pnpm-'+platform.system().lower()+'-'+platform.machine()+'-'+versions+'-'+hashlib.sha256(Path('pnpm-lock.yaml').read_bytes()).hexdigest()
+    with open(os.environ['GITHUB_OUTPUT'],'a') as output:output.write('key='+key+'\n')
+    try:
+        artifacts=api('/actions/artifacts?name='+urllib.parse.quote(key))['artifacts']
+        artifacts.sort(key=lambda a:a['id'],reverse=True)
+        for artifact in artifacts:
+            if artifact.get('expired',True) or artifact.get('name')!=key:
+                continue
+            run_id=artifact.get('workflow_run',{}).get('id')
+            if not run_id:
+                continue
+            run=api('/actions/runs/'+str(run_id))
+            if not eligible(run,os.environ['GITHUB_REPOSITORY'],os.environ['GITHUB_RUN_ID']):
+                continue
+            with tempfile.TemporaryDirectory(prefix='pnpm-artifact-cache-') as directory:
+                downloaded=Path(directory)/'cache.zip'
+                with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+'/actions/artifacts/'+str(artifact['id'])+'/zip') as response,downloaded.open('wb') as target:
+                    while chunk:=response.read(1048576):target.write(chunk)
+                with zipfile.ZipFile(downloaded) as zipped:
+                    members=[name for name in zipped.namelist() if name.rsplit('/',1)[-1]=='pnpm-store.tar']
+                    if len(members)!=1:
+                        raise ValueError('Invalid cache archive')
+                    packed=Path(directory)/'store.tar'
+                    with zipped.open(members[0]) as source,packed.open('wb') as target:
+                        while chunk:=source.read(1048576):target.write(chunk)
+                store.mkdir(parents=True,exist_ok=True)
+                with tarfile.open(packed) as tar:tar.extractall(store,filter='data')
+            print('Restored repository-scoped pnpm cache artifact')
+            return
+    except (urllib.error.HTTPError,urllib.error.URLError,ValueError,tarfile.TarError,zipfile.BadZipFile):
+        print('Cache unavailable; dependencies will be fetched normally')
+        return
+    print('No eligible cache artifact; dependencies will be fetched normally')
+
+
+if __name__=='__main__':main()

.gitea/scripts/docker.py

@@ -0,0 +1,64 @@
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+def lines(value):
+    return [line.strip() for line in value.splitlines() if line.strip()]
+
+
+def output(name, value):
+    with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
+        stream.write(f'{name}<<GITEA_VALUE\n{value}\nGITEA_VALUE\n')
+
+
+def metadata(images, rules, sha):
+    result = []
+    for rule in lines(rules):
+        fields = dict(part.split('=', 1) for part in rule.split(',') if '=' in part)
+        if fields.get('enable', 'true').lower() == 'false':
+            continue
+        kind = fields.get('type')
+        if kind == 'sha':
+            tag = 'sha-' + sha[:7]
+        elif kind == 'raw':
+            tag = fields['value']
+        else:
+            raise ValueError('Unsupported metadata rule')
+        if not re.fullmatch(r'[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}', tag):
+            raise ValueError('Invalid image tag')
+        result.extend(image.lower() + ':' + tag for image in lines(images))
+    return result
+
+
+def main():
+    mode = sys.argv[1]
+    if mode == 'login':
+        subprocess.run(['docker', 'login', os.environ['REGISTRY'], '--username', os.environ['REGISTRY_USER'], '--password-stdin'], input=os.environ['REGISTRY_TOKEN'], text=True, check=True)
+    elif mode == 'metadata':
+        output('tags', '\n'.join(metadata(os.environ['IMAGES'], os.environ['TAG_RULES'], os.environ['SOURCE_SHA'])))
+        output('labels', 'org.opencontainers.image.revision=' + os.environ['SOURCE_SHA'])
+    elif mode == 'build':
+        command = ['docker', 'buildx', 'build', '--metadata-file', '/tmp/image-metadata.json']
+        for env, flag in [('TAGS', '--tag'), ('LABELS', '--label'), ('BUILD_ARGS', '--build-arg')]:
+            for value in lines(os.environ.get(env, '')):
+                command.extend([flag, value])
+        command += ['--label', 'org.opencontainers.image.revision=' + os.environ['SOURCE_SHA'], '--label', 'com.ermnvldmr.ci.run=' + os.environ['RUN_ID']]
+        if os.environ.get('PLATFORMS'):
+            command += ['--platform', os.environ['PLATFORMS']]
+        if os.environ.get('DOCKERFILE'):
+            command += ['--file', os.environ['DOCKERFILE']]
+        if os.environ.get('PUSH', 'false').lower() == 'true':
+            command.append('--push')
+        command.append(os.environ.get('CONTEXT', '.'))
+        subprocess.run(command, check=True)
+        output('digest', json.loads(Path('/tmp/image-metadata.json').read_text())['containerimage.digest'])
+    else:
+        raise ValueError('Unknown docker operation')
+
+
+if __name__ == '__main__':
+    main()

.gitea/scripts/git_write.py

@@ -0,0 +1,25 @@
+import os
+import re
+import shlex
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+def main():
+    ref=sys.argv[1]
+    if ref not in ('HEAD:next','trunk') and not re.fullmatch(r'refs/tags/[A-Za-z0-9][A-Za-z0-9._-]*',ref):
+        raise ValueError('Unexpected publication ref')
+    repository=os.environ['GITHUB_REPOSITORY']
+    if not re.fullmatch(r'deytenit/[A-Za-z0-9_.-]+',repository):
+        raise ValueError('Unexpected repository owner')
+    with tempfile.TemporaryDirectory(prefix='gitea-write-key-') as directory:
+        key=Path(directory)/'key';key.write_text(os.environ['GIT_WRITE_KEY']);key.chmod(0o600)
+        known=Path(__file__).resolve().parent.parent/'known_hosts'
+        env=dict(os.environ);env.pop('GIT_WRITE_KEY',None)
+        env['GIT_SSH_COMMAND']=shlex.join(['ssh','-T','-i',str(key),'-o','IdentitiesOnly=yes','-o','StrictHostKeyChecking=yes','-o','HostKeyAlgorithms=ssh-ed25519','-o','UserKnownHostsFile='+str(known)])
+        subprocess.run(['git','push','ssh://git@git.ermnvldmr.com:22222/'+repository+'.git',ref],env=env,check=True)
+
+
+if __name__=='__main__':main()

.gitea/scripts/provenance.py

@@ -0,0 +1,113 @@
+import json
+import base64
+import io
+import zipfile
+import os
+import re
+import subprocess
+import urllib.request
+
+SERVER = 'https://git.ermnvldmr.com'
+REPO = 'deytenit/ermnvldmr.com'
+IMAGE = SERVER.removeprefix('https://') + '/' + REPO + '/www'
+
+
+def validate_input(sha, digest, run_id):
+    if not re.fullmatch(r'[0-9a-f]{40}', sha):
+        raise ValueError('Full source SHA required')
+    if not re.fullmatch(r'sha256:[0-9a-f]{64}', digest):
+        raise ValueError('OCI sha256 digest required')
+    if not re.fullmatch(r'[1-9][0-9]*', run_id):
+        raise ValueError('Numeric build run ID required')
+
+
+def validate_run(run, sha):
+    expected = {'head_sha': sha, 'head_branch': 'next', 'status': 'completed', 'conclusion': 'success'}
+    if any(run.get(key) != value for key, value in expected.items()):
+        raise ValueError('Build did not succeed for this next commit')
+    if run.get('repository', {}).get('full_name') != REPO or (run.get('head_repository') and run['head_repository'].get('full_name') != REPO):
+        raise ValueError('Build source repository mismatch')
+    if run.get('path') != 'services-www-next-required.yml@refs/heads/next':
+        raise ValueError('Wrong build workflow')
+    if run.get('event') not in ('push', 'workflow_dispatch'):
+        raise ValueError('Untrusted build event')
+
+
+def api(path):
+    req = urllib.request.Request(SERVER + '/api/v1/repos/' + REPO + path, headers={'Authorization': 'token ' + os.environ['PROVENANCE_TOKEN']})
+    with urllib.request.urlopen(req, timeout=30) as response:
+        return json.load(response)
+
+
+def validate_labels(labels, sha, run_id):
+    if labels.get('org.opencontainers.image.revision') != sha or labels.get('com.ermnvldmr.ci.run') != run_id:
+        raise ValueError('Immutable image provenance mismatch')
+
+
+def validate_manifest(manifest, sha, digest, run_id):
+    expected = {'sha': sha, 'digest': digest, 'run_id': run_id, 'repository': REPO}
+    if manifest != expected:
+        raise ValueError('Build artifact does not attest requested image digest')
+
+
+def artifact_manifest(run_id, name='www-provenance', filename='www-provenance.json'):
+    artifacts = api('/actions/runs/' + run_id + '/artifacts')['artifacts']
+    matching = [a for a in artifacts if a.get('name') == name and not a.get('expired', True)]
+    if len(matching) != 1:
+        raise ValueError('Exactly one unexpired build provenance artifact required')
+    class SameHostRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, req, fp, code, msg, headers, newurl):
+            if not newurl.startswith(SERVER + '/'):
+                raise ValueError('Unexpected artifact storage host')
+            return super().redirect_request(req, fp, code, msg, headers, newurl)
+    request = urllib.request.Request(SERVER + '/api/v1/repos/' + REPO + '/actions/artifacts/' + str(matching[0]['id']) + '/zip', headers={'Authorization': 'token ' + os.environ['PROVENANCE_TOKEN']})
+    with urllib.request.build_opener(SameHostRedirect).open(request, timeout=30) as response:
+        payload = response.read(1024 * 1024 + 1)
+    if len(payload) > 1024 * 1024:
+        raise ValueError('Unexpected provenance artifact size')
+    with zipfile.ZipFile(io.BytesIO(payload)) as archive:
+        members = [name for name in archive.namelist() if name.rsplit('/', 1)[-1] == filename]
+        if len(members) != 1:
+            raise ValueError('Missing or ambiguous provenance manifest')
+        if archive.getinfo(members[0]).file_size > 65536:
+            raise ValueError('Unexpected provenance document size')
+        return json.loads(archive.read(members[0]))
+
+
+def main():
+    sha, digest, run_id = os.environ['TESTED_SHA'], os.environ['TESTED_DIGEST'], os.environ['BUILD_RUN_ID']
+    validate_input(sha, digest, run_id)
+    current = api('/actions/runs/' + os.environ['GITHUB_RUN_ID'])
+    if current.get('event') != 'workflow_dispatch' or current.get('head_branch') != 'next':
+        raise ValueError('Approval must be manually dispatched on protected next')
+    actor = current.get('trigger_actor') or current.get('actor') or {}
+    if actor.get('login') != 'deytenit':
+        raise ValueError('Only the repository owner may approve promotion')
+    if not api('/branches/next').get('protected'):
+        raise ValueError('The next branch must be protected before promotion')
+    validate_run(api('/actions/runs/' + run_id), sha)
+    validate_manifest(artifact_manifest(run_id), sha, digest, run_id)
+    if os.environ.get('RELEASE_RUN_ID'):
+        release_id = os.environ['RELEASE_RUN_ID']
+        if not re.fullmatch(r'[1-9][0-9]*', release_id):
+            raise ValueError('Numeric release run ID required')
+        release = api('/actions/runs/' + release_id)
+        actor = release.get('trigger_actor') or release.get('actor') or {}
+        if release.get('conclusion') != 'success' or release.get('status') != 'completed' or release.get('event') != 'workflow_dispatch' or release.get('head_branch') != 'next' or release.get('path') != 'services-www-release-manual.yml@refs/heads/next' or actor.get('login') != 'deytenit':
+            raise ValueError('Successful independently approved release required')
+        manifest = artifact_manifest(release_id, 'www-release-provenance', 'www-release.json')
+        expected = {'sha': sha, 'digest': digest, 'run_id': run_id, 'repository': REPO, 'release_tag': os.environ['RELEASE_TAG']}
+        if manifest != expected:
+            raise ValueError('Release approval does not match requested artifact')
+    auth = base64.b64encode(('deytenit:' + os.environ['PROVENANCE_TOKEN']).encode()).decode()
+    subprocess.run(['git', '-c', 'http.https://git.ermnvldmr.com/.extraheader=AUTHORIZATION: basic ' + auth, 'fetch', 'origin', 'next'], check=True)
+    subprocess.run(['git', 'merge-base', '--is-ancestor', sha, 'origin/next'], check=True)
+    subprocess.run(['docker', 'pull', IMAGE + '@' + digest], check=True)
+    data = json.loads(subprocess.check_output(['docker', 'image', 'inspect', IMAGE + '@' + digest], text=True))
+    validate_labels(data[0]['Config'].get('Labels') or {}, sha, run_id)
+    with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
+        stream.write('short_sha=sha-' + sha[:7] + '\n')
+
+
+if __name__ == '__main__':
+    main()

.gitea/workflows/ci-next-build-golden-image.yml

@@ -0,0 +1,238 @@
+name: ci - next/build-golden-image
+'on':
+  workflow_dispatch: null
+concurrency:
+  group: ci-golden-image
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  validate-scripts:
+    name: Validate - Provisioner Scripts
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Validate Shell Script Syntax
+      run: bash -n ci/packer/scripts/*.sh
+  build-image:
+    name: Build - Golden Image
+    needs: validate-scripts
+    runs-on: apex-debian13
+    outputs:
+      image_name: ${{ steps.vars.outputs.image_name }}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Calculate Image Name
+      id: vars
+      run: 'SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)"
+
+        IMAGE_NAME="com-ermnvldmr-debian-12-k3s-amd64-${SHORT_SHA}.qcow2"
+
+        echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
+
+        '
+    - name: Install Build Tools
+      run: 'sudo apt-get update
+
+        sudo apt-get install -y qemu-utils
+
+        '
+    - name: Build Debian K3s Golden Image
+      run: 'mkdir -p output-qemu
+
+        echo "Downloading official Debian 12 cloud image..."
+
+        curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
+
+
+        echo "Expanding disk image to 10G..."
+
+        qemu-img resize base.qcow2 10G
+
+
+        echo "Connecting disk image via NBD..."
+
+        sudo modprobe nbd max_part=8
+
+        sudo qemu-nbd --connect=/dev/nbd0 base.qcow2
+
+        sleep 1
+
+        sudo partx -u /dev/nbd0 || true
+
+
+        echo "Mounting disk filesystem..."
+
+        sudo mkdir -p /mnt/target
+
+        sudo mount /dev/nbd0p1 /mnt/target
+
+
+        echo "Mounting host virtual filesystems and configuring DNS..."
+
+        sudo rm -f /mnt/target/etc/resolv.conf
+
+        echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf
+
+        echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf
+
+        sudo mount --bind /dev /mnt/target/dev
+
+        sudo mount --bind /dev/pts /mnt/target/dev/pts
+
+        sudo mount --bind /proc /mnt/target/proc
+
+        sudo mount --bind /sys /mnt/target/sys
+
+
+        echo "Copying provisioner scripts..."
+
+        sudo mkdir -p /mnt/target/tmp/scripts
+
+        sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/
+
+        sudo cp /opt/ci/assets/k3s /opt/ci/assets/k3s-install.sh /mnt/target/tmp/scripts/
+
+        sudo cp /opt/ci/assets/flux-install-local.yaml /mnt/target/tmp/scripts/flux-install.yaml
+
+        sudo chmod +x /mnt/target/tmp/scripts/*.sh
+
+
+        echo "Running provisioner scripts in chroot..."
+
+        sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh
+
+        sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh
+
+        sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh
+
+        sudo rm -rf /mnt/target/tmp/scripts
+
+
+        echo "Unmounting filesystems..."
+
+        sudo umount /mnt/target/sys
+
+        sudo umount /mnt/target/proc
+
+        sudo umount /mnt/target/dev/pts
+
+        sudo umount /mnt/target/dev
+
+        sudo umount /mnt/target
+
+        sudo qemu-nbd --disconnect /dev/nbd0
+
+
+        echo "Compressing and optimizing qcow2 with 2M cluster size..."
+
+        qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+
+        echo "Golden image built successfully."
+
+        '
+    - name: Prepare and Upload Image Artifact
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: golden-image
+        path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+        retention-days: 30
+  upload-s3:
+    name: Upload - S3 Storage
+    needs: build-image
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Download Image Artifact
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: golden-image
+        path: output-qemu
+    - name: Upload to Static S3 (/dev/images/)
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID
+          }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY
+          }}
+        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION
+          || 'auto' }}
+        S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL
+          }}
+        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET
+          }}
+        IMAGE_NAME: ${{ needs.build-image.outputs.image_name }}
+      run: "mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 \"output-qemu/${IMAGE_NAME}\"\
+        \nif [ -n \"${S3_BUCKET}\" ] && [ -n \"${AWS_ACCESS_KEY_ID}\" ]; then\n  ENDPOINT_FLAG=\"\
+        \"\n  [ -n \"${S3_ENDPOINT}\" ] && ENDPOINT_FLAG=\"--endpoint-url=${S3_ENDPOINT}\"\
+        \n  echo \"Cleaning up older images in dev/images/ to free bucket storage...\"\
+        \n  aws ${ENDPOINT_FLAG} s3 rm \"s3://${S3_BUCKET}/dev/images/\" --recursive\
+        \ --exclude \"*\" --include \"com-ermnvldmr-debian-12-k3s-*.qcow2\" || true\n\
+        \  aws ${ENDPOINT_FLAG} s3 cp \"output-qemu/${IMAGE_NAME}\" \"s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}\"\
+        \n  echo \"Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}\"\
+        \nelse\n  echo \"S3 storage secrets not provided; skipping remote S3 upload.\
+        \ Image artifact is preserved in GitHub Actions run artifacts.\"\nfi\n"

.gitea/workflows/packages-kits-next-required.yml

@@ -0,0 +1,583 @@
+name: packages/kits - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/kits/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-kits-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-next-kits-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs & UI
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Build UI
+      run: pnpm --filter @ermnvldmr/ui build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+    - name: Upload UI dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+        retention-days: 30
+  lint-kits:
+    name: Lint - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Lint Kits package
+      run: pnpm --filter @ermnvldmr/kits lint
+  typecheck-kits:
+    name: Typecheck - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Typecheck Kits package
+      run: pnpm --filter @ermnvldmr/kits typecheck
+  test-kits:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Test Kits package
+      run: pnpm --filter @ermnvldmr/kits test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits Storybook
+      run: pnpm --filter @ermnvldmr/kits build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/kits test:storybook:ci
+  build-kits:
+    name: Build - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits package
+      run: pnpm --filter @ermnvldmr/kits build

.gitea/workflows/packages-kits-pr-required.yml

@@ -0,0 +1,583 @@
+name: packages/kits - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/kits/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-kits-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-kits-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs & UI
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Build UI
+      run: pnpm --filter @ermnvldmr/ui build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+    - name: Upload UI dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+        retention-days: 30
+  lint-kits:
+    name: Lint - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Lint Kits package
+      run: pnpm --filter @ermnvldmr/kits lint
+  typecheck-kits:
+    name: Typecheck - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Typecheck Kits package
+      run: pnpm --filter @ermnvldmr/kits typecheck
+  test-kits:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Test Kits package
+      run: pnpm --filter @ermnvldmr/kits test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits Storybook
+      run: pnpm --filter @ermnvldmr/kits build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/kits test:storybook:ci
+  build-kits:
+    name: Build - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits package
+      run: pnpm --filter @ermnvldmr/kits build

.gitea/workflows/packages-ssg-next-required.yml

@@ -0,0 +1,291 @@
+name: packages/ssg - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/ssg/**
+    - .gitea/workflows/packages-ssg-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-ssg-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-ssg:
+    name: Lint - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Lint SSG package
+      run: pnpm --filter @ermnvldmr/ssg lint
+  typecheck-ssg:
+    name: Typecheck - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Typecheck SSG package
+      run: pnpm --filter @ermnvldmr/ssg typecheck
+  build-ssg:
+    name: Build - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Build SSG package
+      run: pnpm --filter @ermnvldmr/ssg build

.gitea/workflows/packages-ssg-pr-required.yml

@@ -0,0 +1,291 @@
+name: packages/ssg - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/ssg/**
+    - .gitea/workflows/packages-ssg-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-ssg-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-ssg:
+    name: Lint - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Lint SSG package
+      run: pnpm --filter @ermnvldmr/ssg lint
+  typecheck-ssg:
+    name: Typecheck - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Typecheck SSG package
+      run: pnpm --filter @ermnvldmr/ssg typecheck
+  build-ssg:
+    name: Build - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Build SSG package
+      run: pnpm --filter @ermnvldmr/ssg build

.gitea/workflows/packages-stl-next-required.yml

@@ -0,0 +1,345 @@
+name: packages/stl - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/stl/**
+    - .gitea/workflows/packages-stl-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-stl-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-stl:
+    name: Lint - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Lint STL package
+      run: pnpm --filter @ermnvldmr/stl lint
+  typecheck-stl:
+    name: Typecheck - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Typecheck STL package
+      run: pnpm --filter @ermnvldmr/stl typecheck
+  test-stl:
+    name: Test - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Test STL package
+      run: pnpm --filter @ermnvldmr/stl test:coverage
+  build-stl:
+    name: Build - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Build STL package
+      run: pnpm --filter @ermnvldmr/stl build

.gitea/workflows/packages-stl-pr-required.yml

@@ -0,0 +1,346 @@
+name: packages/stl - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/stl/**
+    - .gitea/workflows/packages-stl-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+  workflow_dispatch: {}
+concurrency:
+  group: ci-pr-stl-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-stl:
+    name: Lint - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Lint STL package
+      run: pnpm --filter @ermnvldmr/stl lint
+  typecheck-stl:
+    name: Typecheck - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Typecheck STL package
+      run: pnpm --filter @ermnvldmr/stl typecheck
+  test-stl:
+    name: Test - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Test STL package
+      run: pnpm --filter @ermnvldmr/stl test:coverage
+  build-stl:
+    name: Build - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Build STL package
+      run: pnpm --filter @ermnvldmr/stl build

.gitea/workflows/packages-ui-next-required.yml

@@ -0,0 +1,535 @@
+name: packages/ui - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-ui-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-ui-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-ui:
+    name: Lint - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Lint UI package
+      run: pnpm --filter @ermnvldmr/ui lint
+  typecheck-ui:
+    name: Typecheck - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Typecheck UI package
+      run: pnpm --filter @ermnvldmr/ui typecheck
+  test-ui:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Test UI package
+      run: pnpm --filter @ermnvldmr/ui test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/ui test:storybook:ci
+  build-ui:
+    name: Build - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build UI package
+      run: pnpm --filter @ermnvldmr/ui build

.gitea/workflows/packages-ui-pr-required.yml

@@ -0,0 +1,544 @@
+name: packages/ui - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-ui-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-ui-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-ui:
+    name: Lint - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Lint UI package
+      run: pnpm --filter @ermnvldmr/ui lint
+  typecheck-ui:
+    name: Typecheck - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Typecheck UI package
+      run: pnpm --filter @ermnvldmr/ui typecheck
+  test-ui:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Test UI package
+      run: pnpm --filter @ermnvldmr/ui test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ui-storybook-static-${{ github.run_id }}
+        path: packages/ui/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-storybook-static-${{ github.run_id }}
+        path: packages/ui/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/ui test:storybook:ci
+  build-ui:
+    name: Build - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build UI package
+      run: pnpm --filter @ermnvldmr/ui build

.gitea/workflows/services-docs-next-required.yml

@@ -0,0 +1,138 @@
+name: services/docs - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/docs/**
+    - .gitea/workflows/services-docs-next-required.yml
+    - ci/docker/docs/**
+    - ci/config/nginx/**
+    - ci/scripts/**
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-docs-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-hugo:
+    name: Setup - Hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+  build-hugo:
+    name: Build - Hugo Site
+    needs: setup-hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+    - name: Build Hugo site
+      working-directory: services/docs
+      run: hugo --gc --minify
+  release-docker:
+    name: Release - Docker Image
+    needs: build-hugo
+    runs-on: apex-debian13
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Log in to GitHub Container Registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Extract Docker metadata
+      id: meta
+      run: python3 .gitea/scripts/docker.py metadata
+      env:
+        IMAGES: git.ermnvldmr.com/${{ github.repository }}/docs
+        TAG_RULES: 'type=raw,value=latest
+
+          type=sha,format=short
+
+          '
+        SOURCE_SHA: ${{ github.sha }}
+    - name: Compute short SHA
+      id: vars
+      run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+    - name: Build and push Docker image
+      run: python3 .gitea/scripts/docker.py build
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
+        LABELS: ${{ steps.meta.outputs.labels }}
+        BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+
+          VERSION=${{ steps.vars.outputs.short_sha }}
+
+          '
+        DOCKERFILE: ci/docker/docs/Dockerfile
+        PLATFORMS: ''
+        PUSH: 'true'
+        CONTEXT: .
+        SOURCE_SHA: ${{ github.sha }}
+        RUN_ID: ${{ github.run_id }}
+  deploy:
+    name: Deploy - Kubernetes (GitOps)
+    needs: release-docker
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    permissions:
+      contents: write
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\")\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n' \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes\
+        \ -o StrictHostKeyChecking=yes -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Setup Kustomize
+      run: test "$(kustomize version)" = v5.3.0
+    - name: Deploy via GitOps
+      run: 'DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+
+        bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"
+
+        '
+      env:
+        GIT_WRITE_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
+  verify-rollout:
+    name: Verify - Production Rollout
+    needs: deploy
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    steps:
+    - name: Await production rollout
+      run: "TARGET_COMMIT=\"sha-$(echo ${{ github.sha }} | cut -c1-7)\"\nENDPOINT=\"https://docs.ermnvldmr.com/version.json\"\n\necho \"========================================================\"\necho \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit: $TARGET_COMMIT\"\necho \"========================================================\"\n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le $MAX_ATTEMPTS ]; do\n  echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\n\n  RESP_FILE=$(mktemp)\n  HTTP_CODE=$(curl -sL --max-time 10 \\\n    -H \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n    -H \"Accept: application/json\" \\\n    -o \"$RESP_FILE\" \\\n    -w \"%{http_code}\" \\\n    \"$ENDPOINT\" || echo \"000\")\n\n  if [ \"$HTTP_CODE\" = \"200\" ]; then\n    LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null || true)\n    echo \"  Live commit:\
+        \ ${LIVE_COMMIT:-<none>}\"\n\n    if [ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n      echo \"\u2705 Success! Production docs has successfully rolled out $TARGET_COMMIT.\"\n      rm -f \"$RESP_FILE\"\n      exit 0\n    fi\n  elif [ \"$HTTP_CODE\" = \"403\" ] || [ \"$HTTP_CODE\" = \"503\" ]; then\n    echo \"  HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP.\"\n    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1))\n  else\n    echo \"  HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out.\"\n  fi\n\n  rm -f \"$RESP_FILE\"\n\n  if [ $CF_BLOCKED_COUNT -ge 5 ]; then\n    echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n    echo \"The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster.\"\n    echo \"Skipping further external HTTP verification to avoid false negative.\"\n    exit 0\n  fi\n\n  ATTEMPT=$((ATTEMPT + 1))\n  sleep 10\ndone\n\
+        \necho \"\u274C Deployment verification timed out after 7.5 minutes.\"\nexit 1\n"

.gitea/workflows/services-docs-pr-required.yml

@@ -0,0 +1,47 @@
+name: services/docs - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/docs/**
+    - .gitea/workflows/services-docs-pr-required.yml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-docs-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-hugo:
+    name: Setup - Hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+  build-hugo:
+    name: Build - Hugo Site
+    needs: setup-hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+    - name: Build Hugo site
+      working-directory: services/docs
+      run: hugo --gc --minify

.gitea/workflows/services-static-next-required.yml

@@ -0,0 +1,374 @@
+name: services/static - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/static/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-static-next-required.yml
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-static-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-static:
+    name: Lint - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Lint static service
+      run: pnpm --filter @ermnvldmr/static lint
+  typecheck-static:
+    name: Typecheck - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Typecheck static service
+      run: pnpm --filter @ermnvldmr/static typecheck
+  build-static:
+    name: Build - Static Site
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build static service
+      run: pnpm --filter @ermnvldmr/static build
+    - name: Upload build artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: static-dist
+        path: services/static/dist/
+        retention-days: 30
+  deploy-s3:
+    name: Deploy - S3
+    needs:
+    - lint-static
+    - typecheck-static
+    - build-static
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Download build artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: static-dist
+        path: services/static/dist/
+    - name: Deploy to S3
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }}
+        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }}
+        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }}
+        AWS_REGION: ${{ secrets.STATIC_AWS_REGION }}
+        S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }}
+      run: 'chmod +x ci/scripts/deploy-static.sh
+
+        ./ci/scripts/deploy-static.sh
+
+        '

.gitea/workflows/services-static-pr-required.yml

@@ -0,0 +1,324 @@
+name: services/static - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/static/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-static-pr-required.yml
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-static-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-static:
+    name: Lint - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Lint static service
+      run: pnpm --filter @ermnvldmr/static lint
+  typecheck-static:
+    name: Typecheck - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Typecheck static service
+      run: pnpm --filter @ermnvldmr/static typecheck
+  build-static:
+    name: Build - Static Site
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build static service
+      run: pnpm --filter @ermnvldmr/static build
+    - name: Upload build artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: static-dist-${{ github.run_id }}
+        path: services/static/dist/
+        retention-days: 30

.gitea/workflows/services-www-deploy-manual.yml

@@ -0,0 +1,122 @@
+name: services/www - manual deploy
+'on':
+  workflow_dispatch:
+    inputs:
+      tested_sha:
+        description: Full tested source commit
+        required: true
+        type: string
+      tested_digest:
+        description: OCI sha256 digest from the successful build
+        required: true
+        type: string
+      build_run_id:
+        description: Successful WWW build run ID
+        required: true
+        type: string
+      release_tag:
+        description: Previously approved release tag
+        required: true
+        type: string
+      release_run_id:
+        description: Successful manually approved release run ID
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+jobs:
+  deploy:
+    runs-on: apex-debian13
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
+      && github.actor == 'deytenit'
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Authenticate local registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: deytenit
+        REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_READ_TOKEN }}
+    - name: Verify successful build and immutable digest
+      id: provenance
+      run: python3 .gitea/scripts/provenance.py
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+        RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+        RELEASE_TAG: ${{ inputs.release_tag }}
+    - name: Verify approved release and deploy digest
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+        RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+        RELEASE_TAG: ${{ inputs.release_tag }}
+        GIT_WRITE_KEY: ${{ secrets.WWW_DEPLOY_KEY }}
+      run: 'set -euo pipefail
+
+        [[ "$RELEASE_TAG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]
+
+        test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$TESTED_SHA"
+
+        test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$RELEASE_TAG"
+        --format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST"
+
+        bash ci/scripts/deploy-gitops.sh www "$TESTED_DIGEST"
+
+        '
+    - name: Await production rollout
+      run: "TARGET_COMMIT=\"sha-${TESTED_SHA:0:7}\"\nENDPOINT=\"https://www.ermnvldmr.com/version.json\"\
+        \n\necho \"========================================================\"\necho\
+        \ \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit:\
+        \  $TARGET_COMMIT\"\necho \"========================================================\"\
+        \n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le\
+        \ $MAX_ATTEMPTS ]; do\n  echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\
+        \n\n  RESP_FILE=$(mktemp)\n  HTTP_CODE=$(curl -sL --max-time 10 \\\n    -H\
+        \ \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\
+        \ (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n    -H \"Accept:\
+        \ application/json\" \\\n    -o \"$RESP_FILE\" \\\n    -w \"%{http_code}\"\
+        \ \\\n    \"$ENDPOINT\" || echo \"000\")\n\n  if [ \"$HTTP_CODE\" = \"200\"\
+        \ ]; then\n    LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null\
+        \ || true)\n    echo \"  Live commit:  ${LIVE_COMMIT:-<none>}\"\n\n    if\
+        \ [ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n      echo \"\u2705 Success!\
+        \ Production has successfully rolled out $TARGET_COMMIT.\"\n      rm -f \"\
+        $RESP_FILE\"\n      exit 0\n    fi\n  elif [ \"$HTTP_CODE\" = \"403\" ] ||\
+        \ [ \"$HTTP_CODE\" = \"503\" ]; then\n    echo \"  HTTP $HTTP_CODE: Cloudflare\
+        \ WAF/challenge encountered from runner IP.\"\n    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT\
+        \ + 1))\n  else\n    echo \"  HTTP $HTTP_CODE: Endpoint returned unexpected\
+        \ status code or timed out.\"\n  fi\n\n  rm -f \"$RESP_FILE\"\n\n  if [ $CF_BLOCKED_COUNT\
+        \ -ge 5 ]; then\n    echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked\
+        \ external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n    echo\
+        \ \"The GitOps release commit was already pushed to the repository; FluxCD\
+        \ will reconcile the cluster.\"\n    echo \"Skipping further external HTTP\
+        \ verification to avoid false negative.\"\n    exit 0\n  fi\n\n  ATTEMPT=$((ATTEMPT\
+        \ + 1))\n  sleep 10\ndone\n\necho \"\u274C Deployment verification timed out\
+        \ after 7.5 minutes.\"\nexit 1\n"
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}

.gitea/workflows/services-www-next-required.yml

@@ -0,0 +1,653 @@
+name: services/www - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/www/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-www-next-required.yml
+    - ci/docker/www/**
+    - ci/config/nginx/**
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+  workflow_dispatch: null
+concurrency:
+  group: ci-www-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Build i18n package
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-www:
+    name: Lint - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Lint WWW service
+      run: pnpm --filter @ermnvldmr/www lint
+  typecheck-www:
+    name: Typecheck - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Typecheck WWW service
+      run: pnpm --filter @ermnvldmr/www typecheck
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Build WWW Storybook
+      run: pnpm --filter @ermnvldmr/www build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-static
+        path: services/www/storybook-static/
+        retention-days: 30
+  test-www:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Test WWW service
+      run: pnpm --filter @ermnvldmr/www test:coverage
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-static
+        path: services/www/storybook-static/
+    - name: Serve Storybook and run tests with coverage
+      run: pnpm --filter @ermnvldmr/www test:storybook:ci
+  build-www:
+    name: Build - WWW Service
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Build WWW service (all locales)
+      run: pnpm --filter @ermnvldmr/www build:all
+      env:
+        RSDOCTOR: 'true'
+    - name: Upload Rsdoctor report
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsdoctor-report
+        path: services/www/rsdoctor/
+        retention-days: 30
+  build-docker:
+    name: Build - Docker Image
+    needs:
+    - lint-www
+    - typecheck-www
+    - test-www
+    - test-storybook
+    - build-www
+    runs-on: apex-debian13
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      short_sha: ${{ steps.vars.outputs.short_sha }}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Calculate Short SHA
+      id: vars
+      run: 'SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+
+        echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+
+        '
+    - name: Log in to GitHub Container Registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Set up Docker Buildx
+      run: 'docker buildx version
+
+        docker buildx create --name apex-ci --driver docker-container --use
+
+        docker buildx inspect --bootstrap'
+    - name: Build and push Docker image
+      run: python3 .gitea/scripts/docker.py build
+      env:
+        TAGS: git.ermnvldmr.com/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha
+          }}
+        LABELS: ''
+        BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+
+          VERSION=${{ steps.vars.outputs.short_sha }}
+
+          '
+        DOCKERFILE: ci/docker/www/Dockerfile
+        PLATFORMS: ''
+        PUSH: 'true'
+        CONTEXT: .
+        SOURCE_SHA: ${{ github.sha }}
+        RUN_ID: ${{ github.run_id }}
+      id: image
+    - name: Record tested digest provenance
+      env:
+        IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
+      run: 'mkdir -p .ci
+
+        python3 - <<''PROVENANCE''
+
+        import json, os
+
+        from pathlib import Path
+
+        Path(''.ci/www-provenance.json'').write_text(json.dumps({''sha'': os.environ[''GITHUB_SHA''],
+        ''digest'': os.environ[''IMAGE_DIGEST''], ''run_id'': os.environ[''GITHUB_RUN_ID''],
+        ''repository'': os.environ[''GITHUB_REPOSITORY'']}))
+
+        PROVENANCE'
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: www-provenance
+        path: .ci/www-provenance.json
+        retention-days: 30

.gitea/workflows/services-www-pr-required.yml

@@ -0,0 +1,553 @@
+name: services/www - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/www/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-www-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-www-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Build i18n package
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-www:
+    name: Lint - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Lint WWW service
+      run: pnpm --filter @ermnvldmr/www lint
+  typecheck-www:
+    name: Typecheck - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Typecheck WWW service
+      run: pnpm --filter @ermnvldmr/www typecheck
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Build WWW Storybook
+      run: pnpm --filter @ermnvldmr/www build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: www-storybook-static-${{ github.run_id }}
+        path: services/www/storybook-static/
+        retention-days: 30
+  test-www:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Test WWW service
+      run: pnpm --filter @ermnvldmr/www test:coverage
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: www-storybook-static-${{ github.run_id }}
+        path: services/www/storybook-static/
+    - name: Serve Storybook and run tests with coverage
+      run: pnpm --filter @ermnvldmr/www test:storybook:ci
+  build-www:
+    name: Build - WWW Service
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Build WWW service (all locales)
+      run: pnpm --filter @ermnvldmr/www build:all
+      env:
+        RSDOCTOR: 'true'
+    - name: Upload Rsdoctor report
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsdoctor-report-${{ github.run_id }}
+        path: services/www/rsdoctor/
+        retention-days: 30

.gitea/workflows/services-www-release-manual.yml

@@ -0,0 +1,108 @@
+name: services/www - manual release
+'on':
+  workflow_dispatch:
+    inputs:
+      tested_sha:
+        description: Full tested source commit
+        required: true
+        type: string
+      tested_digest:
+        description: OCI sha256 digest from the successful build
+        required: true
+        type: string
+      build_run_id:
+        description: Successful WWW build run ID
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+jobs:
+  release:
+    runs-on: apex-debian13
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
+      && github.actor == 'deytenit'
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Authenticate local registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: deytenit
+        REGISTRY_TOKEN: ${{ secrets.RELEASE_REGISTRY_TOKEN }}
+    - name: Verify successful build and immutable digest
+      id: provenance
+      run: python3 .gitea/scripts/provenance.py
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+    - name: Promote tested digest and create release tag
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+        GIT_WRITE_KEY: ${{ secrets.WWW_RELEASE_KEY }}
+      run: 'set -euo pipefail
+
+        VERSION=$(bash ci/scripts/calver-release.sh)
+
+        [[ "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]
+
+        if git show-ref --verify --quiet "refs/tags/$VERSION"; then exit 1; fi
+
+        docker buildx imagetools create --prefer-index=false "git.ermnvldmr.com/deytenit/ermnvldmr.com/www@$TESTED_DIGEST"
+        --tag "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"
+
+        test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"
+        --format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST"
+
+        git tag "$VERSION" "$TESTED_SHA"
+
+        python3 .gitea/scripts/git_write.py "refs/tags/$VERSION"
+
+        export VERSION
+
+        mkdir -p .ci
+
+        python3 - <<''RELEASE_PROVENANCE''
+
+        import json, os
+
+        from pathlib import Path
+
+        Path(''.ci/www-release.json'').write_text(json.dumps({''sha'': os.environ[''TESTED_SHA''],
+        ''digest'': os.environ[''TESTED_DIGEST''], ''run_id'': os.environ[''BUILD_RUN_ID''],
+        ''repository'': ''deytenit/ermnvldmr.com'', ''release_tag'': os.environ[''VERSION'']}))
+
+        RELEASE_PROVENANCE
+
+        '
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: www-release-provenance
+        path: .ci/www-release.json
+        retention-days: 30

.github/workflows/ci-next-build-golden-image.yml

@@ -1,134 +0,0 @@
-name: ci - next/build-golden-image
-
-on:
-  workflow_dispatch:
-
-concurrency:
-  group: ci-golden-image
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  validate-scripts:
-    name: Validate - Provisioner Scripts
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Validate Shell Script Syntax
-        run: bash -n ci/packer/scripts/*.sh
-
-  build-image:
-    name: Build - Golden Image
-    needs: validate-scripts
-    runs-on: ubuntu-latest
-    outputs:
-      image_name: ${{ steps.vars.outputs.image_name }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Calculate Image Name
-        id: vars
-        run: |
-          SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)"
-          IMAGE_NAME="com-ermnvldmr-debian-12-k3s-amd64-${SHORT_SHA}.qcow2"
-          echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
-
-      - name: Install Build Tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y qemu-utils
-
-      - name: Build Debian K3s Golden Image
-        run: |
-          mkdir -p output-qemu
-          echo "Downloading official Debian 12 cloud image..."
-          curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
-          
-          echo "Expanding disk image to 10G..."
-          qemu-img resize base.qcow2 10G
-          
-          echo "Connecting disk image via NBD..."
-          sudo modprobe nbd max_part=8
-          sudo qemu-nbd --connect=/dev/nbd0 base.qcow2
-          sleep 1
-          sudo partx -u /dev/nbd0 || true
-          
-          echo "Mounting disk filesystem..."
-          sudo mkdir -p /mnt/target
-          sudo mount /dev/nbd0p1 /mnt/target
-          
-          echo "Mounting host virtual filesystems and configuring DNS..."
-          sudo rm -f /mnt/target/etc/resolv.conf
-          echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf
-          echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf
-          sudo mount --bind /dev /mnt/target/dev
-          sudo mount --bind /dev/pts /mnt/target/dev/pts
-          sudo mount --bind /proc /mnt/target/proc
-          sudo mount --bind /sys /mnt/target/sys
-          
-          echo "Copying provisioner scripts..."
-          sudo mkdir -p /mnt/target/tmp/scripts
-          sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/
-          sudo chmod +x /mnt/target/tmp/scripts/*.sh
-          
-          echo "Running provisioner scripts in chroot..."
-          sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh
-          sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh
-          sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh
-          sudo rm -rf /mnt/target/tmp/scripts
-          
-          echo "Unmounting filesystems..."
-          sudo umount /mnt/target/sys
-          sudo umount /mnt/target/proc
-          sudo umount /mnt/target/dev/pts
-          sudo umount /mnt/target/dev
-          sudo umount /mnt/target
-          sudo qemu-nbd --disconnect /dev/nbd0
-          
-          echo "Compressing and optimizing qcow2 with 2M cluster size..."
-          qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
-          echo "Golden image built successfully."
-
-      - name: Prepare and Upload Image Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: golden-image
-          path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
-          retention-days: 1
-
-  upload-s3:
-    name: Upload - S3 Storage
-    needs: build-image
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download Image Artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: golden-image
-          path: output-qemu
-
-      - name: Upload to Static S3 (/dev/images/)
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION || 'ru-central1' }}
-          S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL }}
-          S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET }}
-          IMAGE_NAME: ${{ needs.build-image.outputs.image_name }}
-        run: |
-          mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 "output-qemu/${IMAGE_NAME}"
-          if [ -n "${S3_BUCKET}" ] && [ -n "${AWS_ACCESS_KEY_ID}" ]; then
-            ENDPOINT_FLAG=""
-            [ -n "${S3_ENDPOINT}" ] && ENDPOINT_FLAG="--endpoint-url=${S3_ENDPOINT}"
-            echo "Cleaning up older images in dev/images/ to free bucket storage..."
-            aws ${ENDPOINT_FLAG} s3 rm "s3://${S3_BUCKET}/dev/images/" --recursive --exclude "*" --include "com-ermnvldmr-debian-12-k3s-*.qcow2" || true
-            aws ${ENDPOINT_FLAG} s3 cp "output-qemu/${IMAGE_NAME}" "s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}"
-            echo "Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}"
-          else
-            echo "S3 storage secrets not provided; skipping remote S3 upload. Image artifact is preserved in GitHub Actions run artifacts."
-          fi

.github/workflows/codeql.yml

@@ -1,51 +0,0 @@
-name: CodeQL
-
-on:
-  push:
-    branches: [next]
-    paths-ignore:
-      - '**/kustomization.yaml'
-  pull_request:
-    branches: [next]
-    paths-ignore:
-      - '**/kustomization.yaml'
-  schedule:
-    - cron: '43 8 * * 3'
-
-concurrency:
-  group: codeql-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  security-events: write
-  actions: read
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['actions', 'javascript-typescript']
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{ matrix.language }}"

.github/workflows/packages-kits-next-required.yml

@@ -1,361 +0,0 @@
-name: packages/kits - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/kits/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-kits-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-next-kits-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs & UI
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Build UI
-        run: pnpm --filter @ermnvldmr/ui build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-      - name: Upload UI dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-          retention-days: 1
-
-  lint-kits:
-    name: Lint - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Lint Kits package
-        run: pnpm --filter @ermnvldmr/kits lint
-
-  typecheck-kits:
-    name: Typecheck - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Typecheck Kits package
-        run: pnpm --filter @ermnvldmr/kits typecheck
-
-  test-kits:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Test Kits package
-        run: pnpm --filter @ermnvldmr/kits test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/lcov.info
-          flags: kits
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits Storybook
-        run: pnpm --filter @ermnvldmr/kits build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-          retention-days: 1
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/kits test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/storybook/lcov.info
-          flags: kits-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-kits:
-    name: Build - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits package
-        run: pnpm --filter @ermnvldmr/kits build

.github/workflows/packages-kits-pr-required.yml

@@ -1,361 +0,0 @@
-name: packages/kits - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/kits/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-kits-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-kits-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs & UI
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Build UI
-        run: pnpm --filter @ermnvldmr/ui build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-      - name: Upload UI dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-          retention-days: 1
-
-  lint-kits:
-    name: Lint - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Lint Kits package
-        run: pnpm --filter @ermnvldmr/kits lint
-
-  typecheck-kits:
-    name: Typecheck - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Typecheck Kits package
-        run: pnpm --filter @ermnvldmr/kits typecheck
-
-  test-kits:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Test Kits package
-        run: pnpm --filter @ermnvldmr/kits test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/lcov.info
-          flags: kits
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits Storybook
-        run: pnpm --filter @ermnvldmr/kits build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-          retention-days: 1
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/kits test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/storybook/lcov.info
-          flags: kits-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-kits:
-    name: Build - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits package
-        run: pnpm --filter @ermnvldmr/kits build

.github/workflows/packages-ssg-next-required.yml

@@ -1,145 +0,0 @@
-name: packages/ssg - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/ssg/**'
-      - '.github/workflows/packages-ssg-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-ssg-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-ssg:
-    name: Lint - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Lint SSG package
-        run: pnpm --filter @ermnvldmr/ssg lint
-
-  typecheck-ssg:
-    name: Typecheck - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Typecheck SSG package
-        run: pnpm --filter @ermnvldmr/ssg typecheck
-
-  build-ssg:
-    name: Build - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Build SSG package
-        run: pnpm --filter @ermnvldmr/ssg build

.github/workflows/packages-ssg-pr-required.yml

@@ -1,145 +0,0 @@
-name: packages/ssg - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/ssg/**'
-      - '.github/workflows/packages-ssg-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-ssg-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-ssg:
-    name: Lint - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Lint SSG package
-        run: pnpm --filter @ermnvldmr/ssg lint
-
-  typecheck-ssg:
-    name: Typecheck - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Typecheck SSG package
-        run: pnpm --filter @ermnvldmr/ssg typecheck
-
-  build-ssg:
-    name: Build - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Build SSG package
-        run: pnpm --filter @ermnvldmr/ssg build

.github/workflows/packages-stl-next-required.yml

@@ -1,176 +0,0 @@
-name: packages/stl - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/stl/**'
-      - '.github/workflows/packages-stl-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-stl-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-stl:
-    name: Lint - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Lint STL package
-        run: pnpm --filter @ermnvldmr/stl lint
-
-  typecheck-stl:
-    name: Typecheck - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Typecheck STL package
-        run: pnpm --filter @ermnvldmr/stl typecheck
-
-  test-stl:
-    name: Test - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Test STL package
-        run: pnpm --filter @ermnvldmr/stl test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/stl/coverage/lcov.info
-          flags: stl
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-stl:
-    name: Build - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Build STL package
-        run: pnpm --filter @ermnvldmr/stl build

.github/workflows/packages-stl-pr-required.yml

@@ -1,176 +0,0 @@
-name: packages/stl - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/stl/**'
-      - '.github/workflows/packages-stl-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-stl-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-stl:
-    name: Lint - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Lint STL package
-        run: pnpm --filter @ermnvldmr/stl lint
-
-  typecheck-stl:
-    name: Typecheck - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Typecheck STL package
-        run: pnpm --filter @ermnvldmr/stl typecheck
-
-  test-stl:
-    name: Test - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Test STL package
-        run: pnpm --filter @ermnvldmr/stl test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/stl/coverage/lcov.info
-          flags: stl
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-stl:
-    name: Build - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Build STL package
-        run: pnpm --filter @ermnvldmr/stl build

.github/workflows/packages-ui-next-required.yml

@@ -1,313 +0,0 @@
-name: packages/ui - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-ui-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-ui-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-ui:
-    name: Lint - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Lint UI package
-        run: pnpm --filter @ermnvldmr/ui lint
-
-  typecheck-ui:
-    name: Typecheck - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Typecheck UI package
-        run: pnpm --filter @ermnvldmr/ui typecheck
-
-  test-ui:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Test UI package
-        run: pnpm --filter @ermnvldmr/ui test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/lcov.info
-          flags: ui
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/ui test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/storybook/lcov.info
-          flags: ui-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-ui:
-    name: Build - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build UI package
-        run: pnpm --filter @ermnvldmr/ui build

.github/workflows/packages-ui-pr-required.yml

@@ -1,322 +0,0 @@
-name: packages/ui - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-ui-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-ui-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-ui:
-    name: Lint - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Lint UI package
-        run: pnpm --filter @ermnvldmr/ui lint
-
-  typecheck-ui:
-    name: Typecheck - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Typecheck UI package
-        run: pnpm --filter @ermnvldmr/ui typecheck
-
-  test-ui:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Test UI package
-        run: pnpm --filter @ermnvldmr/ui test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/lcov.info
-          flags: ui
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-storybook-static-${{ github.run_id }}
-          path: packages/ui/storybook-static/
-          retention-days: 1
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-storybook-static-${{ github.run_id }}
-          path: packages/ui/storybook-static/
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/ui test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/storybook/lcov.info
-          flags: ui-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-ui:
-    name: Build - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build UI package
-        run: pnpm --filter @ermnvldmr/ui build

.github/workflows/services-docs-next-required.yml

@@ -1,189 +0,0 @@
-name: services/docs - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/docs/**'
-      - '.github/workflows/services-docs-next-required.yml'
-      - 'ci/docker/docs/**'
-      - 'ci/config/nginx/**'
-      - 'ci/scripts/**'
-
-concurrency:
-  group: ci-docs-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-hugo:
-    name: Setup - Hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-  build-hugo:
-    name: Build - Hugo Site
-    needs: setup-hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-      - name: Build Hugo site
-        working-directory: services/docs
-        run: hugo --gc --minify
-
-  release-docker:
-    name: Release - Docker Image
-    needs: build-hugo
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/docs
-          tags: |
-            type=raw,value=latest
-            type=sha,format=short
-
-      - name: Compute short SHA
-        id: vars
-        run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/docs/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
-            VERSION=${{ steps.vars.outputs.short_sha }}
-
-  deploy:
-    name: Deploy - Kubernetes (GitOps)
-    needs: release-docker
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: next
-          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
-
-      - name: Setup Kustomize
-        uses: imranismail/setup-kustomize@v2
-        with:
-          kustomize-version: "5.3.0"
-
-      - name: Deploy via GitOps
-        run: |
-          DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-          bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"
-
-  verify-rollout:
-    name: Verify - Production Rollout
-    needs: deploy
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
-    steps:
-      - name: Await production rollout
-        run: |
-          TARGET_COMMIT="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-          ENDPOINT="https://docs.ermnvldmr.com/version.json"
-
-          echo "========================================================"
-          echo "Verifying production deployment on $ENDPOINT"
-          echo "Expected commit: $TARGET_COMMIT"
-          echo "========================================================"
-
-          MAX_ATTEMPTS=45
-          ATTEMPT=1
-          CF_BLOCKED_COUNT=0
-
-          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
-            echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."
-
-            RESP_FILE=$(mktemp)
-            HTTP_CODE=$(curl -sL --max-time 10 \
-              -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" \
-              -H "Accept: application/json" \
-              -o "$RESP_FILE" \
-              -w "%{http_code}" \
-              "$ENDPOINT" || echo "000")
-
-            if [ "$HTTP_CODE" = "200" ]; then
-              LIVE_COMMIT=$(jq -r '.commit // empty' "$RESP_FILE" 2>/dev/null || true)
-              echo "  Live commit: ${LIVE_COMMIT:-<none>}"
-
-              if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
-                echo "✅ Success! Production docs has successfully rolled out $TARGET_COMMIT."
-                rm -f "$RESP_FILE"
-                exit 0
-              fi
-            elif [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "503" ]; then
-              echo "  HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP."
-              CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1))
-            else
-              echo "  HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out."
-            fi
-
-            rm -f "$RESP_FILE"
-
-            if [ $CF_BLOCKED_COUNT -ge 5 ]; then
-              echo "⚠️ Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE)."
-              echo "The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster."
-              echo "Skipping further external HTTP verification to avoid false negative."
-              exit 0
-            fi
-
-            ATTEMPT=$((ATTEMPT + 1))
-            sleep 10
-          done
-
-          echo "❌ Deployment verification timed out after 7.5 minutes."
-          exit 1

.github/workflows/services-docs-pr-required.yml

@@ -1,54 +0,0 @@
-name: services/docs - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/docs/**'
-      - '.github/workflows/services-docs-pr-required.yml'
-
-concurrency:
-  group: ci-pr-docs-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-hugo:
-    name: Setup - Hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-  build-hugo:
-    name: Build - Hugo Site
-    needs: setup-hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-      - name: Build Hugo site
-        working-directory: services/docs
-        run: hugo --gc --minify

.github/workflows/services-static-next-required.yml

@@ -1,205 +0,0 @@
-name: services/static - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/static/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-static-next-required.yml'
-      - 'ci/scripts/**'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-static-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-static:
-    name: Lint - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Lint static service
-        run: pnpm --filter @ermnvldmr/static lint
-
-  typecheck-static:
-    name: Typecheck - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Typecheck static service
-        run: pnpm --filter @ermnvldmr/static typecheck
-
-  build-static:
-    name: Build - Static Site
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build static service
-        run: pnpm --filter @ermnvldmr/static build
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-dist
-          path: services/static/dist/
-          retention-days: 1
-
-  deploy-s3:
-    name: Deploy - S3
-    needs: [lint-static, typecheck-static, build-static]
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: static-dist
-          path: services/static/dist/
-
-      - name: Deploy to S3
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }}
-          S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }}
-          AWS_REGION: ${{ secrets.STATIC_AWS_REGION }}
-          S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }}
-        run: |
-          chmod +x ci/scripts/deploy-static.sh
-          ./ci/scripts/deploy-static.sh

.github/workflows/services-static-pr-required.yml

@@ -1,178 +0,0 @@
-name: services/static - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/static/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-static-pr-required.yml'
-      - 'ci/scripts/**'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-static-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-static:
-    name: Lint - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Lint static service
-        run: pnpm --filter @ermnvldmr/static lint
-
-  typecheck-static:
-    name: Typecheck - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Typecheck static service
-        run: pnpm --filter @ermnvldmr/static typecheck
-
-  build-static:
-    name: Build - Static Site
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build static service
-        run: pnpm --filter @ermnvldmr/static build
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-dist-${{ github.run_id }}
-          path: services/static/dist/
-          retention-days: 1

.github/workflows/services-www-next-required.yml

@@ -1,508 +0,0 @@
-name: services/www - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/www/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-www-next-required.yml'
-      - 'ci/docker/www/**'
-      - 'ci/config/nginx/**'
-      - 'ci/scripts/**'
-      - 'pnpm-lock.yaml'
-  workflow_dispatch:
-
-concurrency:
-  group: ci-www-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Build i18n package
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-      - name: Upload Unit coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/lcov.info
-          flags: www
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests with coverage
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-      - name: Upload Storybook coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/storybook/lcov.info
-          flags: www-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Build WWW service (all locales)
-        run: pnpm --filter @ermnvldmr/www build:all
-        env:
-          RSDOCTOR: 'true'
-      - name: Upload Rsdoctor report
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsdoctor-report
-          path: services/www/rsdoctor/
-          retention-days: 30
-
-  build-docker:
-    name: Build - Docker Image
-    needs: [lint-www, typecheck-www, test-www, test-storybook, build-www]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    outputs:
-      short_sha: ${{ steps.vars.outputs.short_sha }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Calculate Short SHA
-        id: vars
-        run: |
-          SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ghcr.io/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha }}
-          build-args: |
-            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
-            VERSION=${{ steps.vars.outputs.short_sha }}
-
-  release-tag-docker:
-    name: Release - Tag & Docker
-    needs: build-docker
-    runs-on: ubuntu-latest
-    environment: services-www-releases-publish
-    permissions:
-      contents: write
-      packages: write
-    outputs:
-      version: ${{ steps.calver.outputs.version }}
-      short_sha: ${{ needs.build-docker.outputs.short_sha }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Calculate CalVer Version
-        id: calver
-        run: |
-          VERSION=$(bash ci/scripts/calver-release.sh)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Create and Push Tag
-        run: |
-          TAG_NAME="${{ steps.calver.outputs.version }}"
-          git tag "$TAG_NAME"
-          git push origin "$TAG_NAME"
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Tag and Push Release Docker Image
-        run: |
-          docker buildx imagetools create \
-            ghcr.io/${{ github.repository }}/www:${{ needs.build-docker.outputs.short_sha }} \
-            --tag ghcr.io/${{ github.repository }}/www:${{ steps.calver.outputs.version }}
-
-  deploy:
-    name: Deploy - Kubernetes (GitOps)
-    needs: release-tag-docker
-    runs-on: ubuntu-latest
-    environment:
-      name: services-www-releases-deploy
-      url: https://ermnvldmr.com
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: next
-          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
-
-      - name: Setup Kustomize
-        uses: imranismail/setup-kustomize@v2
-        with:
-          kustomize-version: "5.3.0"
-
-      - name: Deploy via GitOps
-        run: |
-          WWW_TAG="${{ needs.release-tag-docker.outputs.short_sha }}"
-          bash ci/scripts/deploy-gitops.sh www "${WWW_TAG}"
-
-  verify-rollout:
-    name: Verify - Production Rollout
-    needs: [release-tag-docker, deploy]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Await production rollout
-        run: |
-          TARGET_COMMIT="${{ needs.release-tag-docker.outputs.short_sha }}"
-          ENDPOINT="https://www.ermnvldmr.com/version.json"
-
-          echo "========================================================"
-          echo "Verifying production deployment on $ENDPOINT"
-          echo "Expected commit:  $TARGET_COMMIT"
-          echo "========================================================"
-
-          MAX_ATTEMPTS=45
-          ATTEMPT=1
-          CF_BLOCKED_COUNT=0
-
-          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
-            echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."
-
-            RESP_FILE=$(mktemp)
-            HTTP_CODE=$(curl -sL --max-time 10 \
-              -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" \
-              -H "Accept: application/json" \
-              -o "$RESP_FILE" \
-              -w "%{http_code}" \
-              "$ENDPOINT" || echo "000")
-
-            if [ "$HTTP_CODE" = "200" ]; then
-              LIVE_COMMIT=$(jq -r '.commit // empty' "$RESP_FILE" 2>/dev/null || true)
-              echo "  Live commit:  ${LIVE_COMMIT:-<none>}"
-
-              if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
-                echo "✅ Success! Production has successfully rolled out $TARGET_COMMIT."
-                rm -f "$RESP_FILE"
-                exit 0
-              fi
-            elif [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "503" ]; then
-              echo "  HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP."
-              CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1))
-            else
-              echo "  HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out."
-            fi
-
-            rm -f "$RESP_FILE"
-
-            if [ $CF_BLOCKED_COUNT -ge 5 ]; then
-              echo "⚠️ Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE)."
-              echo "The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster."
-              echo "Skipping further external HTTP verification to avoid false negative."
-              exit 0
-            fi
-
-            ATTEMPT=$((ATTEMPT + 1))
-            sleep 10
-          done
-
-          echo "❌ Deployment verification timed out after 7.5 minutes."
-          exit 1

.github/workflows/services-www-pr-required.yml

@@ -1,331 +0,0 @@
-name: services/www - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/www/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-www-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-www-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Build i18n package
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: www-storybook-static-${{ github.run_id }}
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-      - name: Upload Unit coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/lcov.info
-          flags: www
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: www-storybook-static-${{ github.run_id }}
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests with coverage
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-      - name: Upload Storybook coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/storybook/lcov.info
-          flags: www-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Build WWW service (all locales)
-        run: pnpm --filter @ermnvldmr/www build:all
-        env:
-          RSDOCTOR: 'true'
-      - name: Upload Rsdoctor report
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsdoctor-report-${{ github.run_id }}
-          path: services/www/rsdoctor/
-          retention-days: 7

README.md

@@ -1,6 +1,5 @@
 # [ermnvldmr.com](https://ermnvldmr.com)
 
-[![codecov](https://codecov.io/gh/deytenit/ermnvldmr.com/graph/badge.svg)](https://app.codecov.io/github/deytenit/ermnvldmr.com)
 
 The monorepo powering the front pages of my own
 
@@ -58,7 +57,7 @@ Want to contribute or understand the codebase.
   - UI Library: `pnpm ui:dev`
 - **Development Guide**: [AGENTS.md](./AGENTS.md)
 - **Component Development**: `pnpm ui:storybook`
-- **Testing**: `pnpm test` or `pnpm test:coverage` (View results on [Codecov](https://app.codecov.io/github/deytenit/ermnvldmr.com))
+- **Testing**: `pnpm test` or `pnpm test:coverage`
 - **Code Quality**: `pnpm lint` and `pnpm typecheck`
 
 ### Designer

ci/k8s/apps/docs/deployment.yaml

@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: docs
-          image: ghcr.io/deytenit/ermnvldmr.com/docs:sha-91f5245
+          image: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs:sha-91f5245
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

ci/k8s/apps/docs/kustomization.yaml

@@ -5,5 +5,5 @@ resources:
 - deployment.yaml
 - service.yaml
 images:
-- name: ghcr.io/deytenit/ermnvldmr.com/docs
+- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs
-  newTag: sha-b3638f4
+  newTag: sha-84772ff

ci/k8s/apps/umami/configmap.yaml

@@ -6,4 +6,4 @@ metadata:
 data:
   DATABASE_TYPE: "postgresql"
   CLIENT_IP_HEADER: "X-Forwarded-For"
-  TRACKER_SCRIPT_NAME: "beacon.js"
+  TRACKER_SCRIPT_NAME: "trace.js"

ci/k8s/apps/umami/deployment.yaml

@@ -18,7 +18,7 @@ spec:
       labels:
         app: umami
       annotations:
-        config/tracker-script-name: "beacon.js"
+        config/tracker-script-name: "trace.js"
     spec:
       containers:
         - name: umami

ci/k8s/apps/www/deployment.yaml

@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: www
-          image: ghcr.io/deytenit/ermnvldmr.com/www:sha-6d33b71
+          image: git.ermnvldmr.com/deytenit/ermnvldmr.com/www:sha-6d33b71
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

ci/k8s/apps/www/kustomization.yaml

@@ -5,5 +5,5 @@ resources:
 - deployment.yaml
 - service.yaml
 images:
-- name: ghcr.io/deytenit/ermnvldmr.com/www
+- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/www
-  newTag: sha-b3638f4
+  newTag: sha-84772ff

ci/k8s/clusters/production/flux-system/gotk-sync.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: flux-system
 spec:
   interval: 1m
-  url: https://github.com/deytenit/ermnvldmr.com.git
+  url: https://git.ermnvldmr.com/deytenit/ermnvldmr.com.git
+  secretRef:
+    name: gitea-readonly
   ref:
     branch: next
 ---

ci/k8s/infrastructure/cert-manager/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.yaml
+  - install.yaml
   - cluster-issuer.yaml

ci/k8s/infrastructure/networking/ingress-beacon.yaml

@@ -20,7 +20,7 @@ spec:
     - host: www.ermnvldmr.com
       http:
         paths:
-          - path: /beacon
+          - path: /trace
             pathType: Prefix
             backend:
               service:
@@ -30,7 +30,7 @@ spec:
     - host: docs.ermnvldmr.com
       http:
         paths:
-          - path: /beacon
+          - path: /trace
             pathType: Prefix
             backend:
               service:

ci/k8s/infrastructure/networking/middleware-strip-beacon.yaml

@@ -6,4 +6,4 @@ metadata:
 spec:
   stripPrefix:
     prefixes:
-      - /beacon
+      - /trace

ci/packer/scripts/02-install-k3s.sh

@@ -9,7 +9,8 @@ export INSTALL_K3S_SKIP_START="true"
 export INSTALL_K3S_VERSION="v1.31.2+k3s1"
 
 # Download official K3s installer and install binary/systemd unit without starting
-curl -sfL https://get.k3s.io | sh -
+install -m 0755 /tmp/scripts/k3s /usr/local/bin/k3s
+INSTALL_K3S_SKIP_DOWNLOAD=true sh /tmp/scripts/k3s-install.sh
 
 # Verify k3s binary is located in /usr/local/bin
 which k3s
@@ -28,6 +29,7 @@ chmod 644 /etc/rancher/k3s/config.yaml
 
 # Pre-stage default GitOps root sync manifest
 mkdir -p /etc/flux
+install -m 0644 /tmp/scripts/flux-install.yaml /etc/flux/install.yaml
 cat << 'EOF' > /etc/flux/cluster-sync.yaml
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
@@ -36,7 +38,9 @@ metadata:
   namespace: flux-system
 spec:
   interval: 1m
-  url: https://github.com/deytenit/ermnvldmr.com.git
+  url: https://git.ermnvldmr.com/deytenit/ermnvldmr.com.git
+  secretRef:
+    name: gitea-readonly
   ref:
     branch: next
 ---
@@ -119,7 +123,7 @@ else
 fi
 
 echo "=== [Bootstrap] Installing Flux Operator / Custom Resources ==="
-kubectl apply -k "https://github.com/fluxcd/flux2/manifests/install?ref=v2.4.0" || true
+kubectl apply -f /etc/flux/install.yaml
 
 echo "=== [Bootstrap] Applying initial GitOps root sync ==="
 if [ -f /etc/flux/cluster-sync.yaml ]; then

ci/scripts/deploy-gitops.sh

@@ -19,17 +19,25 @@ fi
 
 echo "Updating Kustomize image tag for '$SERVICE' to '$TAG'..."
 cd "$APP_DIR"
-kustomize edit set image "ghcr.io/deytenit/ermnvldmr.com/${SERVICE}:${TAG}"
+IMAGE="git.ermnvldmr.com/deytenit/ermnvldmr.com/${SERVICE}"
+if [[ "$TAG" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+    kustomize edit set image "${IMAGE}=${IMAGE}@${TAG}"
+elif [[ "$TAG" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then
+    kustomize edit set image "${IMAGE}=${IMAGE}:${TAG}"
+else
+    echo "Invalid image digest or tag" >&2
+    exit 1
+fi
 
 cd "$ROOT_DIR"
-git config user.name "adam-at-deytenit"
+git config user.name "APEX CI"
-git config user.email "221188529+adam-at-deytenit@users.noreply.github.com"
+git config user.email "adam@ermnvldmr.com"
 git add "ci/k8s/apps/${SERVICE}/kustomization.yaml"
 
 if git diff --staged --quiet; then
     echo "No manifest changes to commit for $SERVICE."
 else
     git commit -m "chore(release): deploy ${SERVICE} ${TAG} [skip ci]"
-    git push origin next
+    python3 .gitea/scripts/git_write.py HEAD:next
     echo "Successfully deployed $SERVICE ($TAG) via GitOps."
 fi

ci/scripts/ensure-dev-certs.mjs

@@ -162,7 +162,7 @@ export function loadDevRootCaKey(workspaceRoot = findWorkspaceRoot()) {
  * Remote public URL for the Ermnvldmr development root CA certificate.
  */
 export const REMOTE_ROOT_CA_URL =
-  'https://static.ermnvldmr.com/ssl/certs/ErmnvldmrDevelopmentRootCA.pem';
+  'https://static.ermnvldmr.com/dev/ssl/certs/ErmnvldmrDevelopmentRootCA.pem';
 
 /**
  * Ensures valid development certificates exist for localhost.ermnvldmr.com.

codecov.yml

@@ -1,53 +0,0 @@
-codecov:
-  notify:
-    wait_for_ci: true
-
-ignore:
-  - 'packages/eslint-config'
-  - 'packages/rsbuild-config'
-  - 'packages/storybook-config'
-
-coverage:
-  status:
-    project:
-      default:
-        target: 80%
-        threshold: 1%
-        range: 10%
-      stl:
-        target: 80%
-        flags:
-          - stl
-      ui:
-        target: 80%
-        flags:
-          - ui
-      ui-storybook:
-        target: 80%
-        flags:
-          - ui-storybook
-      www:
-        target: 80%
-        flags:
-          - www
-      www-storybook:
-        target: 80%
-        flags:
-          - www-storybook
-
-flags:
-  stl:
-    paths:
-      - packages/stl
-  ui:
-    paths:
-      - packages/ui
-  ui-storybook:
-    paths:
-      - packages/ui
-  www:
-    paths:
-      - services/www
-  www-storybook:
-    paths:
-      - services/www

packages/cli/src/lib/runners/s3SyncRunner.test.ts

@@ -376,4 +376,33 @@ describe('runS3Sync', () => {
     const content = fs.readFileSync(srcPath, 'utf-8');
     expect(content).toContain('https://cdn.example.com/www/img.webp');
   });
+
+  it('should fallback to COM_ERMNVLDMR_STATIC_PUBLIC_URL when publicUrl is not explicitly configured', async () => {
+    process.env.COM_ERMNVLDMR_STATIC_PUBLIC_URL = 'https://static.ermnvldmr.com';
+
+    const staticDir = path.join(tempDir, 'static');
+    fs.mkdirSync(staticDir, { recursive: true });
+    fs.writeFileSync(path.join(staticDir, 'asset.png'), 'png-content');
+
+    const srcDir = path.join(tempDir, 'src');
+    fs.mkdirSync(srcDir, { recursive: true });
+    const srcPath = path.join(srcDir, 'index.ts');
+    fs.writeFileSync(srcPath, 'const img = "/static/asset.png";');
+
+    const cmd: S3SyncCommandConfig = {
+      name: 'sync',
+      description: 'desc',
+      bucket: 'com-ermnvldmr-static',
+      targetPrefix: 'www',
+      sourceDir: './static',
+      type: 's3-sync',
+    };
+
+    await runS3Sync(cmd, {});
+
+    const content = fs.readFileSync(srcPath, 'utf-8');
+    expect(content).toContain('https://static.ermnvldmr.com/www/asset.png');
+
+    delete process.env.COM_ERMNVLDMR_STATIC_PUBLIC_URL;
+  });
 });

packages/cli/src/lib/runners/s3SyncRunner.ts

@@ -53,6 +53,7 @@ export async function runS3Sync(
   const bucket = cmd.bucket ?? process.env.S3_BUCKET;
   const region = cmd.region ?? process.env.AWS_REGION ?? process.env.S3_REGION;
   const endpoint = cmd.endpoint ?? process.env.S3_ENDPOINT_URL ?? process.env.S3_ENDPOINT;
+  const publicUrl = cmd.publicUrl ?? process.env.COM_ERMNVLDMR_STATIC_PUBLIC_URL ?? process.env.S3_PUBLIC_URL;
   const accessKey = cmd.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID ?? process.env.S3_ACCESS_KEY_ID;
   const secretKey = cmd.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY ?? process.env.S3_SECRET_ACCESS_KEY;
 
@@ -149,8 +150,8 @@ export async function runS3Sync(
    */
   const getS3Url = (finalName: string): string => {
     const normalizedKey = normalizeKey(cmd.targetPrefix, finalName);
-    if (cmd.publicUrl) {
+    if (publicUrl) {
-      const cleanPublicUrl = cmd.publicUrl.replace(/\/+$/, '');
+      const cleanPublicUrl = publicUrl.replace(/\/+$/, '');
       return `${cleanPublicUrl}/${normalizedKey}`;
     }
     if (bucket.includes('.')) {

packages/rsbuild-config/src/lib/config/server.ts

@@ -214,7 +214,7 @@ export function loadDevRootCaKey(
  * Remote public URL for the Ermnvldmr development root CA certificate.
  */
 export const REMOTE_ROOT_CA_URL =
-  'https://static.ermnvldmr.com/ssl/certs/ErmnvldmrDevelopmentRootCA.pem';
+  'https://static.ermnvldmr.com/dev/ssl/certs/ErmnvldmrDevelopmentRootCA.pem';
 
 /**
  * Ensures that valid TLS development certificates exist for localhost.ermnvldmr.com.

packages/ssg/package.json

@@ -24,6 +24,7 @@
     "build": "tsc",
     "lint": "eslint src --max-warnings 0",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
     "clean": "rm -rf dist"
   },
   "dependencies": {
@@ -39,6 +40,8 @@
     "@rsbuild/core": "^1.7.3",
     "@rsbuild/plugin-react": "^1.1.1",
     "@rsbuild/plugin-type-check": "^1.1.1",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.1",
     "@types/node": "*",
     "@types/react": "^19.1.2",
     "@types/react-dom": "^19.1.2",
@@ -46,7 +49,8 @@
     "fast-glob": "^3.3.3",
     "jsdom": "^28.0.0",
     "rsbuild-plugin-dts": "^0.19.5",
-    "typescript": "^5.8.2"
+    "typescript": "^5.8.2",
+    "vitest": "^4.1.11"
   },
   "peerDependencies": {
     "react": "^19.1.0",

packages/ssg/src/lib/config/analytics/umami.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+
+import { umamiAnalytics } from './umami';
+
+describe('umamiAnalytics', () => {
+  it('suppresses script injection in non-production environments when not forced', () => {
+    const provider = umamiAnalytics({
+      serverUrl: '/pulse',
+      websiteId: 'test-website-id',
+    });
+
+    expect(provider.getHtmlTags(false)).toEqual([]);
+  });
+
+  it('injects script tag in non-production when force is true', () => {
+    const provider = umamiAnalytics({
+      serverUrl: '/pulse',
+      websiteId: 'test-website-id',
+      force: true,
+    });
+
+    const tags = provider.getHtmlTags(false);
+    expect(tags).toHaveLength(1);
+    expect(tags[0]?.attrs?.src).toBe('/pulse/script.js');
+  });
+
+  it('generates expected script attributes in production builds', () => {
+    const provider = umamiAnalytics({
+      serverUrl: '/trace/',
+      scriptName: 'trace.js',
+      hostUrl: '/trace',
+      websiteId: '41c7699a-0675-4f49-bcd0-3df47a66b6b1',
+      domains: 'ermnvldmr.com,www.ermnvldmr.com',
+      doNotTrack: true,
+      tag: 'landing',
+    });
+
+    const tags = provider.getHtmlTags(true);
+    expect(tags).toEqual([
+      {
+        tag: 'script',
+        head: true,
+        publicPath: false,
+        attrs: {
+          defer: true,
+          src: '/trace/trace.js',
+          'data-website-id': '41c7699a-0675-4f49-bcd0-3df47a66b6b1',
+          'data-host-url': '/trace',
+          'data-domains': 'ermnvldmr.com,www.ermnvldmr.com',
+          'data-do-not-track': 'true',
+          'data-tag': 'landing',
+        },
+      },
+    ]);
+  });
+});

packages/ssg/src/lib/config/ssg.ts

@@ -5,14 +5,36 @@ import path from 'node:path';
 
 import React from 'react';
 
+import { getPageOptions } from '../core/createPage.js';
+
 import type { RsbuildPlugin } from '@rsbuild/core';
 
+/**
+ * Escapes HTML special characters for safe injection into markup.
+ *
+ * @param str - The raw string to escape.
+ * @returns The escaped HTML string.
+ * @example
+ * ```ts
+ * escapeHtml('<script>alert("xss")</script>');
+ * ```
+ */
+function escapeHtml(str: string): string {
+  return str
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
 const SSR_RUNNER_SCRIPT = `
 import { createRsbuild } from '@rsbuild/core';
 
 async function main() {
   const entries = JSON.parse(process.argv[1]);
   const ssrDistPath = process.argv[2];
+  const locale = process.argv[3] || process.env.LOCALE || 'en';
 
   const plugins = [];
   try {
@@ -31,10 +53,35 @@ async function main() {
     // MDX plugins not installed or needed in this service
   }
 
+  if (locale !== 'en') {
+    plugins.push({
+      name: 'ermnvldmr:ssr-locale-mdx-replacement',
+      setup(api) {
+        api.modifyRspackConfig((config, { rspack }) => {
+          config.plugins = [
+            ...(config.plugins ?? []),
+            new rspack.NormalModuleReplacementPlugin(
+              /\\.en\\.mdx$/,
+              (resource) => {
+                resource.request = resource.request.replace(/\\.en\\.mdx$/, '.' + locale + '.mdx');
+              }
+            ),
+          ];
+          return config;
+        });
+      },
+    });
+  }
+
   const ssrBuild = await createRsbuild({
     rsbuildConfig: {
       plugins,
-      source: { entry: entries },
+      source: {
+        entry: entries,
+        define: {
+          'process.env.LOCALE': JSON.stringify(locale),
+        },
+      },
       output: {
         target: 'node',
         distPath: { root: ssrDistPath, js: '.' },
@@ -119,11 +166,16 @@ export function ssgPlugin(): RsbuildPlugin {
           );
         const ssrDistPath = path.join(path.dirname(webDistPath), 'dist-ssr');
 
+        const locale = process.env.LOCALE ?? 'en';
+
         console.log('[ssg-plugin] Building SSR bundles...');
         execFileSync(
           process.execPath,
-          ['--input-type=module', '-e', SSR_RUNNER_SCRIPT, JSON.stringify(entries), ssrDistPath],
+          ['--input-type=module', '-e', SSR_RUNNER_SCRIPT, JSON.stringify(entries), ssrDistPath, locale],
-          { stdio: 'inherit' }
+          {
+            stdio: 'inherit',
+            env: { ...process.env, LOCALE: locale },
+          }
         );
         console.log('[ssg-plugin] SSR bundles ready.');
 
@@ -175,8 +227,10 @@ export function ssgPlugin(): RsbuildPlugin {
             React.createElement(React.StrictMode, null, React.createElement(Component))
           );
 
+          const pageOptions = getPageOptions(Component);
+
           const source = await fs.readFile(webHtmlPath, 'utf8');
-          const injected = source.replace(
+          let injected = source.replace(
             /<div id="root"[^>]*>\s*<\/div>/,
             `<div id="root">${renderedHtml}</div>`
           );
@@ -187,9 +241,29 @@ export function ssgPlugin(): RsbuildPlugin {
             );
           }
 
+          if (pageOptions?.title) {
+            injected = injected.replace(
+              /<title>[^<]*<\/title>/i,
+              `<title>${escapeHtml(pageOptions.title)}</title>`
+            );
+          }
+
+          if (pageOptions?.description) {
+            if (/<meta\s+[^>]*name=["']description["'][^>]*>/i.test(injected)) {
+              injected = injected.replace(
+                /<meta\s+[^>]*name=["']description["'][^>]*>/i,
+                `<meta name="description" content="${escapeHtml(pageOptions.description)}">`
+              );
+            } else {
+              injected = injected.replace(
+                /<\/head>/i,
+                `  <meta name="description" content="${escapeHtml(pageOptions.description)}">\n</head>`
+              );
+            }
+          }
+
           const processed = await critters.process(injected);
 
-          const locale = process.env.LOCALE ?? 'en';
           const localized = processed.replace(
             /<html([^>]*)\slang="[^"]*"/,
             `<html$1 lang="${locale}"`

packages/ssg/src/lib/core/createPage.test.tsx

@@ -0,0 +1,78 @@
+import React from 'react';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import { createPage, getPageOptions } from './createPage';
+
+describe('createPage and getPageOptions', () => {
+  beforeEach(() => {
+    document.title = 'Default Title';
+    const existingMeta = document.querySelector('meta[name="description"]');
+    if (existingMeta) {
+      existingMeta.remove();
+    }
+  });
+
+  it('attaches metadata options to component and retrieves them via getPageOptions', () => {
+    function SamplePage(): React.JSX.Element {
+      return <div>Sample</div>;
+    }
+
+    createPage(SamplePage, {
+      title: 'Sample Title',
+      description: 'Sample Description',
+    });
+
+    const options = getPageOptions(SamplePage);
+    expect(options).toEqual({
+      title: 'Sample Title',
+      description: 'Sample Description',
+    });
+  });
+
+  it('returns undefined for entities without metadata options', () => {
+    function PlainComponent(): React.JSX.Element {
+      return <div>Plain</div>;
+    }
+
+    expect(getPageOptions(PlainComponent)).toBeUndefined();
+    expect(getPageOptions(null)).toBeUndefined();
+    expect(getPageOptions(undefined)).toBeUndefined();
+    expect(getPageOptions('string')).toBeUndefined();
+    expect(getPageOptions(123)).toBeUndefined();
+    expect(getPageOptions({})).toBeUndefined();
+  });
+
+  it('updates document.title and creates meta description in DOM', () => {
+    function MetaPage(): React.JSX.Element {
+      return <div>Meta</div>;
+    }
+
+    createPage(MetaPage, {
+      title: 'Custom Title',
+      description: 'Custom Description',
+    });
+
+    expect(document.title).toBe('Custom Title');
+    const meta = document.querySelector('meta[name="description"]');
+    expect(meta).not.toBeNull();
+    expect(meta?.getAttribute('content')).toBe('Custom Description');
+  });
+
+  it('updates existing meta description if already present in DOM', () => {
+    const existingMeta = document.createElement('meta');
+    existingMeta.setAttribute('name', 'description');
+    existingMeta.setAttribute('content', 'Old Description');
+    document.head.appendChild(existingMeta);
+
+    function AnotherMetaPage(): React.JSX.Element {
+      return <div>Another Meta</div>;
+    }
+
+    createPage(AnotherMetaPage, {
+      description: 'Updated Description',
+    });
+
+    const meta = document.querySelector('meta[name="description"]');
+    expect(meta?.getAttribute('content')).toBe('Updated Description');
+  });
+});

packages/ssg/src/lib/core/createPage.ts

@@ -0,0 +1,121 @@
+import React from 'react';
+
+/**
+ * Options for page creation.
+ */
+export interface PageOptions {
+  /** Document title to set on mount. */
+  title?: string;
+  /** Content of the meta description tag. */
+  description?: string;
+}
+
+/**
+ * Internal interface representing a component with attached page options.
+ */
+interface HasPageOptions {
+  /** The attached page options. */
+  __pageOptions?: PageOptions;
+}
+
+/**
+ * Type predicate checking if a value is an object or function with attached page options.
+ *
+ * @param value - The value to inspect.
+ * @returns True if value has __pageOptions.
+ * @example
+ * ```ts
+ * if (hasPageOptions(Component)) {
+ *   console.log(Component.__pageOptions);
+ * }
+ * ```
+ */
+function hasPageOptions(value: unknown): value is HasPageOptions {
+  return (
+    (typeof value === 'function' || (typeof value === 'object' && value !== null)) &&
+    '__pageOptions' in value
+  );
+}
+
+/**
+ * Retrieves the page metadata options attached to a component via createPage.
+ *
+ * @param component - The component to inspect.
+ * @returns The associated PageOptions, or undefined if none are set.
+ * @example
+ * ```ts
+ * const options = getPageOptions(MyPageComponent);
+ * ```
+ */
+export function getPageOptions(component: unknown): PageOptions | undefined {
+  if (hasPageOptions(component)) {
+    return component.__pageOptions;
+  }
+  return undefined;
+}
+
+/**
+ * Mounts or hydrates a React component into the `#root` element.
+ *
+ * Attaches metadata options for SSG extraction. Skips DOM mounting during the SSG
+ * server-side render pass (`typeof window === 'undefined'`). On the client, hydrates
+ * asynchronously during idle time to unblock First Contentful Paint.
+ *
+ * @param Component - The React component to render.
+ * @param options - Optional page metadata (title, description).
+ *
+ * @example
+ * ```tsx
+ * createPage(App, { title: 'My Page' });
+ * ```
+ */
+export function createPage(Component: React.ComponentType, options: PageOptions = {}): void {
+  Object.assign(Component, { __pageOptions: options });
+
+  if (typeof window === 'undefined') return; // SSG build context: skip DOM mounting
+  const rootElement = document.getElementById('root');
+
+  if (options.title && document.title !== options.title) {
+    document.title = options.title;
+  }
+
+  if (options.description) {
+    let metaDescription = document.querySelector('meta[name="description"]');
+    if (!metaDescription) {
+      metaDescription = document.createElement('meta');
+      metaDescription.setAttribute('name', 'description');
+      document.head.appendChild(metaDescription);
+    }
+    if (metaDescription.getAttribute('content') !== options.description) {
+      metaDescription.setAttribute('content', options.description);
+    }
+  }
+
+  if (!rootElement) return;
+
+  const mountOrHydrate = () => {
+    void import('react-dom/client')
+      .then(({ createRoot, hydrateRoot }) => {
+        const node = React.createElement(
+          React.StrictMode,
+          null,
+          React.createElement(Component)
+        );
+
+        if (rootElement.hasChildNodes()) {
+          hydrateRoot(rootElement, node);
+        } else {
+          createRoot(rootElement).render(node);
+        }
+      })
+      .catch((err: unknown) => {
+        console.error('[createPage] Client hydration failed:', err);
+      });
+  };
+
+  if ('requestIdleCallback' in window) {
+    window.requestIdleCallback(mountOrHydrate);
+  } else {
+    setTimeout(mountOrHydrate, 1);
+  }
+}

packages/ssg/src/lib/core/createPage.tsx

@@ -1,73 +0,0 @@
-import React from 'react';
-
-/**
- * Options for page creation.
- */
-export interface PageOptions {
-  /** Document title to set on mount. */
-  title?: string;
-  /** Content of the meta description tag. */
-  description?: string;
-}
-
-/**
- * Mounts or hydrates a React component into the `#root` element.
- *
- * Skips DOM mounting during the SSG server-side render pass
- * (`typeof window === 'undefined'`). On the client, hydrates asynchronously
- * during idle time to unblock First Contentful Paint.
- *
- * @param Component - The React component to render.
- * @param options - Optional page metadata (title, description).
- *
- * @example
- * ```tsx
- * createPage(App, { title: 'My Page' });
- * ```
- */
-export function createPage(Component: React.ComponentType, options: PageOptions = {}): void {
-  if (typeof window === 'undefined') return; // SSG build context: skip DOM mounting
-  const rootElement = document.getElementById('root');
-
-  if (options.title) {
-    document.title = options.title;
-  }
-
-  if (options.description) {
-    let metaDescription = document.querySelector('meta[name="description"]');
-    if (!metaDescription) {
-      metaDescription = document.createElement('meta');
-      metaDescription.setAttribute('name', 'description');
-      document.head.appendChild(metaDescription);
-    }
-    metaDescription.setAttribute('content', options.description);
-  }
-
-  if (!rootElement) return;
-
-  const mountOrHydrate = () => {
-    void import('react-dom/client')
-      .then(({ createRoot, hydrateRoot }) => {
-        const node = (
-          <React.StrictMode>
-            <Component />
-          </React.StrictMode>
-        );
-
-        if (rootElement.hasChildNodes()) {
-          hydrateRoot(rootElement, node);
-        } else {
-          createRoot(rootElement).render(node);
-        }
-      })
-      .catch((err: unknown) => {
-        console.error('[createPage] Client hydration failed:', err);
-      });
-  };
-
-  if ('requestIdleCallback' in window) {
-    window.requestIdleCallback(mountOrHydrate);
-  } else {
-    setTimeout(mountOrHydrate, 1);
-  }
-}

packages/ssg/vitest.config.ts

@@ -0,0 +1,9 @@
+import { baseVitestConfig } from '@ermnvldmr/rsbuild-config/dev';
+import { mergeConfig } from 'vitest/config';
+
+export default mergeConfig(baseVitestConfig, {
+  test: {
+    environment: 'jsdom',
+    exclude: ['dist/**', 'node_modules/**'],
+  },
+});

packages/ui/src/components/Switch/Switch.stories.tsx

@@ -1,6 +1,7 @@
 import React, { useState } from 'react';
 
 import { Switch } from './Switch';
+import { VStack } from '../VStack/VStack';
 
 import type { Meta, StoryObj } from '@storybook/react';
 
@@ -8,6 +9,16 @@ const meta: Meta<typeof Switch> = {
   title: 'Components/Switch',
   component: Switch,
   tags: ['autodocs'],
+  argTypes: {
+    size: {
+      control: 'select',
+      options: ['s', 'm', 'l'],
+    },
+    variant: {
+      control: 'select',
+      options: ['solid', 'outline', 'ghost'],
+    },
+  },
 };
 
 export default meta;
@@ -19,6 +30,16 @@ export const Default: Story = {
   },
 };
 
+export const Sizes: Story = {
+  render: () => (
+    <VStack gap={4}>
+      <Switch size="s">Small Switch</Switch>
+      <Switch size="m">Medium Switch</Switch>
+      <Switch size="l">Large Switch</Switch>
+    </VStack>
+  ),
+};
+
 export const Selected: Story = {
   args: {
     children: 'Selected State',

packages/ui/src/components/Switch/Switch.test.tsx

@@ -66,5 +66,18 @@ describe('components/Switch', () => {
     expect(track).toHaveClass('data-[selected=true]:bg-primary');
     expect(thumb).toHaveClass('data-[selected=true]:bg-primary-text');
   });
+
+  it('applies size variant classes to track and thumb', () => {
+    const { container, rerender } = render(<Switch size="s">Small</Switch>);
+    const track = container.querySelector('[aria-hidden="true"]');
+    const thumb = track?.firstElementChild;
+
+    expect(track).toHaveClass('w-7', 'h-4');
+    expect(thumb).toHaveClass('w-2.5', 'h-2.5');
+
+    rerender(<Switch size="l">Large</Switch>);
+    expect(track).toHaveClass('w-14', 'h-8');
+    expect(thumb).toHaveClass('w-6', 'h-6');
+  });
 });
 

packages/ui/src/components/Switch/Switch.tsx

@@ -14,6 +14,11 @@ import type { AriaSwitchProps } from 'react-aria';
  */
 export type SwitchVariant = 'solid' | 'outline' | 'ghost';
 
+/**
+ * Switch size variants.
+ */
+export type SwitchSize = 's' | 'm' | 'l';
+
 /**
  * Switch color themes.
  */
@@ -39,12 +44,14 @@ export interface SwitchProps extends AriaSwitchProps, ClassNameProps, DataAttrib
   children?: React.ReactNode;
   /** Visual style variant */
   variant?: SwitchVariant;
+  /** Switch size */
+  size?: SwitchSize;
   /** Color theme */
   color?: SwitchColor;
 }
 
 const trackVariants = cva(
-  'relative w-11 h-6 transition-all duration-200 ease-in-out rounded-full outline-none flex items-center',
+  'relative transition-all duration-200 ease-in-out rounded-full outline-none flex items-center',
   {
     variants: {
       variant: {
@@ -52,6 +59,11 @@ const trackVariants = cva(
         outline: 'border-2 data-[selected=false]:bg-transparent data-[selected=false]:border-muted',
         ghost: 'data-[selected=false]:bg-transparent data-[selected=false]:border-transparent',
       },
+      size: {
+        s: 'w-7 h-4',
+        m: 'w-11 h-6',
+        l: 'w-14 h-8',
+      },
       color: {
         primary: '',
         'primary-negative': '',
@@ -118,19 +130,25 @@ const trackVariants = cva(
     ],
     defaultVariants: {
       variant: 'solid',
+      size: 'm',
       color: 'primary',
     },
   }
 );
 
 const thumbVariants = cva(
-  'w-4 h-4 transition-all duration-200 ease-in-out transform rounded-full shadow-sm data-[selected=false]:bg-[var(--rb-text)] data-[selected=false]:translate-x-0',
+  'transition-all duration-200 ease-in-out transform rounded-full shadow-sm data-[selected=false]:bg-[var(--rb-text)] data-[selected=false]:translate-x-0',
   {
     variants: {
       variant: {
-        solid: 'ml-1 data-[selected=true]:translate-x-5',
+        solid: '',
-        outline: 'ml-0.5 data-[selected=true]:translate-x-4.5',
+        outline: '',
-        ghost: 'ml-1 data-[selected=true]:translate-x-5',
+        ghost: '',
+      },
+      size: {
+        s: 'w-2.5 h-2.5',
+        m: 'w-4 h-4',
+        l: 'w-6 h-6',
       },
       color: {
         primary: '',
@@ -146,6 +164,17 @@ const thumbVariants = cva(
       },
     },
     compoundVariants: [
+      // size + variant offsets
+      { size: 's', variant: 'solid', className: 'ml-0.5 data-[selected=true]:translate-x-3.5' },
+      { size: 's', variant: 'outline', className: 'ml-0.5 data-[selected=true]:translate-x-2.5' },
+      { size: 's', variant: 'ghost', className: 'ml-0.5 data-[selected=true]:translate-x-3.5' },
+      { size: 'm', variant: 'solid', className: 'ml-1 data-[selected=true]:translate-x-5' },
+      { size: 'm', variant: 'outline', className: 'ml-0.5 data-[selected=true]:translate-x-4.5' },
+      { size: 'm', variant: 'ghost', className: 'ml-1 data-[selected=true]:translate-x-5' },
+      { size: 'l', variant: 'solid', className: 'ml-1 data-[selected=true]:translate-x-6' },
+      { size: 'l', variant: 'outline', className: 'ml-0.5 data-[selected=true]:translate-x-5.5' },
+      { size: 'l', variant: 'ghost', className: 'ml-1 data-[selected=true]:translate-x-6' },
+
       // primary
       { variant: 'solid', color: 'primary', className: 'data-[selected=true]:bg-primary-text' },
       { variant: 'outline', color: 'primary', className: 'data-[selected=true]:bg-primary-text' },
@@ -198,6 +227,7 @@ const thumbVariants = cva(
     ],
     defaultVariants: {
       variant: 'solid',
+      size: 'm',
       color: 'primary',
     },
   }
@@ -216,7 +246,7 @@ const thumbVariants = cva(
  * ```
  */
 export function Switch(props: SwitchProps): React.JSX.Element {
-  const { children, className, variant = 'solid', color = 'primary' } = props;
+  const { children, className, variant = 'solid', size = 'm', color = 'primary' } = props;
   const state = useToggleState(props);
   const ref = useRef<HTMLInputElement>(null);
   const { inputProps } = useSwitch(props, state, ref);
@@ -238,14 +268,14 @@ export function Switch(props: SwitchProps): React.JSX.Element {
       <div
         aria-hidden="true"
         className={cn(
-          trackVariants({ variant, color }),
+          trackVariants({ variant, size, color }),
           isFocusVisible && 'ring-2 ring-offset-2 ring-[var(--rb-ring)]',
           props.isDisabled && 'grayscale-[0.5]'
         )}
         data-selected={state.isSelected}
       >
         <div
-          className={thumbVariants({ variant, color })}
+          className={thumbVariants({ variant, size, color })}
           data-selected={state.isSelected}
         />
       </div>
@@ -253,7 +283,7 @@ export function Switch(props: SwitchProps): React.JSX.Element {
         <Text
           bold={state.isSelected}
           color={state.isSelected ? 'default' : 'muted'}
-          size="s"
+          size={size}
           type="label"
         >
           {children}

pnpm-lock.yaml

@@ -69,7 +69,7 @@ importers:
         version: 5.8.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@22.20.0)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
+        version: 4.1.11(@types/node@22.20.0)(@vitest/coverage-v8@4.0.18)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
 
   packages/eslint-config:
     dependencies:
@@ -176,7 +176,7 @@ importers:
         version: 8.6.15(storybook@8.6.17(prettier@3.9.10))
       '@storybook/addon-coverage':
         specifier: ^3.0.0
-        version: 3.0.0(vite@8.1.6(@types/node@22.20.0)(esbuild@0.25.12)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
+        version: 3.0.0(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
       '@storybook/addon-essentials':
         specifier: ^8.6.15
         version: 8.6.15(@types/react@19.2.9)(storybook@8.6.17(prettier@3.9.10))
@@ -236,13 +236,13 @@ importers:
         version: 8.6.17(prettier@3.9.10)
       storybook-react-rsbuild:
         specifier: ^1.0.3
-        version: 1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12))
+        version: 1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7))
       typescript:
         specifier: ^5.8.3
         version: 5.8.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@22.20.0)(@vitest/coverage-v8@4.0.18)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.25.12)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
+        version: 4.1.11(@types/node@22.20.0)(@vitest/coverage-v8@4.0.18)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
       wait-on:
         specifier: ^8.0.3
         version: 8.0.5
@@ -300,7 +300,7 @@ importers:
     dependencies:
       '@rsbuild/plugin-mdx':
         specifier: ^1.1.1
-        version: 1.1.1(@rsbuild/core@1.7.3)(webpack@5.105.1)
+        version: 1.1.1(@rsbuild/core@1.7.3)(webpack@5.105.1(esbuild@0.27.7))
       react:
         specifier: ^19.1.0
         version: 19.2.3
@@ -329,6 +329,12 @@ importers:
       '@rsbuild/plugin-type-check':
         specifier: ^1.1.1
         version: 1.3.3(@rsbuild/core@1.7.3)(@rspack/core@1.7.6(@swc/helpers@0.5.18))(tslib@2.8.1)(typescript@5.8.3)
+      '@testing-library/jest-dom':
+        specifier: ^6.9.1
+        version: 6.9.1
+      '@testing-library/react':
+        specifier: ^16.3.1
+        version: 16.3.2(@testing-library/dom@10.4.0)(@types/react-dom@19.2.3(@types/react@19.2.9))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       '@types/node':
         specifier: '*'
         version: 22.20.0
@@ -353,6 +359,9 @@ importers:
       typescript:
         specifier: ^5.8.2
         version: 5.8.3
+      vitest:
+        specifier: ^4.1.11
+        version: 4.1.11(@types/node@22.20.0)(@vitest/coverage-v8@4.0.18)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
 
   packages/stl:
     dependencies:
@@ -444,7 +453,7 @@ importers:
         version: 7.0.1
       storybook-react-rsbuild:
         specifier: ^1.0.3
-        version: 1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(esbuild@0.27.7))
+        version: 1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(esbuild@0.27.7))
       typescript:
         specifier: ^5.8.3
         version: 5.8.3
@@ -523,7 +532,7 @@ importers:
         version: 8.6.15(storybook@8.6.17(prettier@3.9.10))
       '@storybook/addon-coverage':
         specifier: ^3.0.0
-        version: 3.0.0(vite@8.1.6(@types/node@25.6.2)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
+        version: 3.0.0(vite@8.1.6(@types/node@22.20.0)(esbuild@0.25.12)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
       '@storybook/addon-essentials':
         specifier: ^8.6.15
         version: 8.6.15(@types/react@19.2.9)(storybook@8.6.17(prettier@3.9.10))
@@ -541,7 +550,7 @@ importers:
         version: 8.6.15(storybook@8.6.17(prettier@3.9.10))
       '@storybook/test-runner':
         specifier: ^0.19.1
-        version: 0.19.1(@swc/helpers@0.5.18)(@types/node@25.6.2)(storybook@8.6.17(prettier@3.9.10))(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
+        version: 0.19.1(@swc/helpers@0.5.18)(@types/node@22.20.0)(storybook@8.6.17(prettier@3.9.10))(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@22.20.0)(typescript@5.8.3))
       '@tailwindcss/postcss':
         specifier: ^4.1.18
         version: 4.1.18
@@ -589,13 +598,13 @@ importers:
         version: 8.6.17(prettier@3.9.10)
       storybook-react-rsbuild:
         specifier: ^1.0.3
-        version: 1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(postcss@8.5.31))
+        version: 1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31))
       typescript:
         specifier: ^5.8.3
         version: 5.8.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@25.6.2)(@vitest/coverage-v8@4.0.18)(jsdom@28.0.0)(vite@8.1.6(@types/node@25.6.2)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
+        version: 4.1.11(@types/node@22.20.0)(@vitest/coverage-v8@4.0.18)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.25.12)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
       wait-on:
         specifier: ^8.0.3
         version: 8.0.5
@@ -10259,41 +10268,6 @@ snapshots:
       - supports-color
       - ts-node
 
-  '@jest/core@29.7.0(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))':
-    dependencies:
-      '@jest/console': 29.7.0
-      '@jest/reporters': 29.7.0
-      '@jest/test-result': 29.7.0
-      '@jest/transform': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 22.20.0
-      ansi-escapes: 4.3.2
-      chalk: 4.1.2
-      ci-info: 3.9.0
-      exit: 0.1.2
-      graceful-fs: 4.2.11
-      jest-changed-files: 29.7.0
-      jest-config: 29.7.0(@types/node@22.20.0)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      jest-haste-map: 29.7.0
-      jest-message-util: 29.7.0
-      jest-regex-util: 29.6.3
-      jest-resolve: 29.7.0
-      jest-resolve-dependencies: 29.7.0
-      jest-runner: 29.7.0
-      jest-runtime: 29.7.0
-      jest-snapshot: 29.7.0
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      jest-watcher: 29.7.0
-      micromatch: 4.0.8
-      pretty-format: 29.7.0
-      slash: 3.0.0
-      strip-ansi: 6.0.1
-    transitivePeerDependencies:
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
-
   '@jest/create-cache-key-function@30.2.0':
     dependencies:
       '@jest/types': 30.2.0
@@ -10628,12 +10602,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@mdx-js/loader@3.1.1(webpack@5.105.1)':
+  '@mdx-js/loader@3.1.1(webpack@5.105.1(esbuild@0.27.7))':
     dependencies:
       '@mdx-js/mdx': 3.1.1
       source-map: 0.7.6
     optionalDependencies:
-      webpack: 5.105.1
+      webpack: 5.105.1(esbuild@0.27.7)
     transitivePeerDependencies:
       - supports-color
 
@@ -12563,9 +12537,9 @@ snapshots:
       - supports-color
       - webpack
 
-  '@rsbuild/plugin-mdx@1.1.1(@rsbuild/core@1.7.3)(webpack@5.105.1)':
+  '@rsbuild/plugin-mdx@1.1.1(@rsbuild/core@1.7.3)(webpack@5.105.1(esbuild@0.27.7))':
     dependencies:
-      '@mdx-js/loader': 3.1.1(webpack@5.105.1)
+      '@mdx-js/loader': 3.1.1(webpack@5.105.1(esbuild@0.27.7))
     optionalDependencies:
       '@rsbuild/core': 1.7.3
     transitivePeerDependencies:
@@ -13083,6 +13057,20 @@ snapshots:
       - supports-color
       - vite
 
+  '@storybook/addon-coverage@3.0.0(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))':
+    dependencies:
+      '@istanbuljs/load-nyc-config': 1.1.0
+      '@jsdevtools/coverage-istanbul-loader': 3.0.5
+      '@types/istanbul-lib-coverage': 2.0.6
+      convert-source-map: 2.0.0
+      espree: 9.6.1
+      istanbul-lib-instrument: 6.0.3
+      test-exclude: 6.0.0
+      vite-plugin-istanbul: 6.0.2(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
+    transitivePeerDependencies:
+      - supports-color
+      - vite
+
   '@storybook/addon-coverage@3.0.0(vite@8.1.6(@types/node@25.0.10)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))':
     dependencies:
       '@istanbuljs/load-nyc-config': 1.1.0
@@ -13408,7 +13396,7 @@ snapshots:
     dependencies:
       storybook: 8.6.17(prettier@3.9.10)
 
-  '@storybook/react-docgen-typescript-plugin@1.0.1(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12))':
+  '@storybook/react-docgen-typescript-plugin@1.0.1(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31))':
     dependencies:
       debug: 4.4.3
       endent: 2.1.0
@@ -13418,7 +13406,7 @@ snapshots:
       react-docgen-typescript: 2.4.0(typescript@5.8.3)
       tslib: 2.8.1
       typescript: 5.8.3
-      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)
+      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)
     transitivePeerDependencies:
       - supports-color
 
@@ -13436,6 +13424,20 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@storybook/react-docgen-typescript-plugin@1.0.1(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7))':
+    dependencies:
+      debug: 4.4.3
+      endent: 2.1.0
+      find-cache-dir: 3.3.2
+      flat-cache: 3.2.0
+      micromatch: 4.0.8
+      react-docgen-typescript: 2.4.0(typescript@5.8.3)
+      tslib: 2.8.1
+      typescript: 5.8.3
+      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)
+    transitivePeerDependencies:
+      - supports-color
+
   '@storybook/react-docgen-typescript-plugin@1.0.1(typescript@5.8.3)(webpack@5.105.1(esbuild@0.27.7))':
     dependencies:
       debug: 4.4.3
@@ -13604,40 +13606,6 @@ snapshots:
       - supports-color
       - ts-node
 
-  '@storybook/test-runner@0.19.1(@swc/helpers@0.5.18)(@types/node@25.6.2)(storybook@8.6.17(prettier@3.9.10))(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))':
-    dependencies:
-      '@babel/core': 7.28.6
-      '@babel/generator': 7.28.6
-      '@babel/template': 7.28.6
-      '@babel/types': 7.28.6
-      '@jest/types': 29.6.3
-      '@storybook/core-common': 8.6.14(storybook@8.6.17(prettier@3.9.10))
-      '@storybook/csf': 0.1.13
-      '@storybook/csf-tools': 8.6.14(storybook@8.6.17(prettier@3.9.10))
-      '@storybook/preview-api': 8.6.15(storybook@8.6.17(prettier@3.9.10))
-      '@swc/core': 1.15.10(@swc/helpers@0.5.18)
-      '@swc/jest': 0.2.39(@swc/core@1.15.10(@swc/helpers@0.5.18))
-      expect-playwright: 0.8.0
-      jest: 29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      jest-circus: 29.7.0
-      jest-environment-node: 29.7.0
-      jest-junit: 16.0.0
-      jest-playwright-preset: 4.0.0(jest-circus@29.7.0)(jest-environment-node@29.7.0)(jest-runner@29.7.0)(jest@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)))
-      jest-runner: 29.7.0
-      jest-serializer-html: 7.1.0
-      jest-watch-typeahead: 2.2.2(jest@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)))
-      nyc: 15.1.0
-      playwright: 1.58.0
-    transitivePeerDependencies:
-      - '@swc/helpers'
-      - '@types/node'
-      - babel-plugin-macros
-      - debug
-      - node-notifier
-      - storybook
-      - supports-color
-      - ts-node
-
   '@storybook/test@8.6.15(storybook@8.6.17(prettier@3.5.3))':
     dependencies:
       '@storybook/global': 5.0.0
@@ -14972,21 +14940,6 @@ snapshots:
       - supports-color
       - ts-node
 
-  create-jest@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)):
-    dependencies:
-      '@jest/types': 29.6.3
-      chalk: 4.1.2
-      exit: 0.1.2
-      graceful-fs: 4.2.11
-      jest-config: 29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      jest-util: 29.7.0
-      prompts: 2.4.2
-    transitivePeerDependencies:
-      - '@types/node'
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
-
   create-require@1.1.1: {}
 
   critters@0.0.25:
@@ -16629,25 +16582,6 @@ snapshots:
       - supports-color
       - ts-node
 
-  jest-cli@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)):
-    dependencies:
-      '@jest/core': 29.7.0(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      '@jest/test-result': 29.7.0
-      '@jest/types': 29.6.3
-      chalk: 4.1.2
-      create-jest: 29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      exit: 0.1.2
-      import-local: 3.2.0
-      jest-config: 29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      yargs: 17.7.2
-    transitivePeerDependencies:
-      - '@types/node'
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
-
   jest-config@29.7.0(@types/node@22.20.0)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@22.20.0)(typescript@5.8.3)):
     dependencies:
       '@babel/core': 7.28.6
@@ -16710,37 +16644,6 @@ snapshots:
       - babel-plugin-macros
       - supports-color
 
-  jest-config@29.7.0(@types/node@22.20.0)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)):
-    dependencies:
-      '@babel/core': 7.28.6
-      '@jest/test-sequencer': 29.7.0
-      '@jest/types': 29.6.3
-      babel-jest: 29.7.0(@babel/core@7.28.6)
-      chalk: 4.1.2
-      ci-info: 3.9.0
-      deepmerge: 4.3.1
-      glob: 7.2.3
-      graceful-fs: 4.2.11
-      jest-circus: 29.7.0
-      jest-environment-node: 29.7.0
-      jest-get-type: 29.6.3
-      jest-regex-util: 29.6.3
-      jest-resolve: 29.7.0
-      jest-runner: 29.7.0
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      micromatch: 4.0.8
-      parse-json: 5.2.0
-      pretty-format: 29.7.0
-      slash: 3.0.0
-      strip-json-comments: 3.1.1
-    optionalDependencies:
-      '@types/node': 22.20.0
-      ts-node: 10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)
-    transitivePeerDependencies:
-      - babel-plugin-macros
-      - supports-color
-
   jest-config@29.7.0(@types/node@25.0.10)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.0.10)(typescript@5.8.3)):
     dependencies:
       '@babel/core': 7.28.6
@@ -16772,37 +16675,6 @@ snapshots:
       - babel-plugin-macros
       - supports-color
 
-  jest-config@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)):
-    dependencies:
-      '@babel/core': 7.28.6
-      '@jest/test-sequencer': 29.7.0
-      '@jest/types': 29.6.3
-      babel-jest: 29.7.0(@babel/core@7.28.6)
-      chalk: 4.1.2
-      ci-info: 3.9.0
-      deepmerge: 4.3.1
-      glob: 7.2.3
-      graceful-fs: 4.2.11
-      jest-circus: 29.7.0
-      jest-environment-node: 29.7.0
-      jest-get-type: 29.6.3
-      jest-regex-util: 29.6.3
-      jest-resolve: 29.7.0
-      jest-runner: 29.7.0
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      micromatch: 4.0.8
-      parse-json: 5.2.0
-      pretty-format: 29.7.0
-      slash: 3.0.0
-      strip-json-comments: 3.1.1
-    optionalDependencies:
-      '@types/node': 25.6.2
-      ts-node: 10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)
-    transitivePeerDependencies:
-      - babel-plugin-macros
-      - supports-color
-
   jest-diff@29.7.0:
     dependencies:
       chalk: 4.1.2
@@ -16918,22 +16790,6 @@ snapshots:
       - debug
       - supports-color
 
-  jest-playwright-preset@4.0.0(jest-circus@29.7.0)(jest-environment-node@29.7.0)(jest-runner@29.7.0)(jest@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))):
-    dependencies:
-      expect-playwright: 0.8.0
-      jest: 29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      jest-circus: 29.7.0
-      jest-environment-node: 29.7.0
-      jest-process-manager: 0.4.0
-      jest-runner: 29.7.0
-      nyc: 15.1.0
-      playwright-core: 1.58.0
-      rimraf: 3.0.2
-      uuid: 8.3.2
-    transitivePeerDependencies:
-      - debug
-      - supports-color
-
   jest-pnp-resolver@1.2.3(jest-resolve@29.7.0):
     optionalDependencies:
       jest-resolve: 29.7.0
@@ -17099,17 +16955,6 @@ snapshots:
       string-length: 5.0.1
       strip-ansi: 7.1.2
 
-  jest-watch-typeahead@2.2.2(jest@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))):
-    dependencies:
-      ansi-escapes: 6.2.1
-      chalk: 5.6.2
-      jest: 29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      jest-regex-util: 29.6.3
-      jest-watcher: 29.7.0
-      slash: 5.1.0
-      string-length: 5.0.1
-      strip-ansi: 7.1.2
-
   jest-watcher@29.7.0:
     dependencies:
       '@jest/test-result': 29.7.0
@@ -17158,18 +17003,6 @@ snapshots:
       - supports-color
       - ts-node
 
-  jest@29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3)):
-    dependencies:
-      '@jest/core': 29.7.0(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-      '@jest/types': 29.6.3
-      import-local: 3.2.0
-      jest-cli: 29.7.0(@types/node@25.6.2)(ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3))
-    transitivePeerDependencies:
-      - '@types/node'
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
-
   jiti@2.6.1: {}
 
   jju@1.4.0:
@@ -18765,14 +18598,14 @@ snapshots:
       ajv: 6.12.6
       ajv-keywords: 3.5.2(ajv@6.12.6)
 
-  schema-utils@4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)):
+  schema-utils@4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)):
     dependencies:
       '@types/json-schema': 7.0.15
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       ajv-keywords: 5.1.0(ajv@8.20.0)
     optionalDependencies:
-      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)
+      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)
 
   schema-utils@4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(postcss@8.5.31)):
     dependencies:
@@ -18783,6 +18616,15 @@ snapshots:
     optionalDependencies:
       webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(postcss@8.5.31)
 
+  schema-utils@4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)):
+    dependencies:
+      '@types/json-schema': 7.0.15
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      ajv-keywords: 5.1.0(ajv@8.20.0)
+    optionalDependencies:
+      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)
+
   schema-utils@4.8.1(webpack@5.105.1(esbuild@0.27.7)):
     dependencies:
       '@types/json-schema': 7.0.15
@@ -18792,16 +18634,6 @@ snapshots:
     optionalDependencies:
       webpack: 5.105.1(esbuild@0.27.7)
 
-  schema-utils@4.8.1(webpack@5.105.1):
-    dependencies:
-      '@types/json-schema': 7.0.15
-      ajv: 8.20.0
-      ajv-formats: 3.0.1(ajv@8.20.0)
-      ajv-keywords: 5.1.0(ajv@8.20.0)
-    optionalDependencies:
-      webpack: 5.105.1
-    optional: true
-
   secure-compare@3.0.1: {}
 
   semver@6.3.1: {}
@@ -19120,12 +18952,12 @@ snapshots:
       - tslib
       - webpack
 
-  storybook-react-rsbuild@1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)):
+  storybook-react-rsbuild@1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)):
     dependencies:
       '@rollup/pluginutils': 5.3.0(rollup@4.60.1)
       '@rsbuild/core': 1.7.3
       '@storybook/react': 8.6.15(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)
-      '@storybook/react-docgen-typescript-plugin': 1.0.1(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12))
+      '@storybook/react-docgen-typescript-plugin': 1.0.1(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31))
       '@types/node': 18.19.130
       find-up: 5.0.0
       magic-string: 0.30.21
@@ -19148,12 +18980,12 @@ snapshots:
       - tslib
       - webpack
 
-  storybook-react-rsbuild@1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(postcss@8.5.31)):
+  storybook-react-rsbuild@1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)):
     dependencies:
       '@rollup/pluginutils': 5.3.0(rollup@4.60.1)
       '@rsbuild/core': 1.7.3
       '@storybook/react': 8.6.15(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)
-      '@storybook/react-docgen-typescript-plugin': 1.0.1(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(postcss@8.5.31))
+      '@storybook/react-docgen-typescript-plugin': 1.0.1(typescript@5.8.3)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7))
       '@types/node': 18.19.130
       find-up: 5.0.0
       magic-string: 0.30.21
@@ -19176,7 +19008,7 @@ snapshots:
       - tslib
       - webpack
 
-  storybook-react-rsbuild@1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(esbuild@0.27.7)):
+  storybook-react-rsbuild@1.0.3(@rsbuild/core@1.7.3)(@storybook/test@8.6.15(storybook@8.6.17(prettier@3.9.10)))(@types/react@19.2.9)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rollup@4.60.1)(storybook@8.6.17(prettier@3.9.10))(typescript@5.8.3)(webpack@5.105.1(esbuild@0.27.7)):
     dependencies:
       '@rollup/pluginutils': 5.3.0(rollup@4.60.1)
       '@rsbuild/core': 1.7.3
@@ -19373,16 +19205,17 @@ snapshots:
 
   tapable@2.3.3: {}
 
-  terser-webpack-plugin@5.6.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)):
+  terser-webpack-plugin@5.6.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       jest-worker: 27.5.1
-      schema-utils: 4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12))
+      schema-utils: 4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31))
       terser: 5.51.2
-      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)
+      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)
     optionalDependencies:
       '@swc/core': 1.15.10(@swc/helpers@0.5.18)
       esbuild: 0.25.12
+      postcss: 8.5.31
 
   terser-webpack-plugin@5.6.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(postcss@8.5.31)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(postcss@8.5.31)):
     dependencies:
@@ -19396,6 +19229,17 @@ snapshots:
       esbuild: 0.27.7
       postcss: 8.5.31
 
+  terser-webpack-plugin@5.6.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)):
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      jest-worker: 27.5.1
+      schema-utils: 4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7))
+      terser: 5.51.2
+      webpack: 5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)
+    optionalDependencies:
+      '@swc/core': 1.15.10(@swc/helpers@0.5.18)
+      esbuild: 0.27.7
+
   terser-webpack-plugin@5.6.1(esbuild@0.27.7)(webpack@5.105.1(esbuild@0.27.7)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
@@ -19406,15 +19250,6 @@ snapshots:
     optionalDependencies:
       esbuild: 0.27.7
 
-  terser-webpack-plugin@5.6.1(webpack@5.105.1):
-    dependencies:
-      '@jridgewell/trace-mapping': 0.3.31
-      jest-worker: 27.5.1
-      schema-utils: 4.8.1(webpack@5.105.1)
-      terser: 5.51.2
-      webpack: 5.105.1
-    optional: true
-
   terser@5.46.0:
     dependencies:
       '@jridgewell/source-map': 0.3.11
@@ -19574,27 +19409,6 @@ snapshots:
     optionalDependencies:
       '@swc/core': 1.15.10(@swc/helpers@0.5.18)
 
-  ts-node@10.9.2(@swc/core@1.15.10(@swc/helpers@0.5.18))(@types/node@25.6.2)(typescript@5.8.3):
-    dependencies:
-      '@cspotcode/source-map-support': 0.8.1
-      '@tsconfig/node10': 1.0.12
-      '@tsconfig/node12': 1.0.11
-      '@tsconfig/node14': 1.0.3
-      '@tsconfig/node16': 1.0.4
-      '@types/node': 25.6.2
-      acorn: 8.15.0
-      acorn-walk: 8.3.4
-      arg: 4.1.3
-      create-require: 1.1.1
-      diff: 4.0.4
-      make-error: 1.3.6
-      typescript: 5.8.3
-      v8-compile-cache-lib: 3.0.1
-      yn: 3.1.1
-    optionalDependencies:
-      '@swc/core': 1.15.10(@swc/helpers@0.5.18)
-    optional: true
-
   tsconfck@3.1.6(typescript@5.8.3):
     optionalDependencies:
       typescript: 5.8.3
@@ -19849,6 +19663,18 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  vite-plugin-istanbul@6.0.2(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2)):
+    dependencies:
+      '@istanbuljs/load-nyc-config': 1.1.0
+      espree: 10.4.0
+      istanbul-lib-instrument: 6.0.3
+      picocolors: 1.1.1
+      source-map: 0.7.6
+      test-exclude: 6.0.0
+      vite: 8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2)
+    transitivePeerDependencies:
+      - supports-color
+
   vite-plugin-istanbul@6.0.2(vite@8.1.6(@types/node@25.0.10)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2)):
     dependencies:
       '@istanbuljs/load-nyc-config': 1.1.0
@@ -19972,7 +19798,7 @@ snapshots:
     transitivePeerDependencies:
       - msw
 
-  vitest@4.1.11(@types/node@22.20.0)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2)):
+  vitest@4.1.11(@types/node@22.20.0)(@vitest/coverage-v8@4.0.18)(jsdom@28.0.0)(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2)):
     dependencies:
       '@vitest/expect': 4.1.11
       '@vitest/mocker': 4.1.11(vite@8.1.6(@types/node@22.20.0)(esbuild@0.27.7)(jiti@2.6.1)(terser@5.51.2)(yaml@2.8.2))
@@ -19996,6 +19822,7 @@ snapshots:
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 22.20.0
+      '@vitest/coverage-v8': 4.0.18(vitest@4.1.11)
       jsdom: 28.0.0
     transitivePeerDependencies:
       - msw
@@ -20104,7 +19931,7 @@ snapshots:
 
   webpack-virtual-modules@0.6.2: {}
 
-  webpack@5.105.1:
+  webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31):
     dependencies:
       '@types/eslint-scope': 3.7.7
       '@types/estree': 1.0.9
@@ -20126,9 +19953,9 @@ snapshots:
       loader-runner: 4.3.2
       mime-types: 2.1.35
       neo-async: 2.6.2
-      schema-utils: 4.8.1(webpack@5.105.1)
+      schema-utils: 4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31))
       tapable: 2.3.3
-      terser-webpack-plugin: 5.6.1(webpack@5.105.1)
+      terser-webpack-plugin: 5.6.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(postcss@8.5.31))
       watchpack: 2.6.3
       webpack-sources: 3.6.0
     transitivePeerDependencies:
@@ -20144,9 +19971,8 @@ snapshots:
       - lightningcss
       - postcss
       - uglify-js
-    optional: true
 
-  webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12):
+  webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7):
     dependencies:
       '@types/eslint-scope': 3.7.7
       '@types/estree': 1.0.9
@@ -20168,9 +19994,9 @@ snapshots:
       loader-runner: 4.3.2
       mime-types: 2.1.35
       neo-async: 2.6.2
-      schema-utils: 4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12))
+      schema-utils: 4.8.1(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7))
       tapable: 2.3.3
-      terser-webpack-plugin: 5.6.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.25.12))
+      terser-webpack-plugin: 5.6.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7)(webpack@5.105.1(@swc/core@1.15.10(@swc/helpers@0.5.18))(esbuild@0.27.7))
       watchpack: 2.6.3
       webpack-sources: 3.6.0
     transitivePeerDependencies:

services/docs/.config/cli.ts

@@ -6,16 +6,17 @@ export default defineCli({
       name: 'sync:static',
       description: 'Sync static assets to S3',
       targetPrefix: 'docs',
-      sourceDir: './static',
+      sourceDir: './public/static',
       sourceFilesPattern: 'content/**/*.{md,html}',
       urlPrefixes: ['/static/', '/images/'],
       bucket: env('COM_ERMNVLDMR_STATIC_S3_BUCKET'),
+      publicUrl: env('COM_ERMNVLDMR_STATIC_PUBLIC_URL', 'https://static.ermnvldmr.com'),
       region: env('COM_ERMNVLDMR_STATIC_S3_REGION'),
       endpoint: env('COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL'),
       accessKeyId: env('COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID'),
       secretAccessKey: env('COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY'),
       hooks: {
-        beforeSync: 'bash ../../ci/scripts/optimize-images.sh ./static',
+        beforeSync: 'bash ../../ci/scripts/optimize-images.sh ./public/static',
       },
     }),
   ],

services/docs/assets/js/core/telemetry.js

@@ -0,0 +1,36 @@
+(function () {
+  var KEY = "umami.disabled";
+  var toggles = document.querySelectorAll("[data-umami-toggle]");
+  if (!toggles.length) return;
+
+  function sync() {
+    var enabled = true;
+    try {
+      enabled = window.localStorage.getItem(KEY) !== "1";
+    } catch (e) {}
+    toggles.forEach(function (el) {
+      el.checked = enabled;
+    });
+  }
+
+  sync();
+
+  toggles.forEach(function (el) {
+    el.addEventListener("change", function () {
+      try {
+        if (el.checked) {
+          window.localStorage.removeItem(KEY);
+        } else {
+          window.localStorage.setItem(KEY, "1");
+        }
+      } catch (e) {}
+      sync();
+    });
+  });
+
+  window.addEventListener("storage", function (e) {
+    if (e.key === KEY || e.key === null) {
+      sync();
+    }
+  });
+})();

services/docs/content/en/apex/concepts/architecture.md

@@ -53,15 +53,13 @@ Listing (`apex --help`) never imports action modules; summaries and disabled ma
 
 ## The capture-up model {#capture-up}
 
-Node repositories are ledgers, not just sources: the host itself records what it runs.
+`apex sync/repository` records the working tree and commons pin in a
+`sync/<node>` branch, rebases onto `origin/main`, and pushes with
+`--force-with-lease`. It refuses to run when commons has uncommitted changes
+or the `compositions/` directory is missing. A rebase conflict aborts the sync.
 
-1. A scheduled `sync/repository` run on the host commits the working tree to a `sync/<node>` branch (including the commons submodule pointer), rebases it onto `origin/main`, and pushes with `--force-with-lease`.
+Review and integration of that branch are repository policies. APEX does not
-2. A scheduled CI job in the node repository merges `sync/<node>` back into `main` under a bot identity.
+supply a CI merge workflow or require a particular repository hosting setup.
-
-This [capture-up](/apex/glossary#capture-up) loop means drift on a host becomes a commit — visible, diffable, and revertable — instead of silent divergence. The sync aborts rather than committing when the commons submodule is dirty or the `compositions/` tree is missing, so a broken checkout never becomes the recorded state.
-
-> [!NOTE]
-> The CI merge job checks out the repository *without* submodules: the commons submodule uses an SSH URL that the default CI token cannot fetch, and the merge only moves the gitlink pointer anyway.
 
 ## Design constraints {#constraints}
 

services/docs/content/en/apex/concepts/compositions.md

@@ -44,7 +44,7 @@ Opt-in services, gated by compose profiles a node enables in `COMPOSE_PROFILE
 |---|---|---|
 | `xray` | xray | Host-network proxy edge for the enclave. |
 | `adguard` | adguard | DNS filtering, sharing traefik's network namespace; routed at `/adguard` on the node FQDN. |
-| `alloy` | alloy | Per-node observability agent (Grafana Alloy). Collects host + container metrics and journal + container logs and **pushes** them outbound to a central Prometheus and Loki (see [Concept: Security model](/apex/concepts/security-model#observability)). Its container `hostname` is set to `APEX_NODE_HOST`, and that value stamps the `node` and `instance` labels on every metric and log stream. |
+| `alloy` | alloy | Optional Grafana Alloy agent. Sends host/container metrics and journal/container logs to configured compatible endpoints. See [observability configuration](/apex/concepts/security-model#observability). |
 | `manual` | resticontainer | One-shot label-driven backup runner (`ghcr.io/deytenit/resticontainer`) — never starts with `up`; invoked by the `backup/run` action, which discovers per-service backup intent from `restic.*` compose labels. |
 
 ## Networks {#networks}

services/docs/content/en/apex/concepts/node-identity.md

@@ -21,7 +21,7 @@ It declares identity explicitly through these keys:
 ```ini {filename="node.env"}
 APEX_NODE_FQDN=node1.example.com
 APEX_NODE_HOST=node1.example.com
-APEX_SUBNET=198.18.16.0/24
+APEX_SUBNET=198.18.0.0/24
 ```
 
 ### The OS hostname

services/docs/content/en/apex/concepts/security-model.md

@@ -34,7 +34,11 @@ The [core composition](/apex/glossary#core-composition) encodes container-level
 
 ## Observability {#observability}
 
-Observability is an **outbound push**, not an exposed route. The optional `alloy` core service (Grafana Alloy, one agent per node) collects host metrics (a `node_exporter`-equivalent), container metrics (cadvisor), the systemd journal, and docker container logs, and pushes them to a **central** Prometheus and Loki that live on a designated node — the metrics via `prometheus.remote_write` to `APEX_PROM_PUSH_URL`, the logs via `loki.write` to `APEX_LOKI_PUSH_URL`. Both targets are authenticated with HTTP basic auth using `APEX_OBS_BASIC_AUTH_USER` / `APEX_OBS_BASIC_AUTH_PASS`. Because the push is outbound, Alloy attaches to the `direct` network (which has egress) rather than the `internal` `enclave`; there is no node-local log store and no `/loki` route to protect.
+The optional `alloy` service sends host and container metrics to
+`APEX_PROM_PUSH_URL` and logs to `APEX_LOKI_PUSH_URL`. Configure compatible
+endpoints and HTTP basic-auth credentials through `APEX_OBS_BASIC_AUTH_USER`
+and `APEX_OBS_BASIC_AUTH_PASS`. The service requires outbound connectivity to
+those endpoints; their hosting and access policy are deployment choices.
 
 ## Secrets boundary {#secrets}
 

services/docs/content/en/apex/glossary.md

@@ -16,7 +16,7 @@ Terminology used within the apex fleet operations framework.
 
 ## Capture-up {#capture-up}
 
-**Capture-up** - The flow that records a host's live state back into its repository: a scheduled commit to the `sync/<node>` branch, rebased onto `main` and folded back by CI. Drift becomes a diff instead of divergence.
+**Capture-up** — Recording a host's working state in a `sync/<node>` branch through `apex sync/repository`. The repository's own policy determines review and integration.
 
 ## Commons {#commons}
 

services/docs/content/en/apex/guides/host-operations.md

@@ -12,7 +12,8 @@ weight: 24
 
 | Step | Effect |
 |---|---|
-| `configure/base` | Ensures a Debian base: package index update, essential packages (`curl`, `wget`, `git`, `rsyslog`), rsyslog running, `ufw` installed, and the `ufw-docker` helper at `~/.local/bin/ufw-docker`. |
+| `configure/base` | Installs missing Debian packages after checking that APT's simulation contains no upgrades or removals, ensures rsyslog is running, and verifies the pinned `/usr/local/bin/ufw-docker` before privileged execution. Avoid concurrent package operations. |
+| `configure/timezone` | Applies `configs/timezone` when present and refreshes active cron after a timezone change. Supports `--dry-run`. |
 | `configure/ufw` | Applies host rules, injects the managed kernel-rule blocks, applies container rules via `ufw-docker`. Supports `--dry-run`. |
 | `configure/crowdsec` | Installs CrowdSec if absent, deploys `configs/crowdsec/` to `/etc/crowdsec/`, installs collections, and the firewall bouncer when configured. Supports `--dry-run`. |
 | `configure/cron` | Renders `configs/cron/crontab` through the template layer and installs it — with preview, empty-render refusal (exit `65`), and rollback on a failed install. Supports `--dry-run`. |
@@ -27,10 +28,39 @@ After `configure/ufw`, restart `ufw` deliberately (`sudo systemctl restart ufw`)
 apex compose up            # core first, then services alphabetically
 apex compose down          # reverse order
 apex compose restart
-apex compose up --dry-run  # print the commands only
+apex compose --dry-run up  # print the commands only
+apex compose -p apex restart traefik
+apex compose -p app up -d
 ```
 
-Extra arguments pass through to `docker compose` per project. Each project's `.env` and `apex.env` are supplied automatically when present.
+Put wrapper options (`-p` and `--dry-run`) before the action. Extra arguments pass
+through to Docker Compose for the selected project. Each project's `.env` and
+`apex.env` are supplied automatically when present. Positional targeting remains
+available as `apex compose restart apex traefik` or `apex compose up -d apex`;
+prefer `-p` when arguments could also name a composition.
+
+Replace `app` with a composition defined in your repository. When a mount or
+other container definition changes, use targeted `up -d` to recreate it:
+`restart` retains the existing definition.
+
+### Direct core Compose commands
+
+```bash
+apex env --sync
+cd compositions/apex
+docker compose config --quiet
+docker compose restart traefik
+```
+
+Sync preserves existing secret and UID/GID text in `.env` and its tier-storage
+symlink. A managed block loads committed `apex.env` settings, including profiles,
+then synthesized node/path values. Writes use mode `0600`. Resync after changing
+those settings or paths; do not hand-edit the managed block. Docker's shell
+environment still overrides file values.
+
+`eval "$(apex env)"`, `apex env --dotenv`, and `apex env --write generated.env`
+export or save generated APEX values only. They do not load composition secrets
+or replace the full `--sync` bridge. Output modes are mutually exclusive.
 
 ## Backups {#backups}
 
@@ -46,7 +76,7 @@ Runs [resticontainer](https://github.com/deytenit/resticontainer) one-shot under
 apex sync/repository <telegram-bot-url>
 ```
 
-Commits the live checkout to `sync/<node>`, rebases onto `origin/main`, and force-pushes with lease; CI folds the branch back into `main`. The action refuses to run — with a paged error — when the commons submodule is dirty or the `compositions/` tree is missing, and aborts cleanly on a rebase conflict (manual intervention required). See [Concept: Framework architecture](/apex/concepts/architecture#capture-up) for the model.
+Commits the live checkout to `sync/<node>`, rebases onto `origin/main`, and force-pushes with lease. The action refuses to run — with a paged error — when the commons submodule is dirty or the `compositions/` tree is missing, and aborts cleanly on a rebase conflict (manual intervention required). See [Concept: Framework architecture](/apex/concepts/architecture#capture-up) for the model.
 
 ## Update awareness {#updates}
 

services/docs/content/en/apex/guides/node-repository.md

@@ -25,7 +25,7 @@ The gitlink pins the exact engine version the node runs. Upgrading later mean
 ```ini {filename="node.env"}
 APEX_NODE_FQDN=node1.example.com
 APEX_NODE_HOST=node1.example.com
-APEX_SUBNET=198.18.16.0/24
+APEX_SUBNET=198.18.0.0/24
 APEX_GIT_AUTHOR_NAME=apex [bot]
 APEX_GIT_AUTHOR_EMAIL=apex@localhost
 ```
@@ -41,7 +41,7 @@ include:
 ```
 
 ```ini {filename="compositions/apex/apex.env"}
-APEX_TRAEFIK_DIRECT_IP=198.18.16.10
+APEX_TRAEFIK_DIRECT_IP=198.18.0.10
 APEX_RESTIC_REPOSITORY=s3:<endpoint>/<bucket>/<node>
 COMPOSE_PROFILES=adguard,xray,alloy
 # observability push targets (only when the alloy profile is enabled)
@@ -77,9 +77,12 @@ __pycache__/
 
 Create `compositions/ADDRESSING.md` with the node's subnet (`APEX_SUBNET`) and the reserved ranges (`.10`–`.19` core, `.20`+ services). Every [anchor IP](/apex/glossary#anchor-ip) allocated later is recorded here.
 
-### Wire capture-up CI
+### Choose a sync review policy
 
-Add a scheduled workflow that merges `sync/<node>` into `main` when the branch exists, committing under a bot identity. Check out **without** submodules — the merge only moves the commons pointer, and an SSH submodule URL is not fetchable with the default CI token. See [Concept: Framework architecture](/apex/concepts/architecture) for the full [capture-up](/apex/glossary#capture-up) loop.
+Decide how to review and integrate the `sync/<node>` branch produced by
+`apex sync/repository`. If you automate integration, configure repository
+permissions and submodule access for that workflow. See the
+[capture-up model](/apex/concepts/architecture#capture-up).
 
 ### Validate
 

services/docs/content/en/apex/guides/service-composition.md

@@ -28,7 +28,7 @@ services:
       - ./@tier2/<anchor>/data:/data
     networks:
       direct:
-        ipv4_address: 198.18.16.20
+        ipv4_address: 198.18.0.20
       enclave: {}
     labels:
       - "traefik.enable=true"

services/docs/content/en/apex/reference/actions.md

@@ -4,7 +4,7 @@ description: "Every commons action: arguments and behavior."
 weight: 32
 ---
 
-The sixteen [commons](/apex/glossary#commons) actions, by group. Arguments are shown as the parser accepts them; optional arguments are bracketed. Exit codes follow the [engine convention](/apex/reference/cli#exit-codes).
+The [commons](/apex/glossary#commons) actions, by group. Arguments are shown as the parser accepts them; optional arguments are bracketed. Exit codes follow the [engine convention](/apex/reference/cli#exit-codes).
 
 ## configure {#configure}
 
@@ -12,13 +12,19 @@ The sixteen [commons](/apex/glossary#commons) actions, by group. Arguments are
 
 `apex configure [--dry-run]`
 
-Runs the whole suite in fixed order — `base`, `ufw`, `crowdsec`, `cron`, `systemd`, `routing` — and stops at the first failing step, propagating its exit code. `--dry-run` is forwarded to the steps that support it.
+Runs the suite in order: `base`, `timezone`, `ufw`, `crowdsec`, `cron`, `systemd`, `routing`, then additional node actions. A failing step contributes a nonzero exit status; later steps may still run. `--dry-run` is forwarded only to steps that support it, so it is not a guarantee that the entire umbrella command is read-only.
 
 ### configure/base
 
 `apex configure/base`
 
-Debian-only guard (exit `1` elsewhere). Updates the package index, installs the essential packages (`curl`, `wget`, `git`, `rsyslog`), ensures rsyslog is running, installs `ufw` when absent, and downloads the `ufw-docker` helper to `~/.local/bin/ufw-docker` (skipped when already present).
+Debian-only guard (exit `1` elsewhere). Checks installed package state for `curl`, `wget`, `git`, `rsyslog`, and `ufw`; installs missing packages and ensures rsyslog is running. Refuses an APT simulation containing upgrades or removals and uses `--no-upgrade --no-remove`. Avoid concurrent package operations: simulation and installation are separate transactions. Verifies the immutable revision and SHA-256 of `/usr/local/bin/ufw-docker` before running it as root. Unsafe paths and unverified downloads are rejected; an executable file alone is not trusted.
+
+### configure/timezone
+
+`apex configure/timezone [--dry-run]`
+
+Applies the IANA zone named in `configs/timezone` and refreshes active cron after a change. An absent declaration preserves the current timezone; an invalid zone fails before changing it.
 
 ### configure/ufw
 
@@ -110,9 +116,19 @@ Two passes: (1) [anchor-IP](/apex/glossary#anchor-ip) validation over `compositi
 
 ### compose
 
-`apex compose <action> [--dry-run] [extra...]`
+`apex compose [-p <composition>] [--dry-run] <action> [extra...]`
 
-Orchestrates `docker compose <action>` across the node: the core project first, then services alphabetically (reversed for `down`). `up` implies `-d`; `.env`/`apex.env` are passed per project when present; extra arguments pass through; `--dry-run` (accepted in any position) prints commands instead of executing.
+Without a target, visits core first and other compositions alphabetically, reversed for `down`. `-p` selects one composition or `all`; `up` defaults to detached mode. `.env` then `apex.env` are passed per project, with generated identity/path values in the process environment. Remaining arguments pass through to Docker Compose. Wrapper options precede the action; `--dry-run` prints commands without executing them.
+
+Compatibility forms include `apex compose restart apex traefik` and `apex compose up -d apex`. Use explicit `-p` to distinguish a composition from a service or option value.
+
+## env {#env}
+
+`apex env [--export | --dotenv | --write <path> | --sync]`
+
+Default output is shell-quoted APEX exports for `eval "$(apex env)"`. `--dotenv` emits dotenv syntax; `--write` writes generated values to a separate file, including a relative filename. These modes do not read composition credentials or merge `apex.env`.
+
+`--sync` preserves existing `compositions/apex/.env` text and updates only its managed block: committed `apex.env` settings first, generated identity/path values last. This includes non-APEX settings such as `COMPOSE_PROFILES` and `TZ`, allowing bare Docker Compose commands in the core directory. Existing tier symlinks remain intact, and synchronized files use mode `0600`. Resync after changing source settings or tier paths. Malformed managed markers fail without rewriting uncertain content. Shell environment values still have Docker Compose precedence.
 
 ---
 

services/docs/content/ru/apex/concepts/architecture.md

@@ -53,15 +53,14 @@ flowchart TD
 
 ## Модель «capture-up» {#capture-up}
 
-Репозитории узлов служат реестрами состояния, а не просто источниками конфигурации: хост сам фиксирует то, что выполняет на практике.
+Команда `apex sync/repository` фиксирует рабочее дерево и версию commons
+в ветке `sync/<node>`, выполняет rebase на `origin/main` и отправляет ветку
+с флагом `--force-with-lease`. Если в commons есть незакоммиченные изменения
+или каталог `compositions/` отсутствует, команда отказывается работать.
+Конфликт rebase прерывает синхронизацию.
 
-1. Регулярная задача `sync/repository` на хосте коммитит рабочее дерево в ветку `sync/<node>` (включая указатель субмодуля commons), делает rebase поверх `origin/main` и выполняет push с флагом `--force-with-lease`.
+Проверку и слияние этой ветки определяют правила репозитория. APEX не поставляет
-2. Запланированное CI-задание в репозитории узла вливает ветку `sync/<node>` обратно в `main` от имени бота.
+CI-сценарий слияния и не требует определённого способа размещения репозиториев.
-
-Благодаря циклу [«capture-up»](/apex/glossary#capture-up) любой дрейф конфигурации на хосте превращается в коммит: изменение наглядно отображается в diff и легко откатывается, исключая незаметные расхождения. Если субмодуль commons имеет незакоммиченные изменения («грязный») или каталог `compositions/` отсутствует, синхронизация прерывается без коммита, поэтому повреждённое состояние чекаута никогда не попадёт в историю.
-
-> [!NOTE]
-> CI-задание слияния клонирует репозиторий *без* субмодулей: субмодуль commons подключён по SSH-URL, недоступному стандартному токену CI, а самому слиянию требуется лишь обновить указатель gitlink.
 
 ## Проектные ограничения {#constraints}
 

services/docs/content/ru/apex/concepts/compositions.md

@@ -44,7 +44,7 @@ include:
 |---|---|---|
 | `xray` | xray | Прокси-шлюз с режимом host-network для анклава. |
 | `adguard` | adguard | DNS-фильтрация в сетевом пространстве имён traefik; маршрутизируется по пути `/adguard` на FQDN узла. |
-| `alloy` | alloy | Агент наблюдаемости на каждом узле (Grafana Alloy). Собирает метрики хоста и контейнеров, а также логи systemd journal и контейнеров, после чего **проталкивает** их исходящим потоком в центральные Prometheus и Loki (см. [Концепция: Модель безопасности](/apex/concepts/security-model#observability)). Имя хоста (`hostname`) контейнера совпадает с `APEX_NODE_HOST`, благодаря чему метки `node` и `instance` автоматически проставляются на всех метриках и потоках логов. |
+| `alloy` | alloy | Необязательный агент Grafana Alloy. Отправляет метрики хоста и контейнеров, системный журнал и логи контейнеров на заданные совместимые конечные точки. См. [настройку наблюдаемости](/apex/concepts/security-model#observability). |
 | `manual` | resticontainer | Одноразовый контейнер резервного копирования на основе меток (`ghcr.io/deytenit/resticontainer`). Никогда не запускается командой `up`; вызывается действием `backup/run`, которое определяет необходимость бэкапа каждого сервиса по compose-меткам `restic.*`. |
 
 ## Сети {#networks}

services/docs/content/ru/apex/concepts/node-identity.md

@@ -21,7 +21,7 @@ weight: 12
 ```ini {filename="node.env"}
 APEX_NODE_FQDN=node1.example.com
 APEX_NODE_HOST=node1.example.com
-APEX_SUBNET=198.18.16.0/24
+APEX_SUBNET=198.18.0.0/24
 ```
 
 ### Имя хоста ОС

services/docs/content/ru/apex/concepts/security-model.md

@@ -34,7 +34,11 @@ weight: 18
 
 ## Наблюдаемость {#observability}
 
-Система мониторинга построена по модели **исходящей отправки (push)**, а не входящих опросов. Опциональный сервис `alloy` (Grafana Alloy, один агент на узел) собирает метрики хоста (аналог `node_exporter`), метрики контейнеров (cadvisor), системный журнал systemd journal и логи docker-контейнеров, после чего передаёт их в **центральные** хранилища Prometheus и Loki на выделенном узле. Метрики отправляются через `prometheus.remote_write` на адрес `APEX_PROM_PUSH_URL`, логи — через `loki.write` на `APEX_LOKI_PUSH_URL`. Обе конечные точки защищены базовой аутентификацией HTTP basic auth (`APEX_OBS_BASIC_AUTH_USER` / `APEX_OBS_BASIC_AUTH_PASS`). Поскольку трафик отправляется наружу, Alloy подключён к сети `direct` с доступом в интернет, а не к закрытой сети `enclave`. На самих узлах логи не накапливаются, и открывать внешний доступ к эндпоинтам сервисов не требуется.
+Необязательный сервис `alloy` отправляет метрики хоста и контейнеров на адрес
+`APEX_PROM_PUSH_URL`, а логи — на `APEX_LOKI_PUSH_URL`. Укажите совместимые
+конечные точки и учётные данные HTTP basic auth в `APEX_OBS_BASIC_AUTH_USER`
+и `APEX_OBS_BASIC_AUTH_PASS`. Сервису нужен исходящий доступ к этим адресам.
+Размещение хранилищ и правила доступа определяет оператор.
 
 ## Изоляция секретов {#secrets}
 

services/docs/content/ru/apex/glossary.md

@@ -16,7 +16,7 @@ weight: 100
 
 ## Capture-up {#capture-up}
 
-**Capture-up** — механизм фиксации состояния хоста в репозитории: регулярный коммит в ветку `sync/<node>`, который перебазируется на `main` и сливается средствами CI. В результате любой дрейф конфигурации становится наглядным diff, а не скрытым расхождением.
+**Capture-up** — фиксация рабочего состояния хоста в ветке `sync/<node>` командой `apex sync/repository`. Проверку и слияние определяют правила репозитория.
 
 ## Commons {#commons}
 

services/docs/content/ru/apex/guides/host-operations.md

@@ -12,7 +12,8 @@ weight: 24
 
 | Шаг | Эффект |
 |---|---|
-| `configure/base` | Готовит базовую систему Debian: обновляет списки пакетов, ставит базовые утилиты (`curl`, `wget`, `git`, `rsyslog`), запускает службу rsyslog, устанавливает `ufw` и вспомогательный скрипт `ufw-docker` в `~/.local/bin/ufw-docker`. |
+| `configure/base` | Устанавливает недостающие пакеты Debian после проверки плана APT на обновления и удаления, запускает rsyslog и проверяет закреплённую версию `/usr/local/bin/ufw-docker` перед запуском от root. Не запускайте другие пакетные операции одновременно. |
+| `configure/timezone` | Применяет `configs/timezone`, если файл есть, и перезапускает активную службу cron после смены часового пояса. Поддерживает `--dry-run`. |
 | `configure/ufw` | Применяет правила хоста, настраивает цепочки правил ядра и пробрасывает правила для контейнеров через `ufw-docker`. Поддерживает флаг `--dry-run`. |
 | `configure/crowdsec` | Устанавливает CrowdSec (если он ещё не поставлен), копирует `configs/crowdsec/` в `/etc/crowdsec/`, ставит коллекции и firewall bouncer (если включён в настройках). Поддерживает флаг `--dry-run`. |
 | `configure/cron` | Рендерит `configs/cron/crontab` через шаблонизатор и устанавливает расписание. Предусмотрены предпросмотр, аварийная остановка при пустом результате (код выхода 65) и откат при ошибке установки. Поддерживает флаг `--dry-run`. |
@@ -27,10 +28,39 @@ weight: 24
 apex compose up            # сначала core, затем сервисы по алфавиту
 apex compose down          # обратный порядок
 apex compose restart
-apex compose up --dry-run  # только напечатать команды
+apex compose --dry-run up  # только напечатать команды
+apex compose -p apex restart traefik
+apex compose -p app up -d
 ```
 
-Все дополнительные аргументы движок передаёт напрямую в `docker compose` каждого проекта. Файлы `.env` и `apex.env` проектных каталогов подставляются автоматически при их наличии.
+Указывайте параметры APEX (`-p` и `--dry-run`) перед действием. Остальные аргументы
+передаются Docker Compose для выбранного проекта. Файлы `.env` и `apex.env`
+подключаются автоматически, если существуют. Формы `apex compose restart apex traefik`
+и `apex compose up -d apex` сохраняются; если имя сервиса или значение параметра
+совпадает с именем композиции, выбирайте цель через `-p`.
+
+Замените `app` именем композиции из своего репозитория. После изменения
+монтирования или конфигурации контейнера используйте `up -d` для нужной
+композиции; `restart` сохраняет прежнюю конфигурацию контейнера.
+
+### Прямой запуск Compose для core
+
+```bash
+apex env --sync
+cd compositions/apex
+docker compose config --quiet
+docker compose restart traefik
+```
+
+Синхронизация сохраняет текст секретов и UID/GID в `.env`, а также ссылку
+на файл в хранилище tier. Управляемый блок содержит настройки `apex.env`, включая
+профили, затем вычисленные значения узла и путей. Файл записывается с правами
+`0600`. Повторите синхронизацию после изменения настроек или путей; не редактируйте
+управляемый блок вручную. Переменные оболочки сохраняют приоритет Docker Compose.
+
+`eval "$(apex env)"`, `apex env --dotenv` и `apex env --write generated.env`
+выводят или записывают только вычисленные значения APEX. Они не загружают секреты
+композиции и не заменяют `--sync`. Выбирайте один режим вывода за вызов.
 
 ## Резервные копии {#backups}
 
@@ -53,7 +83,7 @@ apex backup/run "$(cat <path-to-telegram-url-file>)"
 apex sync/repository <telegram-bot-url>
 ```
 
-Действие фиксирует изменения рабочей копии в ветке `sync/<node>`, выполняет rebase на `origin/main` и отправляет ветку через force-push с lease. Затем CI автоматически вливает изменения обратно в `main`. Этот механизм (capture-up) сохраняет актуальное состояние узла в репозиторий.
+Действие фиксирует изменения рабочей копии в ветке `sync/<node>`, выполняет rebase на `origin/main` и отправляет ветку через force-push с lease. Этот механизм (capture-up) сохраняет актуальное состояние узла в репозиторий.
 
 Действие прерывается с подробным сообщением, если подмодуль commons содержит незакоммиченные изменения или каталог `compositions/` отсутствует. При конфликтах rebase выполнение останавливается для ручного вмешательства. Подробнее архитектурная модель описана в разделе [Concept: Framework architecture](/apex/concepts/architecture#capture-up).
 

services/docs/content/ru/apex/guides/node-repository.md

@@ -25,7 +25,7 @@ mkdir -p proprietaries/actions proprietaries/lib configs compositions/apex .gith
 ```ini {filename="node.env"}
 APEX_NODE_FQDN=node1.example.com
 APEX_NODE_HOST=node1.example.com
-APEX_SUBNET=198.18.16.0/24
+APEX_SUBNET=198.18.0.0/24
 APEX_GIT_AUTHOR_NAME=apex [bot]
 APEX_GIT_AUTHOR_EMAIL=apex@localhost
 ```
@@ -46,7 +46,7 @@ include:
 ```
 
 ```ini {filename="compositions/apex/apex.env"}
-APEX_TRAEFIK_DIRECT_IP=198.18.16.10
+APEX_TRAEFIK_DIRECT_IP=198.18.0.10
 APEX_RESTIC_REPOSITORY=s3:<endpoint>/<bucket>/<node>
 COMPOSE_PROFILES=adguard,xray,alloy
 # цели push-наблюдаемости (только когда включён профиль alloy)
@@ -84,9 +84,12 @@ __pycache__/
 
 Создайте файл `compositions/ADDRESSING.md` с подсетью узла (`APEX_SUBNET`) и схемой распределения адресов: диапазоны `.10`–`.19` зарезервированы за базовыми сервисами (core), а `.20` и выше выделяются под проекты. Все назначаемые в будущем [якорные IP](/apex/glossary#anchor-ip) фиксируются в этом документе.
 
-### Подключите CI capture-up
+### Определите правила проверки синхронизации
 
-Настройте периодический CI-workflow, который автоматически вливает ветку `sync/<node>` в `main` (если ветка существует) с авторством бота. Шаг checkout должен выполняться **без** загрузки подмодулей: слияние только сдвигает указатель `commons`, а SSH-ссылка на подмодуль недоступна по стандартному CI-токену. Полный цикл описан в разделе [Concept: Framework architecture](/apex/concepts/architecture) ([capture-up](/apex/glossary#capture-up)).
+Решите, как проверять и вливать ветку `sync/<node>`, которую создаёт
+`apex sync/repository`. Для автоматического слияния настройте разрешения
+репозитория и доступ к субмодулям под выбранный сценарий.
+См. [модель capture-up](/apex/concepts/architecture#capture-up).
 
 ### Проверьте работу
 

services/docs/content/ru/apex/guides/service-composition.md

@@ -28,7 +28,7 @@ services:
       - ./@tier2/<anchor>/data:/data
     networks:
       direct:
-        ipv4_address: 198.18.16.20
+        ipv4_address: 198.18.0.20
       enclave: {}
     labels:
       - "traefik.enable=true"

services/docs/content/ru/apex/reference/actions.md

@@ -4,7 +4,7 @@ description: "Каждое действие commons: аргументы и по
 weight: 32
 ---
 
-Шестнадцать действий [«commons»](/apex/glossary#commons) (общего репозитория), разбитых по группам. Аргументы показаны в том виде, в котором их принимает парсер; необязательные аргументы заключены в квадратные скобки. Коды возврата следуют [соглашению движка](/apex/reference/cli#exit-codes).
+Действия [commons](/apex/glossary#commons) по группам. Аргументы показаны в том виде, в котором их принимает парсер; необязательные аргументы заключены в квадратные скобки. Коды возврата следуют [соглашению движка](/apex/reference/cli#exit-codes).
 
 ## configure {#configure}
 
@@ -12,13 +12,19 @@ weight: 32
 
 `apex configure [--dry-run]`
 
-Запускает весь набор в фиксированном порядке (`base`, `ufw`, `crowdsec`, `cron`, `systemd`, `routing`) и останавливается на первом неудачном шаге, возвращая его код возврата. Флаг `--dry-run` передаётся шагам, которые его поддерживают.
+Запускает `base`, `timezone`, `ufw`, `crowdsec`, `cron`, `systemd`, `routing`, затем дополнительные действия узла. Ошибка шага даёт ненулевой итоговый код; последующие шаги могут продолжить работу. Флаг `--dry-run` передаётся только тем шагам, которые его поддерживают, поэтому не гарантирует отсутствие изменений для всей команды.
 
 ### configure/base
 
 `apex configure/base`
 
-Проверяет, что операционная система — Debian (иначе завершается с кодом `1`). Обновляет индекс пакетов, устанавливает необходимые пакеты (`curl`, `wget`, `git`, `rsyslog`), проверяет статус службы `rsyslog`, устанавливает `ufw`, если его нет, и загружает вспомогательную утилиту `ufw-docker` в `~/.local/bin/ufw-docker` (если утилита уже есть, загрузка пропускается).
+Проверяет, что операционная система — Debian; иначе завершается с кодом `1`. Проверяет состояние пакетов `curl`, `wget`, `git`, `rsyslog` и `ufw`, устанавливает недостающие и запускает rsyslog. Отклоняет план APT с обновлениями или удалениями и использует `--no-upgrade --no-remove`. Не запускайте другие пакетные операции одновременно: проверка плана и установка выполняются отдельно. Перед запуском `/usr/local/bin/ufw-docker` от root проверяет закреплённую ревизию и SHA-256. Небезопасные пути и непроверенные загрузки отклоняются; одних прав на исполнение недостаточно.
+
+### configure/timezone
+
+`apex configure/timezone [--dry-run]`
+
+Применяет часовой пояс IANA из `configs/timezone` и перезапускает активную службу cron после изменения. Если файла нет, сохраняет текущий пояс; неверное имя приводит к ошибке до внесения изменений.
 
 ### configure/ufw
 
@@ -110,9 +116,19 @@ weight: 32
 
 ### compose
 
-`apex compose <action> [--dry-run] [extra...]`
+`apex compose [-p <composition>] [--dry-run] <action> [extra...]`
 
-Оркеструет запуск `docker compose <action>` по всему узлу: сначала основной проект, затем сервисы в алфавитном порядке (в обратном — для команды `down`). Команда `up` по умолчанию использует ключ `-d`; файлы `.env` и `apex.env` подключаются для каждого проекта при их наличии; дополнительные аргументы пробрасываются дальше; флаг `--dry-run` (принимается в любой позиции) выводит сформированные команды без их выполнения.
+Без цели обходит сначала core, затем остальные композиции по алфавиту; для `down` порядок обратный. Параметр `-p` выбирает одну композицию или `all`. Команда `up` по умолчанию добавляет `-d`; файлы `.env` и `apex.env` подключаются в этом порядке, вычисленные значения узла и путей передаются через окружение. Параметры APEX ставятся перед действием, остальные аргументы передаются Docker Compose. Флаг `--dry-run` печатает команды без запуска.
+
+Сохраняются формы `apex compose restart apex traefik` и `apex compose up -d apex`. Используйте `-p`, чтобы явно отличить композицию от сервиса или значения параметра.
+
+## env {#env}
+
+`apex env [--export | --dotenv | --write <path> | --sync]`
+
+По умолчанию выводит экспорты APEX для `eval "$(apex env)"` с экранированием оболочки. `--dotenv` выводит формат dotenv; `--write` записывает вычисленные значения в отдельный файл, в том числе по относительному пути. Эти режимы не читают секреты композиции и не объединяют `apex.env`.
+
+Режим `--sync` сохраняет пользовательский текст `compositions/apex/.env` и обновляет управляемый блок: сначала настройки `apex.env`, затем вычисленные значения. В блок входят `COMPOSE_PROFILES` и `TZ`, поэтому Compose можно запускать напрямую из каталога core. Ссылки tier сохраняются, файл получает права `0600`. Повторяйте синхронизацию после изменения исходных настроек или путей. Некорректные маркеры останавливают запись; переменные оболочки сохраняют приоритет Docker Compose.
 
 ---