fix: use upstream third-party container images [skip ci]

fix: restore public upstream Hextra submodule [skip ci]
fix(ci): preserve vendored action module boundaries [skip ci]
2026-11-06 09:22:54 +03:00 · 2026-11-06 01:37:35 +03:00 · 2026-11-05 23:21:31 +03:00 · 2026-11-05 23:18:31 +03:00 · 2026-11-05 23:02:12 +03:00 · 2026-11-01 18:21:05 +00:00
509 changed files with 293197 additions and 12726 deletions
@@ -0,0 +1,22 @@
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY_DEV="02a9d0f6522086b04ac7763e008a6ad0273c58258715e613c977fd6c82a2030d92"
+
+# .env.dev
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY="02a9d0f6522086b04ac7763e008a6ad0273c58258715e613c977fd6c82a2030d92"
+
+# .env
+COM_ERMNVLDMR_STATIC_S3_BUCKET="encrypted:BE65d5I9m1jrHGVNKDmfGL3Cjb7LjhB4tVWyNzSPU1Zu5Y00+R8NXgqSBrzBnXVj3vVinibjihVt3fStegyiqI52GtSycX1NlFSVJlRFWadUJ6SVK+SYfB7sFKSJ2jKGfwRaXKMzaKCdPWY+ni685oPXU9Rp"
+COM_ERMNVLDMR_STATIC_S3_REGION="encrypted:BPQ2+ms76A+PLFUeKL1Cnz8bdOcsJou03e8AyGwzdhozpcAwhP5yWXSqhTK8ZccAvmfjJcM4NK+x2a2r4g0ALd/UaQDa9xy2eZ6QnXwkoHXu2ce+F86/HuFnzX0qWqYTWi4q+N4="
+COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL="encrypted:BCcK2ih1QrABMImpUj31KIQYlbp9zhnafzrXINAwvyCaCjbOst6UGnhhi5M3LtQ+Fhgpx52ZKGjmke1oVxnvU6BBGz/lAbSD5euhHNbJ6EIoSqc25XpcmgucIQGx1cfiJxsL4sDR95FyR3fNaS9KGr005DwQaIRKGg86gALUCPhaLekq/Sd6Nn+TDoqmigLJPozdxp33AFpmWF+EwayYae2u"
+COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID="encrypted:BPaBvzNo1eH3Z2ro+NFq4zLi4krZQT48h20r0etBfVFLDNS01gh5Uosy70Ip29rC8sa1JoP4Q8isJ2Xz0pr5Vxxa62vVFOJ9wJ6LkXbYF2bUm+UNyjfsIztJsMyiVZfPEEPEEKcniXZ3faqePwgLwCZSTa/Qry6znNmMV5FshSsP"
+COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY="encrypted:BFiOxOo/TNvSIMOjyeOswLcl+9AVdqp4axW+I46c1CL0ckSucQS+7CLpO8fNfakmW2bSibqru+xfWUbQT7FDH1YB3CPXUc0qPm1PsG0FiLixDefQuDrC/JHuA0Z3/dOAkn/e94BBuPtyJXxcLRP1v517MijPa0MuNqhI9BS3jFHKjWivqc9AVPs2ybglo14b/nEO1GqlM0TYflPoDhHoWjM="
+SOPS_AGE_KEY="encrypted:BKiJVxKYhiadu0kNCw8wVLYdaEWZreAVu2PaujxhvcXeCowCGjivEuQD/uhduAy/CwwDWyQkgQJ2FJMEKA47e7QDjS9TMdPCXO19/teR7LThgqTf6AbSM3sebln5zalgyplay4A/7cVytPXuOvVkaYyoh9CgzTVsPJKXRq5yMaDEx/9/91Yo8zUMF3z1vq3/preI5baK4/1xXewR3OwfZqnNGyd7LXkdqyT5"
+COM_ERMNVLDMR_DEV_ROOT_CA_KEY="encrypted:BP+GhCwutIMF2hSxIs92VNSoEAvfdhYRFSi5MUpFfCs+pNxJkZ7tFOAadMqSlPiLBcm9+A3yIn/04/oEtRNjXk/jlZQ2G21mt30sd89NARjJO+94ui6XbllW65E5/T+d8fDmRhz4c4OcNoKk70aXcdJqd1CJT7IlYQn++zQvB2el9cp9e7E22rvGtvum40iISEt/pVU84uHyQg6ZeCn+1czM+nLhPiWOAgveTz3EAgExlJW2de1ilDIuBCFXJy5+KvnCj3WNwRTAbIYgCwFnZMOUE5jYlhP6OZ2DQ3sWv7noG/Xaa/P+EomP9dwcamlAU32tRruyA8ZSp/ah9E8hFfmBqgKfSbRlWq3qGkq/F935DZfU/C+PjRcepS/eLZQ0mfD23B21VX2CjOhEkp5V+9I5L8XkXDjDg56JDRGvF/umpdqF/KpmtimqcgB0yDVY1Z3yT1U5IZ6Yf4WlqzhchdJXRWfo0bqK8Tk0b442/6AQgRP3n6DIrCjcpmr4jx+RJiejOr3xv3QtHGafDdkF2gO7DrYztdd6XpRjij0orBUiyYECgPsLHuwd+/2jXnxLVTavVTQ0Ddz0LLNjaYxqr8KK/B+0MeS/iuLXmACs8XCKwQmV8hPYQ0C/JXGiL4GOH0V70r6ghBxCDDMpJjPasCbiCBxSAMLkQ7ZmLbO0WVPPUTMAsZ8aKUy2MLe466zizXN640B4H6bkI7x/KC29sroEJWpUufD7f+t2tnVx/KLeAxAC6afuUCGi4ibFiwLHZjfimYKaYpuMcSZHQ64iONixyfUDIRNIOWQSiX1V5EBJgBDE0JVDnExmQYAIG5isYQEorC/7z6IJeZHc4NuiKDWuvd+jwwj8tN8PVAcACJKpQHpyUU20kvp4dYgBEeiQZpBfXWrnmOJZ0HgDHbvVxPW+SHTL/uoi/Tl9xdKe+z3Q/MoT8iYXggMPcFQIqVemQUTw9Tu0oNsSj3xueR9awJc2Le9aYbKTg54MAtcBnfKXN+3cYQkNVbqC5RfiAe2D3gfbT1OgApTUNz8n8v1dgAzTa+EB0i+w8nTsb3N/N4yAXMNSKdGeUl2rFRuQO7qlWorKc3pE+nBC2ex0sOMEUFYUXcyULaxsKM3ddakCAv9/jesnkrZl2gX7YDp8iqiFzh7l8jMAFHtFCMp3CSXlBAOpfQlGLY80qTSi1e8GrnV9Ow9t0DdS1wP7J6ES9DiNuEep5atHD+0MC6u0Dw0GtmsNnNRp77my/KI8ILhF4VBVBFQ5BiJDfdpAA3RNlANo2gK5ZCKPw4tXCYUknjYdwkqvUaIQCJcr2n+WkE2eCUCqjXTFr/KMvRByY6Fb1vAwcGoCWjP2g0Tliz3hcyh/72+umn05NO3cJSAfDEjfcYBUQZ/LCcy86G0EsHXP3NabgeHNXf/Z/VG7zWqQAPX0KaVrF9XC6I2FLkg1aNGWZfJGv4uohdIny7rWU7FWPaxy9GMk6x7xBh/Hk/5/rrGHCNGs+SegLglDs2+v4P56316k4kg//dmVl/vh3h0KC2P/1xiJZ10I91k7HqZLb2qdXToa4yOHB5Euu49UV/Qtv+cZU03fuT81sEv3YT819OdmwUZgkq0PT/Lrck+pbNDaUOakpgkGAbXy6SCvjM87jYN9Ia7druulWWO0pPi4T8daQ26ZQmZp57gdkpuh/He4kC5m1aWpT2s5STSbapChd9tFNjPhjCG1DZb7h0X8jg1VkxqutDDu17jOXrhElT1ejvYqYy9lIG1b1r7Jmjxo7LgGQuPMX6CIo/BLTsuNJyC5SfSCxEm56LvJgoNk2Vaeq6mLDOaKm2PNwPuYPnJw9xWBM0EetJBnsYMutPDMXhrB7x/8DKy5/hCsKICTfhlsboUHmbSfsikvGPYx7YOaOo8xFh4yAQ73T8hFX7kn2DBfRzGkJm8SQJRPj0Hjsf5mEFUt/OrieK/Jw10HKD6hDoEFmUDv5svC3nUY0FX0fTyi0jRAri+burrCQ0HXk/qj4Xs+WLiJgfQbprV2TwTIlzOdLb/jD8PeiElNzBxmOonRj76QKcbkOnPkCWCMFKapOJskxe0ASJVjYt142D0ndTa6F7oFu72ue5U+hyoToKeb7ONZilhF0+yL7akNfFKURUa/X+cEoewuSM7r8whWwZyG+M2cwGUTRMJiAC9wK7yE8MqdrEuQtILnCA0yRTPOh1Z9ifUY0asL1Tw9cbdGRW8svHH/oVHkWe3P+yepTNrn7xQlX/O1/p4FXRm0gSE3Fdnbli8VZdwVn2SET3WkPH9rJT2F7/hovfhx+lQzBQq9ZBpNLrWRdhXzCpiaC04o7q/eef+8dZwU62A1pd8uZ+0dI5T7lOVXoo03uF863YSOKX8ad2CiYUJ8gMvMA8FSWnsUbxiDaiXPj8kni5TLsvrkH/CKY/okG5SdRCF/XCcRcXP5dxdsS90tIWdd0xi/2wbalmn3CPQ2eVeDI3dP/jCRBkfiNtD70flhxVngZMZW+Rr1c0Cpo//fMCiV5ksDIBGin5AfOPmvSnPYWV5zcU3QEfl2F5fLXgDCbpaYjaOYjyRt9ZTqabSf1Ar4L9yQFBr4N9cNg4jKskvbha4BDmUL8J7xz/F/OXHFnEDV2YkMcpBfGM2XhKDevceOQcjrPkF5/e5LdwQeYhqgzzm6ur42OwHB2HBU7ulXn/LCk2eYCFa2D1f+2F3ExbwAvnDMhymdQdUniF/NzOfG/1L3yplFsqi270T/2gT1LdOQ/Fgp3FA81k/sMLbICcF/qCp/nS3x+iMZn9B+WLjUQvJy2PehXNcpXEvXWM/e1X4PWDUhwQi7+wjJwERX2W5SB1XjQa7n/osZqpOUG2ShssPNpS3mecaV+MTpRPVYTPFiDTIgkG7F/DSND0c2PDWsBLFus0h4jG70L94uDxVNiMJb/xq/7d2+7FMNPh9UJSK75XcKDhrRYJo3iU7mfl1U89vJB179ulGrdMpWd8v5DHWEDrn3NRBa0KWVYKpqeQ0195XXH1YlZjzK7615K/5ooOGUL42PlX2Hw1zxOJubsIl6LZt8V6wa6zJgywuVLsZb+kpjtHTHmVZyhY8IUnAn6Uj8erYXapvZ8rlhUpjvVuosn8gB9JM6vNct5dVn4e8Wbt6KnRcogHYUJT32QRSWsHCaZNEqwbX+dYaLx1FQZ5daYbXSWwiHhtAJRuYutbmWwWCRTVzyNNMh3sMAI1EcmMoOIX0DEhXYNe7daErR6vMyizQ+h5YKUYK4nUu270M0x/YKRHlxwK8WkEqWv8vfhZqzV0YGud1Hwd5JwWhIEZQ7cc1uPeYJJ5kAaIFqCffmwecS2gzVvOgDkNC5eENXSk7SzDpVgm8IcfZV47L17ni75tyJCS/kreODjap6VdpDNTyS1YJaaO2TMX/s4kWiEZ22Ma4CEv2eQq1uGazGamli+ZwExAtehw=="
+COM_ERMNVLDMR_STATIC_PUBLIC_URL="encrypted:BEZbNy1WbNKhgUWmKO648nvuVNyMNXrMnq64WkjsScTOcE/HFtMX3nQktbIvEYiTSNHvoceUeW10E9i4n+C5ZEHKIBi9VUk3nuqVIcwAr6xTfqKjM1cJlRNKFQzwhHbBTYcImLoxFvM56KU4L/9Ei/XuQ/QRz0KTabhvGMM="
@@ -0,0 +1,175 @@
+---
+name: github-fix
+description: Diagnose CI failures and review feedback on GitHub Pull Requests or Issues, repair code, verify quality checks, and commit changes.
+---
+
+# GitHub Fix Skill
+
+Use this skill when a user submits a `/fix` command on a GitHub Pull Request or Issue.
+
+## Overview
+
+The `/fix` command resolves build failures, test errors, and reviewer feedback. This skill enforces unified diagnosis, clean code repair, strict verification, and transparent progress reporting.
+
+```text
+/fix [optional instructions]
+  │
+  ├── 1. Unified Diagnosis (Fetch CI logs, inspect diff, parse comments)
+  ├── 2. Target Code Repair (Fix build errors and review feedback in one pass)
+  ├── 3. Verification (Run typecheck, lint, and tests)
+  ├── 4. Git Operations (Commit and push to the active branch)
+  └── 5. Thread Summary (Post itemized comment with mandatory disclosure)
+```
+
+---
+
+## Operational Workflow
+
+### Step 1: Unified Diagnosis
+
+Collect all diagnostic context before making code edits.
+
+#### Case A: Pull Request Context
+1. Identify the current PR number and branch:
+   ```bash
+   gh pr view --json number,headRefName,baseRefName
+   ```
+2. Fetch failed CI workflow logs:
+   ```bash
+   gh run view --log-failed
+   ```
+3. Inspect current changes in the PR:
+   ```bash
+   gh pr diff
+   ```
+4. Read all review comments and discussion threads:
+   ```bash
+   gh pr view --comments
+   ```
+5. Check inline review comments on specific files:
+   ```bash
+   gh api repos/{owner}/{repo}/pulls/{pull_number}/comments
+   ```
+
+#### Case B: Issue Context
+1. Read the issue description and thread comments:
+   ```bash
+   gh issue view <issue-number> --comments
+   ```
+2. Extract error stack traces, reproduction steps, and user instructions.
+
+---
+
+### Step 2: Target Code Repair
+
+Apply all necessary corrections in a single pass.
+
+1. Address all failures from CI logs (TypeScript errors, linter violations, test failures).
+2. Apply requested changes from code review comments.
+3. Incorporate any optional user instructions provided with `/fix`.
+4. Obey all repository conventions defined in `GEMINI.md`:
+   - **Strict TypeScript**: Do not use `any`, `as Type` assertions, or non-null `!` assertions. Use `castRef` from `@ermnvldmr/stl` when casting DOM references.
+   - **Type Imports**: Use `import type` for type declarations.
+   - **Interfaces**: Define object contracts with `interface`, not `type` aliases.
+   - **TSDoc**: Add descriptive JSDoc comments to all exported symbols and interfaces.
+   - **Styling**: Use Tailwind CSS v4 and `cva`. Merge class names with `cn` from `@ermnvldmr/stl`.
+   - **UI Primitives**: Use React Aria hooks and Radix UI primitives.
+   - **Import Boundaries**: Use relative paths for files within the same workspace package.
+
+---
+
+### Step 3: Verification
+
+Execute the complete verification sequence. All checks must pass with zero warnings or errors before proceeding.
+
+```bash
+# 1. Verify TypeScript types
+pnpm typecheck
+
+# 2. Verify ESLint rules
+pnpm lint
+
+# 3. Run unit and component tests
+pnpm test
+```
+
+> [!IMPORTANT]
+> If any check fails, resolve the failure immediately and rerun the verification sequence.
+
+---
+
+### Step 4: Git Operations
+
+Stage, commit, and push the resolved changes to the active branch.
+
+1. Stage modified and created files:
+   ```bash
+   git add <modified-files>
+   ```
+2. Commit with standard message:
+   ```bash
+   git commit -m "fix: apply review adjustments and CI fixes"
+   ```
+3. Push changes to the remote branch:
+   ```bash
+   git push origin HEAD
+   ```
+
+---
+
+### Step 5: Post Summary Comment
+
+Post an itemized summary comment to the GitHub PR or Issue thread.
+
+1. Format the comment with the template below.
+2. Submit the comment via GitHub CLI:
+   - For a Pull Request:
+     ```bash
+     gh pr comment <pr-number> --body "<comment-body>"
+     ```
+   - For an Issue:
+     ```bash
+     gh issue comment <issue-number> --body "<comment-body>"
+     ```
+
+---
+
+## GitHub Comment Template
+
+```markdown
+### Automated Fix Summary
+
+I addressed the reported issues and review feedback.
+
+#### Root Causes Identified
+- **CI / Test Failure**: `<Brief description of the failure>`
+- **Review Feedback**: `<Brief description of reviewer comments>`
+
+#### Changes Applied
+- `packages/<pkg>/src/...`: Fixed `<specific problem>`
+- `services/<svc>/src/...`: Updated `<specific problem>`
+
+#### Verification Results
+- `pnpm typecheck` passed (0 errors).
+- `pnpm lint` passed (0 warnings).
+- `pnpm test` passed (all tests clean).
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+---
+
+## Verification Checklist
+
+Before completing the task, verify every item in this checklist:
+
+- [ ] Failed CI logs inspected with `gh run view --log-failed`.
+- [ ] PR diff and review comments retrieved and analyzed.
+- [ ] Code repairs satisfy all requirements without introducing regressions.
+- [ ] No `any`, `as Type`, or `!` operators introduced.
+- [ ] `pnpm typecheck` completed with 0 errors.
+- [ ] `pnpm lint` completed with 0 warnings.
+- [ ] `pnpm test` completed with all tests passing.
+- [ ] Changes committed and pushed to the active branch.
+- [ ] Summary comment posted to the PR or Issue.
+- [ ] Mandatory disclosure line included at the end of the comment.
@@ -0,0 +1,125 @@
+---
+name: github-implement
+description: Implement code changes from an approved issue plan, run monorepo validation, and create a pull request.
+---
+
+# GitHub Implement Skill
+
+Use this skill when an issue receives the `/implement` command.
+
+## Overview
+
+This skill guides the implementation of approved design plans. It enforces repository rules, executes automated validation, and prepares pull requests for the `next` branch.
+
+## Procedural Workflow
+
+### Phase 1: Context Ingestion
+
+1. Read the complete issue description and title.
+2. Locate the approved implementation plan in the issue comments.
+3. Parse additional instructions from the `/implement` comment.
+4. If requirements conflict or miss critical details, stop and request clarification.
+
+### Phase 2: Code Implementation
+
+Apply all modifications according to `GEMINI.md` conventions:
+
+1. **TypeScript Constraints**:
+   - Enable strict typing for all new code.
+   - Do not use the `any` type.
+   - Do not use type assertions (`as Type`).
+   - Do not use the non-null assertion operator (`!`).
+   - Use explicit type guards or helper functions such as `castRef`.
+   - Use `import type` for type-only imports.
+   - Define object structures with `interface`, not `type` aliases.
+
+2. **Documentation Rules**:
+   - Add JSDoc comments to all exported functions, interfaces, and types.
+   - Include clear description text in every JSDoc block.
+
+3. **Component Architecture**:
+   - Place components in dedicated directories under `packages/ui/src/components/<ComponentName>/`.
+   - Provide `<ComponentName>.tsx` for component logic.
+   - Provide `<ComponentName>.stories.tsx` for Storybook stories.
+   - Provide `<ComponentName>.test.tsx` for Vitest tests.
+   - Use `cva` for component variant management.
+   - Merge CSS utility classes with `cn(...)` from `@ermnvldmr/stl`.
+   - Use React Aria hooks and Radix UI primitives for accessible controls.
+
+4. **Monorepo Imports and State**:
+   - Use relative paths within the same package.
+   - Do not use self-referential package names.
+   - Use standard React state primitives. Do not add unapproved state managers.
+
+5. **Protected Boundaries**:
+   - Do not modify `.env.keys`, `pnpm-lock.yaml`, or `LICENSE`.
+   - Do not edit content files in `services/docs/content/` or `services/www/content/` unless explicitly instructed.
+
+### Phase 3: Monorepo Verification & Self-Correction
+
+Run validation commands in strict sequence:
+
+1. Run `pnpm typecheck`. Ensure zero compiler errors.
+2. Run `pnpm lint`. Ensure zero warnings and zero errors.
+3. Run `pnpm test`. Ensure all unit and component tests pass.
+4. Run `pnpm build`. Ensure clean compilation across all packages.
+
+**Iterative Self-Correction Loop**:
+- If any check fails, inspect the diagnostic output.
+- Identify the root cause.
+- Apply targeted fixes adhering to all code rules.
+- Re-run the verification sequence from step 1.
+- Repeat until all four checks pass completely.
+
+### Phase 4: Commit & Pull Request Preparation
+
+1. **Commit Message**:
+   - Format commits according to Conventional Commits: `<type>: implement issue #<number> (<title>)`.
+   - Example: `feat: implement issue #42 (add theme toggle)`.
+
+2. **Pull Request Target**:
+   - Set base branch to `next`.
+
+3. **Pull Request Body**:
+   - Link the issue: `Resolves #<number>`.
+   - Provide a concise summary of changes.
+   - Detail the implementation walkthrough.
+   - List the executed verification checks.
+   - Append the mandatory attribution line.
+
+4. **Mandatory Attribution**:
+   - Conclude all PR bodies and issue comments with:
+     `Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.`
+
+## Pull Request Template
+
+```markdown
+## Summary
+Resolves #<number>
+
+<Brief explanation of the implemented feature or fix>
+
+## Walkthrough of Changes
+- `<package-or-path>`: <Description of specific change>
+- `<package-or-path>`: <Description of specific change>
+
+## Verification Results
+- [x] `pnpm typecheck` passed (0 errors)
+- [x] `pnpm lint` passed (0 warnings)
+- [x] `pnpm test` passed (all tests green)
+- [x] `pnpm build` passed (clean build)
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+## Verification Checklist
+
+- [ ] Issue context, approved plan, and user instructions are satisfied.
+- [ ] TypeScript strict mode rules are respected (`no any`, `no as`, `no !`).
+- [ ] Exported symbols include JSDoc comments.
+- [ ] UI components reside in dedicated folders with tests and stories.
+- [ ] Monorepo boundaries and relative imports are respected.
+- [ ] All four verification checks passed cleanly.
+- [ ] Target branch is set to `next`.
+- [ ] PR description includes `Resolves #<number>`.
+- [ ] Mandatory attribution line is present.
@@ -0,0 +1,136 @@
+---
+name: github-plan
+description: Analyze an issue thread, iterate on feedback, and produce or update an implementation plan for ermnvldmr.com.
+---
+
+# GitHub Issue Planning Skill (ASD-STE100 Standard)
+
+## Overview
+
+Use this skill when an issue receives the `/plan [optional instructions]` command.
+
+This skill creates or updates an implementation plan before code modification starts. All outputs must follow ASD-STE100 language constraints and repository standards.
+
+---
+
+## ASD-STE100 Writing Rules
+
+Follow these rules for all generated plans and documentation:
+
+| Rule | Limit | Approved Example | Non-Approved Example |
+| :--- | :--- | :--- | :--- |
+| **Procedural Sentences** | Max **20 words** | "Run `pnpm test`. Verify that all unit tests pass." | "You should run the pnpm test command to verify that all the unit tests pass properly without errors." |
+| **Descriptive Sentences** | Max **25 words** | "The `Button` component uses `cva` to manage style variants." | "The Button component is implemented using the cva library because it helps us manage complex style variants across different themes easily." |
+| **Voice** | **Active voice** | "The function validates the user input." | "The user input is validated by the function." |
+| **Mood and Tense** | **Present tense** and **Imperative mood** | "Click **Submit**. The form transmits the data." | "You will click submit and the form will be transmitting the data." |
+| **Noun Clusters** | Max **3 nouns** | "Theme configuration file" | "Theme variant style configuration file" |
+
+### Controlled Vocabulary Guidelines
+- Do not use conversational filler (for example: "basically", "let's dive in", "simply", "feel free to").
+- Use approved verbs: use *use* (not *utilize*), *stop* (not *terminate*), *start* (not *initiate*), *show* (not *exhibit*).
+- Use clear and literal technical terms.
+
+---
+
+## Planning Responsibilities
+
+### 1. Ingest Full Issue Context
+- Read the issue title, issue description, and all subsequent comments.
+- Identify user requirements, technical constraints, and reported symptoms.
+- Inspect relevant source files in the repository before proposing changes.
+- Read `GEMINI.md` to confirm current project conventions.
+
+### 2. Multi-Turn Plan Iteration
+- Check if an earlier implementation plan exists in the issue thread.
+- If an earlier plan exists:
+  - Do not create a plan from zero.
+  - Retain approved architectural decisions from previous turns.
+  - Apply the requested modifications or additions from the latest comment.
+  - Summarize the specific adjustments made to the previous plan.
+- If no earlier plan exists:
+  - Create a new baseline implementation plan from the issue requirements.
+
+### 3. Enforce Repository Architecture (`GEMINI.md`)
+Every proposed plan must comply with repository architecture:
+- **Build System**: Use Rsbuild and Rspack. Do not propose Vite, Webpack, or Next.js.
+- **Strict TypeScript**:
+  - Do not use `any`.
+  - Do not use type assertions (`as Type`). Use type guards or `castRef` from `@ermnvldmr/stl`.
+  - Do not use non-null assertions (`!`).
+  - Use `import type` for type-only imports.
+  - Define object shapes with `interface`, not `type` aliases.
+  - Require JSDoc comments on all exported symbols.
+- **Component Architecture** (`packages/ui`):
+  - Place components in `packages/ui/src/components/<ComponentName>/`.
+  - Provide `<ComponentName>.tsx`, `<ComponentName>.stories.tsx`, and `<ComponentName>.test.tsx`.
+  - Use `cva` for variant definitions.
+  - Merge class names with `cn(...)` from `@ermnvldmr/stl`.
+- **Accessibility & State**:
+  - Use React Aria hooks (`useButton`, `useFocusRing`, `useHover`) and Radix UI primitives.
+  - Use standard React state (`useState`, `useReducer`, `useContext`) and `react-stately`.
+  - Do not introduce external state management libraries.
+- **Monorepo Import Rules**:
+  - Use relative import paths within the same package.
+  - Do not import `@ermnvldmr/<package>` inside `<package>` itself.
+- **Protected Files**:
+  - Do not modify `.env.keys`, `pnpm-lock.yaml`, `LICENSE`, `services/docs/content/`, or `services/www/content/`.
+
+---
+
+## Output Plan Structure
+
+Format the generated plan with the following markdown template:
+
+```markdown
+### Goal
+[Describe the objective in 1-2 sentences. Keep each sentence under 25 words.]
+
+### Architecture & Technical Decisions
+- [Decision 1: Explain pattern, primitive, or component structure.]
+- [Decision 2: Explain typing or API contracts.]
+- [Decision 3: Explain state management or accessibility integration.]
+
+### File Changes
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.tsx` - [Purpose]
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.stories.tsx` - [Purpose]
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.test.tsx` - [Purpose]
+- `[MODIFY]` `packages/ui/src/index.ts` - [Export new component]
+
+### Verification Plan
+1. `pnpm typecheck` - Verify zero TypeScript compiler errors.
+2. `pnpm lint` - Verify zero ESLint warnings and errors.
+3. `pnpm test` - Run unit and integration tests.
+4. `pnpm build` - Run full workspace build.
+
+### Open Questions
+- [List open questions or ambiguities. If no open questions exist, write "None.".]
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+---
+
+## Common Traps and Solutions
+
+| Anti-Pattern | Correct Action |
+| :--- | :--- |
+| Regenerating a new plan after user feedback | Update the existing plan and highlight modified sections. |
+| Using `as Type` assertions in the proposed code | Propose explicit type guards or `castRef` helpers. |
+| Missing Storybook or Vitest files for UI components | Include `.stories.tsx` and `.test.tsx` in the file plan. |
+| Proposing external state libraries | Use React 19 primitives and `react-stately`. |
+| Omitting the attribution line | Append the mandatory disclosure line at the end. |
+
+---
+
+## Verification Checklist
+
+Before posting the plan response, verify all items:
+
+- [ ] The issue thread context and all user comments are analyzed.
+- [ ] Existing plans are updated rather than replaced from scratch.
+- [ ] Proposed code satisfies all `GEMINI.md` constraints (`strict: true`, no `any`, no `as`, no `!`).
+- [ ] All UI components include unit tests and Storybook stories.
+- [ ] All sentences follow ASD-STE100 limits (<=20 words for instructions, <=25 words for descriptions).
+- [ ] Active voice is used throughout the plan.
+- [ ] The output concludes with: `Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.`
+
@@ -1,404 +1,80 @@
 ---
 name: write-docs
-description: 'Use this to write uniform comprehensive documentation in ermnvldmr.com context, using nextra'
+description: Use when creating, updating, or refactoring technical documentation, developer guides, API references, or Hugo Hextra pages
 ---

-# HEXTRA DOCUMENTATION ARCHITECT
-
-**IDENTITY**
-You are the **Hextra Documentation Architect**, a senior technical writer and developer advocate expert in the **Hugo** static site generator and the **Hextra** theme. You possess a deep understanding of information architecture, technical pedagogy, and the specific syntax requirements of the Hextra framework.
-
-**GOAL**
-Your sole purpose is to transform raw user input (notes, code snippets, brief explanations) into **production-ready, comprehensive developer documentation**. Your output must be valid Markdown, ready to be saved directly into a Hugo `content/` directory without requiring further editing.
-
-**DEFINITION OF SUCCESS**
-A successful output is one that a developer can copy-paste, compile with Hugo, and immediately use to solve a specific problem. It is visually structured, strictly compliant with Hextra shortcodes, and devoid of fluff or hallucinated details.
-
---
-
-## 1. LANGUAGE, TONE, AND TYPOGRAPHY
-
-You must adhere to the following strict stylistic rules. There are no exceptions to "MUST" or "MUST NOT" constraints.
-
-### 1.1 Language & Localization
-
- **MUST** write in grammatically perfect **English** (or **Russian**, if explicitly requested by the prompt).
- **MUST** verify that all technical terminology matches the standard glossary of the specific domain (e.g., Hugo terms, Cloud infrastructure terms).
- **MUST** translate the entire document structure (headers, admonitions, link descriptions) when writing in a specific language. Do not mix languages unless referring to specific code entities that cannot be translated.
-
-### 1.2 Typography & Symbols
-
- **MUST** use standard Unicode typography to enhance readability.
- _Allowed:_ French quotes (`«...»`), em-dashes (`—`), en-dashes (`–`), ellipses (`…`), arrows (`→`, `←`).
-
- **MUST NOT** use Emojis (`🚀`, `⚠️`, `✅`), Kaomojis (`(o_O)`), or non-standard decorative symbols.
- _Reasoning:_ These symbols break search functionality, interfere with copy-pasting, and degrade the professional tone of the documentation.
-
- **MUST NOT** use "Title Case" for every word in headers. Capitalize the first word and proper nouns only, or follow standard sentence case rules (e.g., "Architecture of module A", not "Architecture Of Module A").
-
-### 1.3 Document Titles & Headers
-
- **MUST** ensure the document `title` (in Front Matter) is descriptive and summarizes the document's purpose.
- _Bad:_ "Settings"
- _Good:_ "Module A Configuration Settings"
-
- **MUST NOT** write a top-level H1 header (e.g., `# Title`) in the Markdown body, as Hextra automatically generates this from the Front Matter `title`.
-
- **MUST** use lower-case conjunctions in headers (and, or, the, of) unless they start the sentence.
-
-### 1.4 Tone & Audience
-
- **MUST** adopt an **authoritative and concrete** tone.
- _Bad:_ "You should probably try to click the button..."
- _Good:_ "Click the **Submit** button."
-
- **MUST** accommodate different skill levels within the same documentation ecosystem:
- Provide **Quick Start** sections for beginners (minimal theory, fast results).
- Provide **How-to Guides** and **Concepts** for experienced users (complex scenarios, architectural deep-dives).
-
- **SHOULD** maximize "Signal-to-Noise" ratio.
- Eliminate obvious statements.
- _Bad:_ "To save the file, click save. This will save your changes to the disk."
- _Good:_ "Save the file."
-
- **MUST NOT** be chatty or conversational. Avoid phrases like "Let's dive in," "In this tutorial, we will learn," or "Happy coding!"
-
-### 1.5 Content Precision
-
- **MUST** define clear steps, expected results, and precise formulations.
- **SHOULD** only comment on code examples if the logic is non-obvious. Do not explain standard syntax (e.g., do not explain what a `for` loop does in Python, unless the loop logic is unique to the business case).
- **MUST** actively prompt the user for missing materials if the input is insufficient.
- _Example:_ "I need the specific configuration parameters for Service X to complete this section. Please provide a link to the wiki or a code snippet."
-
-### 1.6 Source Fidelity (Tone Aspect)
-
- **MUST** write _only_ what is confirmed by the provided sources.
- **MUST NOT** speculate, guess, or fill in "gray areas" with "typical" or "default" values unless explicitly instructed.
- **MUST NOT** invent "Best Practices" or "Common Mistakes" sections unless the source material explicitly lists them. Your job is to document the _actual_ system, not a _hypothetical_ ideal system.
-
---
-
-## 2. SOURCE FIDELITY & DATA INTEGRITY
-
-This is the most critical directive. You are a documentation engine, not a creative writer. You must strictly adhere to the provided source material to ensure technical accuracy.
-
-### 2.1 The "Zero Hallucination" Policy (CRITICAL / MUST NOT)
-
- **MUST NOT** add "logical" assumptions, behavioral descriptions, or implementation details if they are not explicitly present in the source text or code.
- **MUST NOT** invent "Best Practices" or "Common Pitfalls" unless the source explicitly lists them.
- **MUST NOT** fabricate command-line arguments, file paths, service names, configuration parameters, or variable names. If a parameter name is missing, use a placeholder like `<variable_name>` and flag it.
-
-### 2.2 Evidence-Based Writing (MUST)
-
- **MUST** ensure every technical assertion is backed by one of the provided sources (documents, user-provided files, chat logs).
- **MUST** explicitly identify missing information. If the source material is insufficient to complete a section (e.g., a missing step in a procedure):
-
-1. Stop writing that specific section.
-2. Ask the user clarifying questions.
-3. List exactly what data is missing (e.g., "I need the default port number for Service X to complete the Configuration section.").
-
-### 2.3 Handling Conflicts
-
- **MUST** integrate materials sequentially if multiple sources are provided. Process Source A -> Normalize headers/terms -> Process Source B.
- **MUST NOT** resolve contradictions yourself. If Source A says "Port 80" and Source B says "Port 8080", you must document the discrepancy and ask the user for the "Source of Truth."
-
---
-
-## 3. FILE MANAGEMENT & DIRECTORY STRUCTURE
-
-You must structure the output to fit a standard localized Hugo project architecture.
-
-### 3.1 File Locations (MUST)
-
- **MUST** assume documentation lives in the following localized directories:
- `content/en/` (English)
- `content/ru/` (Russian)
-
- **MUST** provide output that is ready to be placed in these directories.
-
-### 3.2 Asset Management (MUST)
-
- **MUST** assume all static assets (images, videos, PDFs) are stored in the `static/` directory at the project root.
- **MUST** format links relative to the `static` root.
- _Input:_ An image named `diagram.png` stored in `static/images/`.
- _Markdown Output:_ `![Description](/images/diagram.png)` (Note the leading slash).
-
- **MUST NOT** include `static/` in the markdown link path itself (e.g., `![...](static/images/...)` is **WRONG**).
-
-### 3.3 Translation Requirements (MUST)
-
- **MUST** be capable of generating the document in both English and Russian upon request.
- **MUST** ensure the glossary terms (see Part 3) are consistent across both languages.
-
---
-
-## 4. GLOSSARY, LINKS, & CITATIONS
-
-A consistent glossary and linking strategy is mandatory for maintainable documentation.
-
-### 4.1 The Glossary Standards (MUST)
-
-The glossary is the "Source of Truth" for terminology. It resides in `(en/ru)/{project}/glossary.md`.
-
- **MUST** maintain the glossary in **Alphabetical Order**.
- **MUST** assign a Markdown anchor to every term in the glossary definition.
- _Format:_ `## Term Name {#term-key}`
- _Definition Format:_
-
-```markdown
-## Term Name {#term-key}
-
-**Term Name** - A brief definition in 1-3 sentences.
-```
-
- **MUST** link to these anchors whenever the term is first used in other documents.
- _Usage Syntax:_ `... configure the [Term Name](/glossary#term-key) settings...`
-
- **MUST** maintain the glossary in both English and Russian if the documentation is bilingual.
-
-### 4.2 Hyperlink Formatting (MUST / SHOULD)
-
- **MUST NOT** use "naked" URLs in the text.
- _Bad:_ `Check this link: https://example.com/api`
- _Bad:_ `[https://example.com/api](https://example.com/api)`
-
- **MUST** format links with the **Source Type** and **Content Description**.
- _Good:_ `[Wiki: API Deployment Guide](https://example.com/api)`
- _Good:_ `[RFC: HTTP/2 Protocol](https://tools.ietf.org/html/rfc7540)`
-
- **SHOULD** use relative paths for internal links using Hugo `ref` or standard relative markdown paths where possible.
-
-### 4.3 The "See Also" Footer (MUST)
-
-Every document MUST end with a "See Also" block containing external references and last update metadata.
-
- **Location:** Always at the very bottom of the file.
- **Format:** Use a horizontal rule (`---`) followed by bold text.
- **Content:**
- **MUST** contain only a bulleted list of Markdown links.
- **MUST NOT** contain paths to files as inline code.
- **MUST NOT** link to the current document (self-referencing) or the Glossary (redundant).
-
- **Template:**
-
-```markdown
---
-
-**See also:**
-
- [Doc: Related Component A](https://docs.example.com/comp-a)
- [Wiki: Legacy Architecture](https://wiki.example.com/arch)
-```
-
-### 4.4 Code References (MUST)
-
- **Product Code:**
- **SHOULD NOT** paste large blocks of product source code, as it becomes stale.
- **MUST** link to a specific GitHub/GitLab commit (permalink) that shows the implementation.
- _Format:_ `[GitHub: sha - Description of change](https://github.com/org/repo/blob/sha/file.go)`
-
- **Commands & Scripts:**
- **MUST** use Fenced Code Blocks (````bash`) for instructions, scripts, or conceptual examples that the user needs to copy.
-
- **Inline Code Entities:**
- **MUST** use inline code backticks for:
- Variable names (`retryCount`)
- Function names (`init()`)
- Component names (`UserProfile`)
- Literal values (`true`, `404`)
- File extensions (`.md`, `.json`)
- Filenames (`hugo.yaml`)
-
---
-
-## 5. VISUALS, UI, & HEXTRA SHORTCODES
-
-You must use Hextra's advanced features to create structured, interactive documentation. Plain Markdown is often insufficient for complex technical concepts.
-
-### 5.1 Images & Media (MUST)
-
- **Alt Text & Titles:** Every image **MUST** have alt-text and a hover title.
- _Syntax:_ `![Alt Text](./path/image.png "Hover Title" =700x)`
-
- **Sizing:**
- **Small/Medium Images:** **SHOULD** be resized using the width attribute (e.g., `=700x`) to prevent layout shift.
- **Large Images/Diagrams:** **MUST NOT** be resized if detail loss is a risk. Instead, wrap them in a **Details** shortcode (see below).
-
- **YouTube:** Use the shortcode for videos.
- _Syntax:_ `{{< youtube id="VIDEO_ID" loading="lazy" >}}`
-
- **PDFs:** Use the PDF shortcode for embeddings.
- _Syntax:_ `{{< pdf "/path/to/doc.pdf" >}}`
-
-### 5.2 UI & Text Formatting (MUST)
-
- **"Points of Attraction":** Use **Bold** for goals, key list items, important preambles, and action names.
- _Example:_ **Goal:** Set up the environment.
-
- **UI References:** Use _Italics_ for buttons, labels, window names, and screen titles.
- _Example:_ Click the _Submit_ button on the _Settings_ screen.
-
-### 5.3 Interactive Shortcodes (MUST / SHOULD)
-
-#### A. Details (Collapsible Content)
-
-Use for large screenshots, detailed logs, or deep-dive explanations that disrupt the flow.
-
-```markdown
-{{% details title="Click to reveal configuration details" closed="true" %}}
-
-1. Detailed step one...
-   ![Large Screenshot](/images/screen.png 'Settings Config')
-   {{% /details %}}
-```
-
-#### B. Tabs (Mutually Exclusive Content)
-
-Use when the user must choose _one_ path (e.g., OS specific, Language specific).
-
-```markdown
-{{< tabs >}}
-{{< tab name="JSON" >}} **JSON** content here... {{< /tab >}}
-{{< tab name="YAML" >}} **YAML** content here... {{< /tab >}}
-{{< /tabs >}}
-```
-
-#### C. Steps (Procedures)
-
-Use for sequential instructions. **MUST** use H3 (`###`) headers inside.
-
-```markdown
-{{% steps %}}
-
-### Step 1: Install
-
-Run `npm install`
-
-### Step 2: Configure
-
-Edit `config.js`
-{{% /steps %}}
-```
-
-#### D. Badges (Status/Versioning)
-
-Use to denote version availability or feature status.
-
- _Options:_ `color` (green, orange, red, blue), `icon` (sparkles, github), `style` (outline/filled).
-
-```markdown
-{{< badge content="v2.0+" color="green" >}}
-{{< badge content="Beta" color="orange" icon="sparkles" >}}
-```
-
-#### E. File Trees (Directory Structure)
-
-Use to visualize folder layouts.
-
-```markdown
-{{< filetree/container >}}
-{{< filetree/folder name="src" state="open" >}}
-{{< filetree/file name="index.js" >}}
-{{< /filetree/folder >}}
-{{< /filetree/container >}}
-```
-
-#### F. Alerts/Callouts
-
-Use GitHub-flavored alerts for emphasis.
-
-```markdown
-> [!TIP]
-> This is a helpful tip.
-
-> [!WARNING]
-> This action is irreversible.
-```
-
---
-
-## 6. DOCUMENT TYPES & TEMPLATES
-
-Do not output full-page boilerplate unless requested. Instead, apply these structural rules ("Skeletons") dynamically based on the content type.
-This is also serves as the fixed categories which should populate every project's docs: Getting Started, Guides, Concepts, Troubleshooting.
-
-### 6.1 General Skeleton (All Docs)
-
-1. **Front Matter:** `title`, `weight`, `date` (optional).
-2. **Brief:** 1-2 sentences summarizing the "What" and "Why".
-3. **Body Sections:** (See specific types below).
-4. **Glossary Tooltips:** Use `[Term](/glossary#term)` for first mentions.
-5. **Footer:** The `> [!NOTE]` "See Also" block.
-
-### 6.2 Quick Start (Beginner)
-
- **Goal:** Minimal steps to "Hello World".
- **Structure:**
-
-1. **Prerequisites:** (Brief list).
-2. **Steps:** Use `{{% steps %}}`. Keep theory to zero.
-3. **Validation:** How to check it worked.
-
-### 6.3 Procedure / Guide (Strict)
-
- **Goal:** Reproducible, audit-ready process.
- **Structure:**
-
-1. **Objective:** What is being done.
-2. **Launch Conditions:** When to start (Triggers).
-3. **Procedure:** Strict numbered steps (or `{{% steps %}}`).
-4. **Result Control:** How to verify success.
-
-### 6.4 How-to / Guide (Task-Oriented)
-
- **Goal:** Solve a specific problem.
- **Structure:**
-
-1. **Context:** Why do this?
-2. **Steps:** Detailed execution.
-3. **Notes:** Edge cases or warnings.
-
-### 6.5 Concept / Architecture (Theory)
-
- **Goal:** Explain how it works.
- **Structure:**
-
-1. **Overview:** High-level summary.
-2. **Architecture:** Mermaid diagrams or Images.
-3. **Components:** Description of parts.
-4. **Terminology:** Definitions.
-
-### 6.6 Troubleshooting (Diagnostic)
-
- **Goal:** Fix a broken state.
- **Structure:**
-
-1. **Symptoms:** Error logs, behaviors.
-2. **Diagnosis:** How to confirm the issue.
-3. **Solution:** Steps to resolve.
-
---
-
-## 7. EXECUTION PROTOCOL
-
-You are now active. Your operating loop is as follows:
-
-1. **Wait for Input:** Receive raw text, code, or a topic request.
-2. **Classify:** Determine the Document Type (Quick Start, How-to, etc.).
-3. **Validate Sources:** Check if you have enough info.
-
- _If info is missing:_ STOP and ask the user specific questions.
- _If info is contradictory:_ STOP and ask for the "Source of Truth".
-
-4. **Draft:** Generate the Hextra Markdown.
-5. **Audit:**
-
- Did I use `filename=""` in code blocks?
- Did I use Hextra shortcodes (`steps`, `tabs`) effectively?
- Are links descriptive (No naked URLs)?
- Is the "See Also" footer present?
- Did I avoid hallucinations?
-
-6. **Output:** Present the final Markdown code block.
-
-**Awaiting user input...** (Please provide the topic, raw notes, API details, or specific file fragments you want converted into documentation).
+# Write Technical Documentation (ASD-STE100 & Hextra Standard)
+
+## Overview
+Technical documentation must be unambiguous, direct, and easy to translate. This skill enforces **ASD-STE100** (Simplified Technical English) language constraints combined with **Hextra/Hugo** static site architecture.
+
+Core principle: Write with controlled vocabulary, strict sentence limits, active voice, and zero fluff.
+
+## ASD-STE100 Language Rules
+
+### 1. Grammar & Sentence Constraints
+
+| Rule | Constraint | Example |
+| :--- | :--- | :--- |
+| **Procedural Sentence Length** | Maximum **20 words** per sentence for steps, commands, or instructions. | ✅ "Run `hugo server`. Open the local preview link." (10 words)<br>❌ "To start the local preview server, run the hugo server command and then open the generated localhost URL in your browser." (22 words) |
+| **Descriptive Sentence Length** | Maximum **25 words** per sentence for explanations or concepts. | ✅ "Hugo compiles markdown files into static HTML. The Hextra theme provides search and layout components." (15 words)<br>❌ "Hugo is an exceptionally fast static site generator that compiles markdown files into static HTML while the Hextra theme adds modern documentation layouts and search capabilities." (26 words) |
+| **Voice** | **Active voice** only. Avoid passive voice. | ✅ "The worker node drops expired messages."<br>❌ "Expired messages are dropped by the worker node." |
+| **Tense & Mood** | Use **present tense** for descriptions and **imperative mood** for steps. | ✅ "Click **Save**. The server restarts."<br>❌ "You will click Save, after which the server will be restarting." |
+| **Noun Clusters** | Maximum **3 sequential nouns**. Unpack longer clusters using prepositions. | ✅ "Index file for site search" (4 words, 2 nouns)<br>❌ "Site search index configuration file" (5 sequential nouns) |
+
+### 2. Controlled Vocabulary
+- **One approved meaning per word**: Use words in only one part of speech (e.g. *close* as verb, never adjective; use *near* or *adjacent* instead).
+- **Eliminate conversational filler**: Do NOT use "let's dive in", "basically", "simply", "easily", "in order to", "feel free to".
+- **Standard verbs**: Use *use* (not *utilize*), *stop* (not *terminate*), *start* (not *initiate*), *show* (not *exhibit*).
+- **No metaphors or jargon**: Write explicit, literal statements.
+
+## Hextra & Hugo Formatting
+
+### 1. Document Structure & Front Matter
+- **Front Matter**: Always include `title` and `description`.
+- **Top-level Header**: **MUST NOT** include `# Title` in the markdown body. Hextra automatically renders H1 from front matter `title`.
+- **Admonitions**: Use GitHub alerts (`> [!NOTE]`, `> [!TIP]`, `> [!WARNING]`, `> [!CAUTION]`).
+
+### 2. Hextra Shortcodes
+- **Steps**: Use `{{% steps %}}` with `### Step` headers for sequential procedures.
+- **Tabs**: Use `{{< tabs >}}` for alternative paths (e.g. OS, languages).
+- **Details**: Use `{{% details title="..." %}}` for large code dumps, raw logs, or edge cases.
+
+### 3. Hyperlinks & Code References
+- **No naked URLs**: Use `[Source Type: Description](URL)` (e.g. `[RFC: HTTP/2 Specification](https://tools.ietf.org/html/rfc7540)`).
+- **Inline code**: Use backticks for filenames (`hugo.yaml`), functions (`init()`), variables (`port`), and commands.
+
+## Document Templates (Skeletons)
+
+### Quick Start
+1. **Prerequisites**: Bullet list.
+2. **Steps**: Use `{{% steps %}}`. Keep steps under 20 words each.
+3. **Verification**: Direct command or test to check success.
+
+### Procedure / How-to
+1. **Objective**: 1 sentence explanation (<25 words).
+2. **Procedure**: Numbered steps or `{{% steps %}}`.
+3. **Expected Result**: Direct verification.
+
+### Troubleshooting
+1. **Symptom**: Concrete error message or behavior.
+2. **Cause**: Direct explanation of root failure.
+3. **Solution**: Imperative repair steps.
+
+## Red Flags & Rationalization Table
+
+| Excuse / Rationalization | Reality |
+| :--- | :--- |
+| "A longer sentence makes it flow better." | Long sentences cause translation errors and slow reading. Split into two sentences under 20/25 words. |
+| "Passive voice sounds more formal." | Passive voice creates ambiguity about who or what performs the action. Use active voice. |
+| "The noun cluster is standard industry jargon." | 4+ sequential nouns confuse non-native speakers. Unpack with prepositions. |
+| "I added H1 because markdown needs a main title." | Hextra generates H1 from Front Matter. Duplicate H1 breaks page layout. |
+
+## Verification Checklist
+- [ ] Procedural sentences are **20 words or fewer**.
+- [ ] Descriptive sentences are **25 words or fewer**.
+- [ ] Every step uses **imperative active voice**.
+- [ ] Noun clusters contain **3 or fewer sequential nouns**.
+- [ ] No conversational filler ("basically", "let's dive in").
+- [ ] No top-level `# H1` header in markdown body.
+- [ ] All links have descriptive text and source types.
@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2018 GitHub, Inc. and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
@@ -0,0 +1,8 @@
+{
+  "name": "ci-action-gitea-download-artifact",
+  "source": "https://github.com/christopherhx/gitea-download-artifact.git",
+  "requested_ref": "v4",
+  "commit": "75635f32b4c1c41c4b3d64e8f85210112ed4c9c7",
+  "path": "/private/tmp/gitea-migration-20261105/mirrors/ci-action-gitea-download-artifact.git",
+  "destination": "https://git.ermnvldmr.com/deytenit/ci-action-gitea-download-artifact"
+}
@@ -0,0 +1,40 @@
+name: 'Download a Build Artifact'
+description: 'Download a build artifact that was previously uploaded in the workflow by the upload-artifact action'
+author: 'GitHub'
+inputs:
+  name:
+    description: 'Name of the artifact to download. If unspecified, all artifacts for the run are downloaded.'
+    required: false
+  path:
+    description: 'Destination path. Supports basic tilde expansion. Defaults to $GITHUB_WORKSPACE'
+    required: false
+  pattern:
+    description: 'A glob pattern matching the artifacts that should be downloaded. Ignored if name is specified.'
+    required: false
+  merge-multiple:
+    description: 'When multiple artifacts are matched, this changes the behavior of the destination directories.
+      If true, the downloaded artifacts will be in the same directory specified by path.
+      If false, the downloaded artifacts will be extracted into individual named directories within the specified path.'
+    required: false
+    default: 'false'
+  github-token:
+    description: 'The GitHub token used to authenticate with the GitHub API.
+      This is required when downloading artifacts from a different repository or from a different workflow run.
+      If this is not specified, the action will attempt to download artifacts from the current repository and the current workflow run.'
+    required: false
+  repository:
+    description: 'The repository owner and the repository name joined together by "/".
+      If github-token is specified, this is the repository that artifacts will be downloaded from.'
+    required: false
+    default: ${{ github.repository }}
+  run-id:
+    description: 'The id of the workflow run where the desired download artifact was uploaded from.
+      If github-token is specified, this is the run that artifacts will be downloaded from.'
+    required: false
+    default: ${{ github.run_id }}
+outputs:
+  download-path:
+    description: 'Path of artifact download'
+runs:
+  using: 'node20'
+  main: 'dist/index.js'
@@ -0,0 +1,47 @@
+{
+  "name": "download-artifact",
+  "version": "4.0.1",
+  "description": "Download an Actions Artifact from a workflow run",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "release": "ncc build src/download-artifact.ts && git add -f dist/",
+    "check-all": "concurrently \"npm:format-check\" \"npm:lint\" \"npm:build\"",
+    "format": "prettier --write **/*.ts",
+    "format-check": "prettier --check **/*.ts",
+    "lint": "eslint **/*.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/download-artifact.git"
+  },
+  "keywords": [
+    "Actions",
+    "GitHub",
+    "Artifacts",
+    "Download"
+  ],
+  "author": "GitHub",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/actions/download-artifact/issues"
+  },
+  "homepage": "https://github.com/actions/download-artifact#readme",
+  "dependencies": {
+    "@actions/artifact": "^2.0.1",
+    "@actions/core": "^1.10.0",
+    "@actions/github": "^5.1.1",
+    "minimatch": "^9.0.3"
+  },
+  "devDependencies": {
+    "@types/node": "^12.12.6",
+    "@typescript-eslint/eslint-plugin": "^6.14.0",
+    "@vercel/ncc": "^0.33.4",
+    "concurrently": "^5.2.0",
+    "eslint": "^8.55.0",
+    "eslint-plugin-github": "^4.10.1",
+    "eslint-plugin-prettier": "^5.0.1",
+    "prettier": "^3.1.1",
+    "typescript": "^5.3.3"
+  }
+}
@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2018 GitHub, Inc. and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
@@ -0,0 +1,8 @@
+{
+  "name": "ci-action-gitea-upload-artifact",
+  "source": "https://github.com/christopherhx/gitea-upload-artifact.git",
+  "requested_ref": "v4",
+  "commit": "81f940d004763f986ba3582c007fd842dd5cb0d7",
+  "path": "/private/tmp/gitea-migration-20261105/mirrors/ci-action-gitea-upload-artifact.git",
+  "destination": "https://git.ermnvldmr.com/deytenit/ci-action-gitea-upload-artifact"
+}
@@ -0,0 +1,61 @@
+name: 'Upload a Build Artifact'
+description: 'Upload a build artifact that can be used by subsequent workflow steps'
+author: 'GitHub'
+inputs:
+  name:
+    description: 'Artifact name'
+    default: 'artifact'
+  path:
+    description: 'A file, directory or wildcard pattern that describes what to upload'
+    required: true
+  if-no-files-found:
+    description: >
+      The desired behavior if no files are found using the provided path.
+
+      Available Options:
+        warn: Output a warning but do not fail the action
+        error: Fail the action with an error message
+        ignore: Do not output any warnings or errors, the action does not fail
+    default: 'warn'
+  retention-days:
+    description: >
+      Duration after which artifact will expire in days. 0 means using default retention.
+
+      Minimum 1 day.
+      Maximum 90 days unless changed from the repository settings page.
+  compression-level:
+    description: >
+      The level of compression for Zlib to be applied to the artifact archive.
+      The value can range from 0 to 9:
+      - 0: No compression
+      - 1: Best speed
+      - 6: Default compression (same as GNU Gzip)
+      - 9: Best compression
+      Higher levels will result in better compression, but will take longer to complete.
+      For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+    default: '6'
+  overwrite:
+    description: >
+      If true, an artifact with a matching name will be deleted before a new one is uploaded.
+      If false, the action will fail if an artifact for the given name already exists.
+      Does not fail if the artifact does not exist.
+    default: 'false'
+
+outputs:
+  artifact-id:
+    description: >
+      A unique identifier for the artifact that was just uploaded. Empty if the artifact upload failed.
+
+      This ID can be used as input to other APIs to download, delete or get more information about an artifact: https://docs.github.com/en/rest/actions/artifacts
+  artifact-url:
+    description: >
+      A download URL for the artifact that was just uploaded. Empty if the artifact upload failed.
+
+      This download URL only works for requests Authenticated with GitHub. Anonymous downloads will be prompted to first login. 
+      If an anonymous download URL is needed than a short time restricted URL can be generated using the download artifact API: https://docs.github.com/en/rest/actions/artifacts#download-an-artifact    
+
+      This URL will be valid for as long as the artifact exists and the workflow run and repository exists. Once an artifact has expired this URL will no longer work.
+      Common uses cases for such a download URL can be adding download links to artifacts in descriptions or comments on pull requests or issues.
+runs:
+  using: 'node20'
+  main: 'dist/index.js'
@@ -0,0 +1,54 @@
+{
+  "name": "upload-artifact",
+  "version": "4.2.0",
+  "description": "Upload an Actions Artifact in a workflow run",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "release": "ncc build src/upload-artifact.ts && git add -f dist/index.js",
+    "check-all": "concurrently \"npm:format-check\" \"npm:lint\" \"npm:test\" \"npm:build\"",
+    "format": "prettier --write **/*.ts",
+    "format-check": "prettier --check **/*.ts",
+    "lint": "eslint **/*.ts",
+    "test": "jest --testTimeout 10000"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/upload-artifact.git"
+  },
+  "keywords": [
+    "Actions",
+    "GitHub",
+    "Artifacts",
+    "Upload"
+  ],
+  "author": "GitHub",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/actions/upload-artifact/issues"
+  },
+  "homepage": "https://github.com/actions/upload-artifact#readme",
+  "dependencies": {
+    "@actions/artifact": "^2.1.0",
+    "@actions/core": "^1.10.0",
+    "@actions/github": "^6.0.0",
+    "@actions/glob": "^0.3.0",
+    "@actions/io": "^1.1.2"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.2.5",
+    "@types/node": "^18.11.18",
+    "@typescript-eslint/parser": "^5.48.0",
+    "@vercel/ncc": "^0.36.0",
+    "concurrently": "^7.6.0",
+    "eslint": "^8.31.0",
+    "eslint-plugin-github": "^4.6.0",
+    "eslint-plugin-jest": "^27.2.0",
+    "glob": "^8.0.3",
+    "jest": "^29.3.1",
+    "jest-circus": "^29.3.1",
+    "prettier": "^2.8.1",
+    "ts-jest": "^29.0.3",
+    "typescript": "^4.9.4"
+  }
+}
@@ -0,0 +1,319 @@
+name: gemini - manual
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+concurrency:
+  group: agent-issue-${{ github.event.issue.number || github.event.pull_request.number }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  actions: write
+
+jobs:
+  agent-dispatch:
+    name: Agent / Dispatch
+    if: >
+      (github.event.comment.author_association == 'OWNER' ||
+       github.event.comment.author_association == 'MEMBER' ||
+       github.event.comment.author_association == 'COLLABORATOR') &&
+      (contains(github.event.comment.body, '/plan') ||
+       contains(github.event.comment.body, '/implement') ||
+       contains(github.event.comment.body, '/fix'))
+    runs-on: [self-hosted, eliza]
+    container:
+      image: node:20-bookworm
+      options: --add-host host.docker.internal:host-gateway
+    env:
+      HTTP_PROXY: http://host.docker.internal:1080
+      HTTPS_PROXY: http://host.docker.internal:1080
+      ALL_PROXY: http://host.docker.internal:1080
+      NO_PROXY: localhost,127.0.0.1
+    timeout-minutes: 30
+
+    steps:
+      - name: Verify Collaborator Authorization
+        id: auth-check
+        run: |
+          AUTHOR_ASSOC="${{ github.event.comment.author_association }}"
+          echo "Author association: $AUTHOR_ASSOC"
+          if [[ "$AUTHOR_ASSOC" != "OWNER" && "$AUTHOR_ASSOC" != "MEMBER" && "$AUTHOR_ASSOC" != "COLLABORATOR" ]]; then
+            echo "::error::Unauthorized trigger by user with association '$AUTHOR_ASSOC'."
+            exit 1
+          fi
+
+      - name: Ensure GitHub CLI is Installed
+        run: |
+          if ! command -v gh &> /dev/null; then
+            echo "Installing GitHub CLI..."
+            curl -fsSL https://github.com/cli/cli/releases/download/v2.67.0/gh_2.67.0_linux_amd64.tar.gz | tar -xz -C /usr/local --strip-components=1
+          fi
+
+      - name: Acknowledge Command (Add Eyes Reaction)
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" -f content=eyes || true
+
+      - name: Checkout Codebase
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.12.3
+
+      - name: Setup Node.js with pnpm cache
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      - name: Install Dependencies & Build Workspace Packages
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm build:deps
+
+      - name: Restore Agent Conversation Context
+        uses: actions/cache@v4
+        id: agent-context-cache
+        with:
+          path: |
+            ~/.gemini/antigravity-cli/conversations
+            ~/.gemini/antigravity-cli/brain
+          key: agent-context-issue-${{ github.event.issue.number }}-${{ github.run_id }}
+          restore-keys: |
+            agent-context-issue-${{ github.event.issue.number }}-
+
+      - name: Setup Antigravity CLI & Credentials
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          AGY_AUTH_TOKEN: ${{ secrets.AGY_AUTH_TOKEN }}
+        run: |
+          # 1. Download official Antigravity CLI binary from google-antigravity/antigravity-cli
+          mkdir -p "$HOME/.local/bin"
+          if ! command -v agy &> /dev/null; then
+            echo "Fetching Antigravity CLI from google-antigravity/antigravity-cli..."
+            gh release download --repo google-antigravity/antigravity-cli -p "agy_cli_linux_x64.tar.gz" -O - | tar -xz -C "$HOME/.local/bin"
+            if [ -f "$HOME/.local/bin/antigravity" ] && [ ! -f "$HOME/.local/bin/agy" ]; then
+              mv "$HOME/.local/bin/antigravity" "$HOME/.local/bin/agy"
+            fi
+            ln -sf "$HOME/.local/bin/agy" "$HOME/.local/bin/antigravity"
+            chmod +x "$HOME/.local/bin/agy" "$HOME/.local/bin/antigravity"
+          fi
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+          echo "$HOME/.gemini/antigravity-cli/bin" >> $GITHUB_PATH
+          export PATH="$HOME/.local/bin:$HOME/.gemini/antigravity-cli/bin:$PATH"
+
+          # 2. Patch location eligibility check (open-antigravity-patcher CLI_GATE_X64)
+          node -e '
+            const fs = require("fs");
+            const file = process.env.HOME + "/.local/bin/agy";
+            if (!fs.existsSync(file)) process.exit(0);
+            const buf = fs.readFileSync(file);
+            let count = 0;
+            for (let i = 0; i < buf.length - 18; i++) {
+              if (buf[i] === 0x48 && buf[i+1] === 0x85 && buf[i+2] === 0xc0 && buf[i+3] === 0x0f && buf[i+4] === 0x84 &&
+                  buf[i+9] === 0x80 && buf[i+10] === 0x78 && buf[i+11] === 0x08 && buf[i+12] === 0x00 &&
+                  buf[i+13] === 0x0f && buf[i+14] === 0x85) {
+                buf[i+9] = 0x48; buf[i+10] = 0x85; buf[i+11] = 0xc0; buf[i+12] = 0x90;
+                count++;
+              }
+            }
+            if (count > 0) {
+              fs.writeFileSync(file, buf);
+              console.log(`Applied open-antigravity-patcher: ${count} gates patched.`);
+            } else {
+              console.log("Antigravity CLI is already patched or signature not found.");
+            }
+          '
+
+          # 3. Inject OAuth Token
+          mkdir -p ~/.gemini/antigravity-cli
+          if [ -n "$AGY_AUTH_TOKEN" ]; then
+            if echo "$AGY_AUTH_TOKEN" | base64 --decode >/dev/null 2>&1; then
+              echo "$AGY_AUTH_TOKEN" | base64 --decode > ~/.gemini/antigravity-cli/antigravity-oauth-token
+            else
+              echo "$AGY_AUTH_TOKEN" > ~/.gemini/antigravity-cli/antigravity-oauth-token
+            fi
+            chmod 600 ~/.gemini/antigravity-cli/antigravity-oauth-token
+          else
+            echo "::warning::AGY_AUTH_TOKEN secret is not set."
+          fi
+
+      - name: Configure Git Bot Identity
+        run: |
+          git config --global user.name "Adam Jensen [bot]"
+          git config --global user.email "adam@ermnvldmr.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      # --- COMMAND: /plan ---
+      - name: Handle /plan (Issue Planning)
+        if: contains(github.event.comment.body, '/plan') && github.event.issue.pull_request == null
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          echo "Generating plan for Issue #${ISSUE_NUMBER}..."
+          ISSUE_DATA=$(gh issue view "$ISSUE_NUMBER" --comments --json title,body,comments)
+
+          CONTINUE_FLAG=""
+          if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+            CONTINUE_FLAG="--continue"
+          fi
+
+          PROMPT="You are operating via GitHub Actions in non-interactive headless mode on Issue #${ISSUE_NUMBER}.\n\nIssue Context:\n${ISSUE_DATA}\n\nLatest instruction:\n${COMMENT_BODY}\n\nPlease generate/update a detailed technical implementation plan adhering to project GEMINI.md guidelines."
+
+          PLAN_OUTPUT=$(agy $CONTINUE_FLAG --mode plan --dangerously-skip-permissions --print-timeout 20m -p "$PROMPT" || echo "Agent encountered an error generating the plan.")
+
+          DISCLOSURE="\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          gh issue comment "$ISSUE_NUMBER" --body "${PLAN_OUTPUT}${DISCLOSURE}"
+
+      # --- COMMAND: /implement ---
+      - name: Handle /implement (Issue Implementation & PR)
+        if: contains(github.event.comment.body, '/implement') && github.event.issue.pull_request == null
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          BRANCH_NAME="agent/issue-${ISSUE_NUMBER}"
+          git checkout -b "$BRANCH_NAME"
+
+          ISSUE_DATA=$(gh issue view "$ISSUE_NUMBER" --comments --json title,body,comments)
+
+          CONTINUE_FLAG=""
+          if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+            CONTINUE_FLAG="--continue"
+          fi
+
+          PROMPT="You are operating via GitHub Actions in non-interactive headless mode to implement Issue #${ISSUE_NUMBER}.\n\nContext:\n${ISSUE_DATA}\n\nLatest instruction:\n${COMMENT_BODY}\n\nTask: Inspect relevant files, implement the necessary code changes directly in the workspace adhering to GEMINI.md rules, and verify them. Do not exit or stop before applying edits to the source code."
+          agy $CONTINUE_FLAG --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+          echo "Running repository verification gates..."
+          pnpm typecheck
+          pnpm lint
+          pnpm test
+
+          ISSUE_TITLE=$(gh issue view "$ISSUE_NUMBER" --json title -q .title)
+          git add -A
+          if git diff --staged --quiet; then
+            echo "No changes produced by agent."
+            gh issue comment "$ISSUE_NUMBER" --body "No changes were produced for implementation.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+            exit 0
+          fi
+
+          git commit -m "feat: implement issue #${ISSUE_NUMBER} (${ISSUE_TITLE})"
+          git push -u origin "$BRANCH_NAME" --force
+
+          PR_BODY="Resolves #${ISSUE_NUMBER}\n\nAutomated implementation generated via \`/implement\`.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          gh pr create \
+            --title "feat: ${ISSUE_TITLE}" \
+            --body "$PR_BODY" \
+            --base next \
+            --head "$BRANCH_NAME"
+
+      # --- COMMAND: /fix ---
+      - name: Handle /fix (PR Review Adjustments & CI Failure Debugging)
+        if: contains(github.event.comment.body, '/fix')
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_OR_PR_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          IS_PR="${{ github.event.issue.pull_request != null }}"
+          if [ "$IS_PR" = "true" ]; then
+            # Verify PR is not from an untrusted cross-repository fork
+            IS_CROSS_REPO=$(gh pr view "$ISSUE_OR_PR_NUMBER" --json isCrossRepository -q .isCrossRepository)
+            if [ "$IS_CROSS_REPO" = "true" ]; then
+              echo "::error::Cross-repository fork PRs cannot be automatically processed in privileged context."
+              exit 1
+            fi
+
+            gh pr checkout "$ISSUE_OR_PR_NUMBER"
+            BRANCH_NAME=$(git branch --show-current)
+            PR_DIFF=$(gh pr diff "$ISSUE_OR_PR_NUMBER" || true)
+
+            FAILED_RUN_ID=$(gh run list --branch "$BRANCH_NAME" --status failure --limit 1 --json databaseId -q '.[0].databaseId' || true)
+            CI_LOGS=""
+            if [ -n "$FAILED_RUN_ID" ] && [ "$FAILED_RUN_ID" != "null" ]; then
+              echo "Found failed CI run: #$FAILED_RUN_ID. Fetching failure logs..."
+              CI_LOGS=$(gh run view "$FAILED_RUN_ID" --log-failed | tail -n 200 || true)
+            fi
+
+            CONTINUE_FLAG=""
+            if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+              CONTINUE_FLAG="--continue"
+            fi
+
+            PROMPT="You are operating via GitHub Actions in non-interactive headless mode to fix/adjust PR #${ISSUE_OR_PR_NUMBER} on branch ${BRANCH_NAME}.\n\nFeedback / Comment:\n${COMMENT_BODY}\n\nPR Diff:\n${PR_DIFF}\n\nFailed CI Logs (if any):\n${CI_LOGS}\n\nTask: Apply the necessary fixes directly to the files, ensuring all lint, typecheck, and test checks pass. Do not exit without applying the changes."
+            agy $CONTINUE_FLAG --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+            echo "Running repository verification gates..."
+            pnpm typecheck
+            pnpm lint
+            pnpm test
+
+            git add -A
+            if git diff --staged --quiet; then
+              echo "No additional changes were needed."
+              gh pr comment "$ISSUE_OR_PR_NUMBER" --body "Analyzed the request; no additional changes were needed.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+              exit 0
+            fi
+
+            git commit -m "fix: apply review adjustments and CI fixes"
+            git push origin "$BRANCH_NAME"
+
+            gh pr comment "$ISSUE_OR_PR_NUMBER" --body "Applied adjustments and verified build/test suite.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          else
+            echo "Handling /fix on Issue #${ISSUE_OR_PR_NUMBER}..."
+            BRANCH_NAME="agent/fix-issue-${ISSUE_OR_PR_NUMBER}"
+            git checkout -b "$BRANCH_NAME"
+
+            ISSUE_DATA=$(gh issue view "$ISSUE_OR_PR_NUMBER" --comments --json title,body,comments)
+            PROMPT="You are operating via GitHub Actions in non-interactive headless mode to fix issue #${ISSUE_OR_PR_NUMBER}.\n\nContext:\n${ISSUE_DATA}\n\nInstruction:\n${COMMENT_BODY}\n\nTask: Apply the necessary fixes directly to the files adhering to GEMINI.md rules."
+            agy --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+            pnpm typecheck
+            pnpm lint
+            pnpm test
+
+            git add -A
+            git commit -m "fix: resolve issue #${ISSUE_OR_PR_NUMBER}"
+            git push -u origin "$BRANCH_NAME" --force
+
+            gh pr create \
+              --title "fix: resolve issue #${ISSUE_OR_PR_NUMBER}" \
+              --body "Resolves #${ISSUE_OR_PR_NUMBER}\n\nFix applied via \`/fix\`.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*" \
+              --base next \
+              --head "$BRANCH_NAME"
+          fi
+
+      - name: Complete Command (Add Rocket Reaction)
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" -f content=rocket || true
+
+      - name: Report Failure on Comment
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh issue comment "$ISSUE_NUMBER" --body "⚠️ Workflow failed during execution. View run logs: [Action Run #${{ github.run_id }}](${RUN_URL})\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*" || true
@@ -0,0 +1 @@
+[git.ermnvldmr.com]:22222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXcvf3Lds3AKfGHGh00IWR9tSRbBBqrV/CC6JBGmcrD
@@ -0,0 +1,87 @@
+import hashlib
+import json
+import os
+import platform
+import subprocess
+import sys
+import tarfile
+import tempfile
+import urllib.error
+import urllib.parse
+import urllib.request
+import zipfile
+from pathlib import Path
+
+SERVER='https://git.ermnvldmr.com'
+
+
+def eligible(run, repository, current_run):
+    if run.get('repository',{}).get('full_name')!=repository:
+        return False
+    if str(run.get('id'))==current_run:
+        return True
+    return run.get('head_branch')=='next' and run.get('event') in ('push','workflow_dispatch') and run.get('status')=='completed' and run.get('conclusion')=='success'
+
+
+def request(url):
+    if not url.startswith(SERVER+'/'):
+        raise ValueError('Unexpected cache artifact host')
+    class LocalRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, req, fp, code, msg, headers, newurl):
+            if not newurl.startswith(SERVER+'/'):
+                raise ValueError('Unexpected cache storage host')
+            return super().redirect_request(req,fp,code,msg,headers,newurl)
+    req=urllib.request.Request(url,headers={'Authorization':'token '+os.environ['CACHE_TOKEN']})
+    return urllib.request.build_opener(LocalRedirect).open(req,timeout=60)
+
+
+def api(path):
+    with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+path) as response:
+        return json.load(response)
+
+
+def main():
+    store=Path(subprocess.check_output(['pnpm','store','path','--silent'],text=True).strip())
+    archive=Path('.ci/pnpm-store.tar')
+    if sys.argv[1]=='pack':
+        archive.parent.mkdir(exist_ok=True)
+        store.mkdir(parents=True,exist_ok=True)
+        with tarfile.open(archive,'w') as target:target.add(store,arcname='.')
+        return
+    versions=subprocess.check_output(['node','--version'],text=True).strip()+'-'+subprocess.check_output(['pnpm','--version'],text=True).strip()
+    key='pnpm-'+platform.system().lower()+'-'+platform.machine()+'-'+versions+'-'+hashlib.sha256(Path('pnpm-lock.yaml').read_bytes()).hexdigest()
+    with open(os.environ['GITHUB_OUTPUT'],'a') as output:output.write('key='+key+'\n')
+    try:
+        artifacts=api('/actions/artifacts?name='+urllib.parse.quote(key))['artifacts']
+        artifacts.sort(key=lambda a:a['id'],reverse=True)
+        for artifact in artifacts:
+            if artifact.get('expired',True) or artifact.get('name')!=key:
+                continue
+            run_id=artifact.get('workflow_run',{}).get('id')
+            if not run_id:
+                continue
+            run=api('/actions/runs/'+str(run_id))
+            if not eligible(run,os.environ['GITHUB_REPOSITORY'],os.environ['GITHUB_RUN_ID']):
+                continue
+            with tempfile.TemporaryDirectory(prefix='pnpm-artifact-cache-') as directory:
+                downloaded=Path(directory)/'cache.zip'
+                with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+'/actions/artifacts/'+str(artifact['id'])+'/zip') as response,downloaded.open('wb') as target:
+                    while chunk:=response.read(1048576):target.write(chunk)
+                with zipfile.ZipFile(downloaded) as zipped:
+                    members=[name for name in zipped.namelist() if name.rsplit('/',1)[-1]=='pnpm-store.tar']
+                    if len(members)!=1:
+                        raise ValueError('Invalid cache archive')
+                    packed=Path(directory)/'store.tar'
+                    with zipped.open(members[0]) as source,packed.open('wb') as target:
+                        while chunk:=source.read(1048576):target.write(chunk)
+                store.mkdir(parents=True,exist_ok=True)
+                with tarfile.open(packed) as tar:tar.extractall(store,filter='data')
+            print('Restored repository-scoped pnpm cache artifact')
+            return
+    except (urllib.error.HTTPError,urllib.error.URLError,ValueError,tarfile.TarError,zipfile.BadZipFile):
+        print('Cache unavailable; dependencies will be fetched normally')
+        return
+    print('No eligible cache artifact; dependencies will be fetched normally')
+
+
+if __name__=='__main__':main()
@@ -0,0 +1,64 @@
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+def lines(value):
+    return [line.strip() for line in value.splitlines() if line.strip()]
+
+
+def output(name, value):
+    with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
+        stream.write(f'{name}<<GITEA_VALUE\n{value}\nGITEA_VALUE\n')
+
+
+def metadata(images, rules, sha):
+    result = []
+    for rule in lines(rules):
+        fields = dict(part.split('=', 1) for part in rule.split(',') if '=' in part)
+        if fields.get('enable', 'true').lower() == 'false':
+            continue
+        kind = fields.get('type')
+        if kind == 'sha':
+            tag = 'sha-' + sha[:7]
+        elif kind == 'raw':
+            tag = fields['value']
+        else:
+            raise ValueError('Unsupported metadata rule')
+        if not re.fullmatch(r'[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}', tag):
+            raise ValueError('Invalid image tag')
+        result.extend(image.lower() + ':' + tag for image in lines(images))
+    return result
+
+
+def main():
+    mode = sys.argv[1]
+    if mode == 'login':
+        subprocess.run(['docker', 'login', os.environ['REGISTRY'], '--username', os.environ['REGISTRY_USER'], '--password-stdin'], input=os.environ['REGISTRY_TOKEN'], text=True, check=True)
+    elif mode == 'metadata':
+        output('tags', '\n'.join(metadata(os.environ['IMAGES'], os.environ['TAG_RULES'], os.environ['SOURCE_SHA'])))
+        output('labels', 'org.opencontainers.image.revision=' + os.environ['SOURCE_SHA'])
+    elif mode == 'build':
+        command = ['docker', 'buildx', 'build', '--metadata-file', '/tmp/image-metadata.json']
+        for env, flag in [('TAGS', '--tag'), ('LABELS', '--label'), ('BUILD_ARGS', '--build-arg')]:
+            for value in lines(os.environ.get(env, '')):
+                command.extend([flag, value])
+        command += ['--label', 'org.opencontainers.image.revision=' + os.environ['SOURCE_SHA'], '--label', 'com.ermnvldmr.ci.run=' + os.environ['RUN_ID']]
+        if os.environ.get('PLATFORMS'):
+            command += ['--platform', os.environ['PLATFORMS']]
+        if os.environ.get('DOCKERFILE'):
+            command += ['--file', os.environ['DOCKERFILE']]
+        if os.environ.get('PUSH', 'false').lower() == 'true':
+            command.append('--push')
+        command.append(os.environ.get('CONTEXT', '.'))
+        subprocess.run(command, check=True)
+        output('digest', json.loads(Path('/tmp/image-metadata.json').read_text())['containerimage.digest'])
+    else:
+        raise ValueError('Unknown docker operation')
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,25 @@
+import os
+import re
+import shlex
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+def main():
+    ref=sys.argv[1]
+    if ref not in ('HEAD:next','trunk') and not re.fullmatch(r'refs/tags/[A-Za-z0-9][A-Za-z0-9._-]*',ref):
+        raise ValueError('Unexpected publication ref')
+    repository=os.environ['GITHUB_REPOSITORY']
+    if not re.fullmatch(r'deytenit/[A-Za-z0-9_.-]+',repository):
+        raise ValueError('Unexpected repository owner')
+    with tempfile.TemporaryDirectory(prefix='gitea-write-key-') as directory:
+        key=Path(directory)/'key';key.write_text(os.environ['GIT_WRITE_KEY']);key.chmod(0o600)
+        known=Path(__file__).resolve().parent.parent/'known_hosts'
+        env=dict(os.environ);env.pop('GIT_WRITE_KEY',None)
+        env['GIT_SSH_COMMAND']=shlex.join(['ssh','-T','-i',str(key),'-o','IdentitiesOnly=yes','-o','StrictHostKeyChecking=yes','-o','HostKeyAlgorithms=ssh-ed25519','-o','UserKnownHostsFile='+str(known)])
+        subprocess.run(['git','push','ssh://git@git.ermnvldmr.com:22222/'+repository+'.git',ref],env=env,check=True)
+
+
+if __name__=='__main__':main()
@@ -0,0 +1,113 @@
+import json
+import base64
+import io
+import zipfile
+import os
+import re
+import subprocess
+import urllib.request
+
+SERVER = 'https://git.ermnvldmr.com'
+REPO = 'deytenit/ermnvldmr.com'
+IMAGE = SERVER.removeprefix('https://') + '/' + REPO + '/www'
+
+
+def validate_input(sha, digest, run_id):
+    if not re.fullmatch(r'[0-9a-f]{40}', sha):
+        raise ValueError('Full source SHA required')
+    if not re.fullmatch(r'sha256:[0-9a-f]{64}', digest):
+        raise ValueError('OCI sha256 digest required')
+    if not re.fullmatch(r'[1-9][0-9]*', run_id):
+        raise ValueError('Numeric build run ID required')
+
+
+def validate_run(run, sha):
+    expected = {'head_sha': sha, 'head_branch': 'next', 'status': 'completed', 'conclusion': 'success'}
+    if any(run.get(key) != value for key, value in expected.items()):
+        raise ValueError('Build did not succeed for this next commit')
+    if run.get('repository', {}).get('full_name') != REPO or (run.get('head_repository') and run['head_repository'].get('full_name') != REPO):
+        raise ValueError('Build source repository mismatch')
+    if run.get('path') != 'services-www-next-required.yml@refs/heads/next':
+        raise ValueError('Wrong build workflow')
+    if run.get('event') not in ('push', 'workflow_dispatch'):
+        raise ValueError('Untrusted build event')
+
+
+def api(path):
+    req = urllib.request.Request(SERVER + '/api/v1/repos/' + REPO + path, headers={'Authorization': 'token ' + os.environ['PROVENANCE_TOKEN']})
+    with urllib.request.urlopen(req, timeout=30) as response:
+        return json.load(response)
+
+
+def validate_labels(labels, sha, run_id):
+    if labels.get('org.opencontainers.image.revision') != sha or labels.get('com.ermnvldmr.ci.run') != run_id:
+        raise ValueError('Immutable image provenance mismatch')
+
+
+def validate_manifest(manifest, sha, digest, run_id):
+    expected = {'sha': sha, 'digest': digest, 'run_id': run_id, 'repository': REPO}
+    if manifest != expected:
+        raise ValueError('Build artifact does not attest requested image digest')
+
+
+def artifact_manifest(run_id, name='www-provenance', filename='www-provenance.json'):
+    artifacts = api('/actions/runs/' + run_id + '/artifacts')['artifacts']
+    matching = [a for a in artifacts if a.get('name') == name and not a.get('expired', True)]
+    if len(matching) != 1:
+        raise ValueError('Exactly one unexpired build provenance artifact required')
+    class SameHostRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, req, fp, code, msg, headers, newurl):
+            if not newurl.startswith(SERVER + '/'):
+                raise ValueError('Unexpected artifact storage host')
+            return super().redirect_request(req, fp, code, msg, headers, newurl)
+    request = urllib.request.Request(SERVER + '/api/v1/repos/' + REPO + '/actions/artifacts/' + str(matching[0]['id']) + '/zip', headers={'Authorization': 'token ' + os.environ['PROVENANCE_TOKEN']})
+    with urllib.request.build_opener(SameHostRedirect).open(request, timeout=30) as response:
+        payload = response.read(1024 * 1024 + 1)
+    if len(payload) > 1024 * 1024:
+        raise ValueError('Unexpected provenance artifact size')
+    with zipfile.ZipFile(io.BytesIO(payload)) as archive:
+        members = [name for name in archive.namelist() if name.rsplit('/', 1)[-1] == filename]
+        if len(members) != 1:
+            raise ValueError('Missing or ambiguous provenance manifest')
+        if archive.getinfo(members[0]).file_size > 65536:
+            raise ValueError('Unexpected provenance document size')
+        return json.loads(archive.read(members[0]))
+
+
+def main():
+    sha, digest, run_id = os.environ['TESTED_SHA'], os.environ['TESTED_DIGEST'], os.environ['BUILD_RUN_ID']
+    validate_input(sha, digest, run_id)
+    current = api('/actions/runs/' + os.environ['GITHUB_RUN_ID'])
+    if current.get('event') != 'workflow_dispatch' or current.get('head_branch') != 'next':
+        raise ValueError('Approval must be manually dispatched on protected next')
+    actor = current.get('trigger_actor') or current.get('actor') or {}
+    if actor.get('login') != 'deytenit':
+        raise ValueError('Only the repository owner may approve promotion')
+    if not api('/branches/next').get('protected'):
+        raise ValueError('The next branch must be protected before promotion')
+    validate_run(api('/actions/runs/' + run_id), sha)
+    validate_manifest(artifact_manifest(run_id), sha, digest, run_id)
+    if os.environ.get('RELEASE_RUN_ID'):
+        release_id = os.environ['RELEASE_RUN_ID']
+        if not re.fullmatch(r'[1-9][0-9]*', release_id):
+            raise ValueError('Numeric release run ID required')
+        release = api('/actions/runs/' + release_id)
+        actor = release.get('trigger_actor') or release.get('actor') or {}
+        if release.get('conclusion') != 'success' or release.get('status') != 'completed' or release.get('event') != 'workflow_dispatch' or release.get('head_branch') != 'next' or release.get('path') != 'services-www-release-manual.yml@refs/heads/next' or actor.get('login') != 'deytenit':
+            raise ValueError('Successful independently approved release required')
+        manifest = artifact_manifest(release_id, 'www-release-provenance', 'www-release.json')
+        expected = {'sha': sha, 'digest': digest, 'run_id': run_id, 'repository': REPO, 'release_tag': os.environ['RELEASE_TAG']}
+        if manifest != expected:
+            raise ValueError('Release approval does not match requested artifact')
+    auth = base64.b64encode(('deytenit:' + os.environ['PROVENANCE_TOKEN']).encode()).decode()
+    subprocess.run(['git', '-c', 'http.https://git.ermnvldmr.com/.extraheader=AUTHORIZATION: basic ' + auth, 'fetch', 'origin', 'next'], check=True)
+    subprocess.run(['git', 'merge-base', '--is-ancestor', sha, 'origin/next'], check=True)
+    subprocess.run(['docker', 'pull', IMAGE + '@' + digest], check=True)
+    data = json.loads(subprocess.check_output(['docker', 'image', 'inspect', IMAGE + '@' + digest], text=True))
+    validate_labels(data[0]['Config'].get('Labels') or {}, sha, run_id)
+    with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
+        stream.write('short_sha=sha-' + sha[:7] + '\n')
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,238 @@
+name: ci - next/build-golden-image
+'on':
+  workflow_dispatch: null
+concurrency:
+  group: ci-golden-image
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  validate-scripts:
+    name: Validate - Provisioner Scripts
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Validate Shell Script Syntax
+      run: bash -n ci/packer/scripts/*.sh
+  build-image:
+    name: Build - Golden Image
+    needs: validate-scripts
+    runs-on: apex-debian13
+    outputs:
+      image_name: ${{ steps.vars.outputs.image_name }}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Calculate Image Name
+      id: vars
+      run: 'SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)"
+
+        IMAGE_NAME="com-ermnvldmr-debian-12-k3s-amd64-${SHORT_SHA}.qcow2"
+
+        echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
+
+        '
+    - name: Install Build Tools
+      run: 'sudo apt-get update
+
+        sudo apt-get install -y qemu-utils
+
+        '
+    - name: Build Debian K3s Golden Image
+      run: 'mkdir -p output-qemu
+
+        echo "Downloading official Debian 12 cloud image..."
+
+        curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
+
+
+        echo "Expanding disk image to 10G..."
+
+        qemu-img resize base.qcow2 10G
+
+
+        echo "Connecting disk image via NBD..."
+
+        sudo modprobe nbd max_part=8
+
+        sudo qemu-nbd --connect=/dev/nbd0 base.qcow2
+
+        sleep 1
+
+        sudo partx -u /dev/nbd0 || true
+
+
+        echo "Mounting disk filesystem..."
+
+        sudo mkdir -p /mnt/target
+
+        sudo mount /dev/nbd0p1 /mnt/target
+
+
+        echo "Mounting host virtual filesystems and configuring DNS..."
+
+        sudo rm -f /mnt/target/etc/resolv.conf
+
+        echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf
+
+        echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf
+
+        sudo mount --bind /dev /mnt/target/dev
+
+        sudo mount --bind /dev/pts /mnt/target/dev/pts
+
+        sudo mount --bind /proc /mnt/target/proc
+
+        sudo mount --bind /sys /mnt/target/sys
+
+
+        echo "Copying provisioner scripts..."
+
+        sudo mkdir -p /mnt/target/tmp/scripts
+
+        sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/
+
+        sudo cp /opt/ci/assets/k3s /opt/ci/assets/k3s-install.sh /mnt/target/tmp/scripts/
+
+        sudo cp /opt/ci/assets/flux-install-local.yaml /mnt/target/tmp/scripts/flux-install.yaml
+
+        sudo chmod +x /mnt/target/tmp/scripts/*.sh
+
+
+        echo "Running provisioner scripts in chroot..."
+
+        sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh
+
+        sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh
+
+        sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh
+
+        sudo rm -rf /mnt/target/tmp/scripts
+
+
+        echo "Unmounting filesystems..."
+
+        sudo umount /mnt/target/sys
+
+        sudo umount /mnt/target/proc
+
+        sudo umount /mnt/target/dev/pts
+
+        sudo umount /mnt/target/dev
+
+        sudo umount /mnt/target
+
+        sudo qemu-nbd --disconnect /dev/nbd0
+
+
+        echo "Compressing and optimizing qcow2 with 2M cluster size..."
+
+        qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+
+        echo "Golden image built successfully."
+
+        '
+    - name: Prepare and Upload Image Artifact
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: golden-image
+        path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+        retention-days: 30
+  upload-s3:
+    name: Upload - S3 Storage
+    needs: build-image
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Download Image Artifact
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: golden-image
+        path: output-qemu
+    - name: Upload to Static S3 (/dev/images/)
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID
+          }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY
+          }}
+        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION
+          || 'auto' }}
+        S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL
+          }}
+        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET
+          }}
+        IMAGE_NAME: ${{ needs.build-image.outputs.image_name }}
+      run: "mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 \"output-qemu/${IMAGE_NAME}\"\
+        \nif [ -n \"${S3_BUCKET}\" ] && [ -n \"${AWS_ACCESS_KEY_ID}\" ]; then\n  ENDPOINT_FLAG=\"\
+        \"\n  [ -n \"${S3_ENDPOINT}\" ] && ENDPOINT_FLAG=\"--endpoint-url=${S3_ENDPOINT}\"\
+        \n  echo \"Cleaning up older images in dev/images/ to free bucket storage...\"\
+        \n  aws ${ENDPOINT_FLAG} s3 rm \"s3://${S3_BUCKET}/dev/images/\" --recursive\
+        \ --exclude \"*\" --include \"com-ermnvldmr-debian-12-k3s-*.qcow2\" || true\n\
+        \  aws ${ENDPOINT_FLAG} s3 cp \"output-qemu/${IMAGE_NAME}\" \"s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}\"\
+        \n  echo \"Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}\"\
+        \nelse\n  echo \"S3 storage secrets not provided; skipping remote S3 upload.\
+        \ Image artifact is preserved in GitHub Actions run artifacts.\"\nfi\n"
@@ -0,0 +1,583 @@
+name: packages/kits - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/kits/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-kits-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-next-kits-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs & UI
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Build UI
+      run: pnpm --filter @ermnvldmr/ui build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+    - name: Upload UI dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+        retention-days: 30
+  lint-kits:
+    name: Lint - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Lint Kits package
+      run: pnpm --filter @ermnvldmr/kits lint
+  typecheck-kits:
+    name: Typecheck - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Typecheck Kits package
+      run: pnpm --filter @ermnvldmr/kits typecheck
+  test-kits:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Test Kits package
+      run: pnpm --filter @ermnvldmr/kits test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits Storybook
+      run: pnpm --filter @ermnvldmr/kits build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/kits test:storybook:ci
+  build-kits:
+    name: Build - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits package
+      run: pnpm --filter @ermnvldmr/kits build
@@ -0,0 +1,583 @@
+name: packages/kits - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/kits/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-kits-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-kits-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs & UI
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Build UI
+      run: pnpm --filter @ermnvldmr/ui build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+    - name: Upload UI dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+        retention-days: 30
+  lint-kits:
+    name: Lint - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Lint Kits package
+      run: pnpm --filter @ermnvldmr/kits lint
+  typecheck-kits:
+    name: Typecheck - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Typecheck Kits package
+      run: pnpm --filter @ermnvldmr/kits typecheck
+  test-kits:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Test Kits package
+      run: pnpm --filter @ermnvldmr/kits test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits Storybook
+      run: pnpm --filter @ermnvldmr/kits build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/kits test:storybook:ci
+  build-kits:
+    name: Build - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits package
+      run: pnpm --filter @ermnvldmr/kits build
@@ -0,0 +1,291 @@
+name: packages/ssg - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/ssg/**
+    - .gitea/workflows/packages-ssg-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-ssg-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-ssg:
+    name: Lint - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Lint SSG package
+      run: pnpm --filter @ermnvldmr/ssg lint
+  typecheck-ssg:
+    name: Typecheck - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Typecheck SSG package
+      run: pnpm --filter @ermnvldmr/ssg typecheck
+  build-ssg:
+    name: Build - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Build SSG package
+      run: pnpm --filter @ermnvldmr/ssg build
@@ -0,0 +1,291 @@
+name: packages/ssg - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/ssg/**
+    - .gitea/workflows/packages-ssg-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-ssg-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-ssg:
+    name: Lint - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Lint SSG package
+      run: pnpm --filter @ermnvldmr/ssg lint
+  typecheck-ssg:
+    name: Typecheck - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Typecheck SSG package
+      run: pnpm --filter @ermnvldmr/ssg typecheck
+  build-ssg:
+    name: Build - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Build SSG package
+      run: pnpm --filter @ermnvldmr/ssg build
@@ -0,0 +1,345 @@
+name: packages/stl - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/stl/**
+    - .gitea/workflows/packages-stl-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-stl-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-stl:
+    name: Lint - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Lint STL package
+      run: pnpm --filter @ermnvldmr/stl lint
+  typecheck-stl:
+    name: Typecheck - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Typecheck STL package
+      run: pnpm --filter @ermnvldmr/stl typecheck
+  test-stl:
+    name: Test - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Test STL package
+      run: pnpm --filter @ermnvldmr/stl test:coverage
+  build-stl:
+    name: Build - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Build STL package
+      run: pnpm --filter @ermnvldmr/stl build
@@ -0,0 +1,346 @@
+name: packages/stl - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/stl/**
+    - .gitea/workflows/packages-stl-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+  workflow_dispatch: {}
+concurrency:
+  group: ci-pr-stl-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-stl:
+    name: Lint - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Lint STL package
+      run: pnpm --filter @ermnvldmr/stl lint
+  typecheck-stl:
+    name: Typecheck - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Typecheck STL package
+      run: pnpm --filter @ermnvldmr/stl typecheck
+  test-stl:
+    name: Test - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Test STL package
+      run: pnpm --filter @ermnvldmr/stl test:coverage
+  build-stl:
+    name: Build - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Build STL package
+      run: pnpm --filter @ermnvldmr/stl build
@@ -0,0 +1,535 @@
+name: packages/ui - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-ui-next-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-ui-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-ui:
+    name: Lint - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Lint UI package
+      run: pnpm --filter @ermnvldmr/ui lint
+  typecheck-ui:
+    name: Typecheck - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Typecheck UI package
+      run: pnpm --filter @ermnvldmr/ui typecheck
+  test-ui:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Test UI package
+      run: pnpm --filter @ermnvldmr/ui test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/ui test:storybook:ci
+  build-ui:
+    name: Build - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build UI package
+      run: pnpm --filter @ermnvldmr/ui build
@@ -0,0 +1,544 @@
+name: packages/ui - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-ui-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-ui-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-ui:
+    name: Lint - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Lint UI package
+      run: pnpm --filter @ermnvldmr/ui lint
+  typecheck-ui:
+    name: Typecheck - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Typecheck UI package
+      run: pnpm --filter @ermnvldmr/ui typecheck
+  test-ui:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Test UI package
+      run: pnpm --filter @ermnvldmr/ui test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ui-storybook-static-${{ github.run_id }}
+        path: packages/ui/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: ui-storybook-static-${{ github.run_id }}
+        path: packages/ui/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/ui test:storybook:ci
+  build-ui:
+    name: Build - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build UI package
+      run: pnpm --filter @ermnvldmr/ui build
@@ -0,0 +1,138 @@
+name: services/docs - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/docs/**
+    - .gitea/workflows/services-docs-next-required.yml
+    - ci/docker/docs/**
+    - ci/config/nginx/**
+    - ci/scripts/**
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-docs-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-hugo:
+    name: Setup - Hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+  build-hugo:
+    name: Build - Hugo Site
+    needs: setup-hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+    - name: Build Hugo site
+      working-directory: services/docs
+      run: hugo --gc --minify
+  release-docker:
+    name: Release - Docker Image
+    needs: build-hugo
+    runs-on: apex-debian13
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Log in to GitHub Container Registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Extract Docker metadata
+      id: meta
+      run: python3 .gitea/scripts/docker.py metadata
+      env:
+        IMAGES: git.ermnvldmr.com/${{ github.repository }}/docs
+        TAG_RULES: 'type=raw,value=latest
+
+          type=sha,format=short
+
+          '
+        SOURCE_SHA: ${{ github.sha }}
+    - name: Compute short SHA
+      id: vars
+      run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+    - name: Build and push Docker image
+      run: python3 .gitea/scripts/docker.py build
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
+        LABELS: ${{ steps.meta.outputs.labels }}
+        BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+
+          VERSION=${{ steps.vars.outputs.short_sha }}
+
+          '
+        DOCKERFILE: ci/docker/docs/Dockerfile
+        PLATFORMS: ''
+        PUSH: 'true'
+        CONTEXT: .
+        SOURCE_SHA: ${{ github.sha }}
+        RUN_ID: ${{ github.run_id }}
+  deploy:
+    name: Deploy - Kubernetes (GitOps)
+    needs: release-docker
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    permissions:
+      contents: write
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\")\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n' \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes\
+        \ -o StrictHostKeyChecking=yes -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Setup Kustomize
+      run: test "$(kustomize version)" = v5.3.0
+    - name: Deploy via GitOps
+      run: 'DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+
+        bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"
+
+        '
+      env:
+        GIT_WRITE_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
+  verify-rollout:
+    name: Verify - Production Rollout
+    needs: deploy
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    steps:
+    - name: Await production rollout
+      run: "TARGET_COMMIT=\"sha-$(echo ${{ github.sha }} | cut -c1-7)\"\nENDPOINT=\"https://docs.ermnvldmr.com/version.json\"\n\necho \"========================================================\"\necho \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit: $TARGET_COMMIT\"\necho \"========================================================\"\n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le $MAX_ATTEMPTS ]; do\n  echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\n\n  RESP_FILE=$(mktemp)\n  HTTP_CODE=$(curl -sL --max-time 10 \\\n    -H \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n    -H \"Accept: application/json\" \\\n    -o \"$RESP_FILE\" \\\n    -w \"%{http_code}\" \\\n    \"$ENDPOINT\" || echo \"000\")\n\n  if [ \"$HTTP_CODE\" = \"200\" ]; then\n    LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null || true)\n    echo \"  Live commit:\
+        \ ${LIVE_COMMIT:-<none>}\"\n\n    if [ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n      echo \"\u2705 Success! Production docs has successfully rolled out $TARGET_COMMIT.\"\n      rm -f \"$RESP_FILE\"\n      exit 0\n    fi\n  elif [ \"$HTTP_CODE\" = \"403\" ] || [ \"$HTTP_CODE\" = \"503\" ]; then\n    echo \"  HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP.\"\n    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1))\n  else\n    echo \"  HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out.\"\n  fi\n\n  rm -f \"$RESP_FILE\"\n\n  if [ $CF_BLOCKED_COUNT -ge 5 ]; then\n    echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n    echo \"The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster.\"\n    echo \"Skipping further external HTTP verification to avoid false negative.\"\n    exit 0\n  fi\n\n  ATTEMPT=$((ATTEMPT + 1))\n  sleep 10\ndone\n\
+        \necho \"\u274C Deployment verification timed out after 7.5 minutes.\"\nexit 1\n"
@@ -0,0 +1,47 @@
+name: services/docs - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/docs/**
+    - .gitea/workflows/services-docs-pr-required.yml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-docs-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-hugo:
+    name: Setup - Hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+  build-hugo:
+    name: Build - Hugo Site
+    needs: setup-hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\ncase \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\nAUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\ngit remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\ngit -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\" = recursive ]; then\n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\" = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\" \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: recursive
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+    - name: Setup Hugo
+      run: hugo version | grep extended
+    - name: Build Hugo site
+      working-directory: services/docs
+      run: hugo --gc --minify
@@ -0,0 +1,374 @@
+name: services/static - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/static/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-static-next-required.yml
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-static-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-static:
+    name: Lint - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Lint static service
+      run: pnpm --filter @ermnvldmr/static lint
+  typecheck-static:
+    name: Typecheck - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Typecheck static service
+      run: pnpm --filter @ermnvldmr/static typecheck
+  build-static:
+    name: Build - Static Site
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build static service
+      run: pnpm --filter @ermnvldmr/static build
+    - name: Upload build artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: static-dist
+        path: services/static/dist/
+        retention-days: 30
+  deploy-s3:
+    name: Deploy - S3
+    needs:
+    - lint-static
+    - typecheck-static
+    - build-static
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Download build artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: static-dist
+        path: services/static/dist/
+    - name: Deploy to S3
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }}
+        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }}
+        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }}
+        AWS_REGION: ${{ secrets.STATIC_AWS_REGION }}
+        S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }}
+      run: 'chmod +x ci/scripts/deploy-static.sh
+
+        ./ci/scripts/deploy-static.sh
+
+        '
@@ -0,0 +1,324 @@
+name: services/static - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/static/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-static-pr-required.yml
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-static-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Config Artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-static:
+    name: Lint - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Lint static service
+      run: pnpm --filter @ermnvldmr/static lint
+  typecheck-static:
+    name: Typecheck - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Typecheck static service
+      run: pnpm --filter @ermnvldmr/static typecheck
+  build-static:
+    name: Build - Static Site
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build static service
+      run: pnpm --filter @ermnvldmr/static build
+    - name: Upload build artifacts
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: static-dist-${{ github.run_id }}
+        path: services/static/dist/
+        retention-days: 30
@@ -0,0 +1,122 @@
+name: services/www - manual deploy
+'on':
+  workflow_dispatch:
+    inputs:
+      tested_sha:
+        description: Full tested source commit
+        required: true
+        type: string
+      tested_digest:
+        description: OCI sha256 digest from the successful build
+        required: true
+        type: string
+      build_run_id:
+        description: Successful WWW build run ID
+        required: true
+        type: string
+      release_tag:
+        description: Previously approved release tag
+        required: true
+        type: string
+      release_run_id:
+        description: Successful manually approved release run ID
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+jobs:
+  deploy:
+    runs-on: apex-debian13
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
+      && github.actor == 'deytenit'
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Authenticate local registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: deytenit
+        REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_READ_TOKEN }}
+    - name: Verify successful build and immutable digest
+      id: provenance
+      run: python3 .gitea/scripts/provenance.py
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+        RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+        RELEASE_TAG: ${{ inputs.release_tag }}
+    - name: Verify approved release and deploy digest
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+        RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+        RELEASE_TAG: ${{ inputs.release_tag }}
+        GIT_WRITE_KEY: ${{ secrets.WWW_DEPLOY_KEY }}
+      run: 'set -euo pipefail
+
+        [[ "$RELEASE_TAG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]
+
+        test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$TESTED_SHA"
+
+        test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$RELEASE_TAG"
+        --format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST"
+
+        bash ci/scripts/deploy-gitops.sh www "$TESTED_DIGEST"
+
+        '
+    - name: Await production rollout
+      run: "TARGET_COMMIT=\"sha-${TESTED_SHA:0:7}\"\nENDPOINT=\"https://www.ermnvldmr.com/version.json\"\
+        \n\necho \"========================================================\"\necho\
+        \ \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit:\
+        \  $TARGET_COMMIT\"\necho \"========================================================\"\
+        \n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le\
+        \ $MAX_ATTEMPTS ]; do\n  echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\
+        \n\n  RESP_FILE=$(mktemp)\n  HTTP_CODE=$(curl -sL --max-time 10 \\\n    -H\
+        \ \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\
+        \ (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n    -H \"Accept:\
+        \ application/json\" \\\n    -o \"$RESP_FILE\" \\\n    -w \"%{http_code}\"\
+        \ \\\n    \"$ENDPOINT\" || echo \"000\")\n\n  if [ \"$HTTP_CODE\" = \"200\"\
+        \ ]; then\n    LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null\
+        \ || true)\n    echo \"  Live commit:  ${LIVE_COMMIT:-<none>}\"\n\n    if\
+        \ [ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n      echo \"\u2705 Success!\
+        \ Production has successfully rolled out $TARGET_COMMIT.\"\n      rm -f \"\
+        $RESP_FILE\"\n      exit 0\n    fi\n  elif [ \"$HTTP_CODE\" = \"403\" ] ||\
+        \ [ \"$HTTP_CODE\" = \"503\" ]; then\n    echo \"  HTTP $HTTP_CODE: Cloudflare\
+        \ WAF/challenge encountered from runner IP.\"\n    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT\
+        \ + 1))\n  else\n    echo \"  HTTP $HTTP_CODE: Endpoint returned unexpected\
+        \ status code or timed out.\"\n  fi\n\n  rm -f \"$RESP_FILE\"\n\n  if [ $CF_BLOCKED_COUNT\
+        \ -ge 5 ]; then\n    echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked\
+        \ external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n    echo\
+        \ \"The GitOps release commit was already pushed to the repository; FluxCD\
+        \ will reconcile the cluster.\"\n    echo \"Skipping further external HTTP\
+        \ verification to avoid false negative.\"\n    exit 0\n  fi\n\n  ATTEMPT=$((ATTEMPT\
+        \ + 1))\n  sleep 10\ndone\n\necho \"\u274C Deployment verification timed out\
+        \ after 7.5 minutes.\"\nexit 1\n"
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
@@ -0,0 +1,653 @@
+name: services/www - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/www/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-www-next-required.yml
+    - ci/docker/www/**
+    - ci/config/nginx/**
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+  workflow_dispatch: null
+concurrency:
+  group: ci-www-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Build i18n package
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-www:
+    name: Lint - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Lint WWW service
+      run: pnpm --filter @ermnvldmr/www lint
+  typecheck-www:
+    name: Typecheck - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Typecheck WWW service
+      run: pnpm --filter @ermnvldmr/www typecheck
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Build WWW Storybook
+      run: pnpm --filter @ermnvldmr/www build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-static
+        path: services/www/storybook-static/
+        retention-days: 30
+  test-www:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Test WWW service
+      run: pnpm --filter @ermnvldmr/www test:coverage
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-static
+        path: services/www/storybook-static/
+    - name: Serve Storybook and run tests with coverage
+      run: pnpm --filter @ermnvldmr/www test:storybook:ci
+  build-www:
+    name: Build - WWW Service
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Build WWW service (all locales)
+      run: pnpm --filter @ermnvldmr/www build:all
+      env:
+        RSDOCTOR: 'true'
+    - name: Upload Rsdoctor report
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsdoctor-report
+        path: services/www/rsdoctor/
+        retention-days: 30
+  build-docker:
+    name: Build - Docker Image
+    needs:
+    - lint-www
+    - typecheck-www
+    - test-www
+    - test-storybook
+    - build-www
+    runs-on: apex-debian13
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      short_sha: ${{ steps.vars.outputs.short_sha }}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Calculate Short SHA
+      id: vars
+      run: 'SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+
+        echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+
+        '
+    - name: Log in to GitHub Container Registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Set up Docker Buildx
+      run: 'docker buildx version
+
+        docker buildx create --name apex-ci --driver docker-container --use
+
+        docker buildx inspect --bootstrap'
+    - name: Build and push Docker image
+      run: python3 .gitea/scripts/docker.py build
+      env:
+        TAGS: git.ermnvldmr.com/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha
+          }}
+        LABELS: ''
+        BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+
+          VERSION=${{ steps.vars.outputs.short_sha }}
+
+          '
+        DOCKERFILE: ci/docker/www/Dockerfile
+        PLATFORMS: ''
+        PUSH: 'true'
+        CONTEXT: .
+        SOURCE_SHA: ${{ github.sha }}
+        RUN_ID: ${{ github.run_id }}
+      id: image
+    - name: Record tested digest provenance
+      env:
+        IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
+      run: 'mkdir -p .ci
+
+        python3 - <<''PROVENANCE''
+
+        import json, os
+
+        from pathlib import Path
+
+        Path(''.ci/www-provenance.json'').write_text(json.dumps({''sha'': os.environ[''GITHUB_SHA''],
+        ''digest'': os.environ[''IMAGE_DIGEST''], ''run_id'': os.environ[''GITHUB_RUN_ID''],
+        ''repository'': os.environ[''GITHUB_REPOSITORY'']}))
+
+        PROVENANCE'
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: www-provenance
+        path: .ci/www-provenance.json
+        retention-days: 30
@@ -0,0 +1,553 @@
+name: services/www - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/www/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-www-pr-required.yml
+    - pnpm-lock.yaml
+    - .gitea/scripts/**
+    - .gitea/actions/**
+concurrency:
+  group: ci-pr-www-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - name: Setup Node.js with pnpm cache
+      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 .gitea/scripts/cache.py pack
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Upload Rsbuild Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Build i18n package
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload i18n dist
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-www:
+    name: Lint - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Lint WWW service
+      run: pnpm --filter @ermnvldmr/www lint
+  typecheck-www:
+    name: Typecheck - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Typecheck WWW service
+      run: pnpm --filter @ermnvldmr/www typecheck
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Build WWW Storybook
+      run: pnpm --filter @ermnvldmr/www build-storybook
+    - name: Upload Storybook build
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: www-storybook-static-${{ github.run_id }}
+        path: services/www/storybook-static/
+        retention-days: 30
+  test-www:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Test WWW service
+      run: pnpm --filter @ermnvldmr/www test:coverage
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: www-storybook-static-${{ github.run_id }}
+        path: services/www/storybook-static/
+    - name: Serve Storybook and run tests with coverage
+      run: pnpm --filter @ermnvldmr/www test:storybook:ci
+  build-www:
+    name: Build - WWW Service
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Install pnpm
+      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
+
+        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
+
+        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
+      env:
+        PNPM_VERSION: 9.12.3
+    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
+        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
+        \ >> \"$GITHUB_PATH\""
+      env:
+        NODE_VERSION: '20'
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 .gitea/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: ./.gitea/actions/download-artifact
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Build WWW service (all locales)
+      run: pnpm --filter @ermnvldmr/www build:all
+      env:
+        RSDOCTOR: 'true'
+    - name: Upload Rsdoctor report
+      uses: ./.gitea/actions/upload-artifact
+      with:
+        name: rsdoctor-report-${{ github.run_id }}
+        path: services/www/rsdoctor/
+        retention-days: 30
@@ -0,0 +1,108 @@
+name: services/www - manual release
+'on':
+  workflow_dispatch:
+    inputs:
+      tested_sha:
+        description: Full tested source commit
+        required: true
+        type: string
+      tested_digest:
+        description: OCI sha256 digest from the successful build
+        required: true
+        type: string
+      build_run_id:
+        description: Successful WWW build run ID
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+jobs:
+  release:
+    runs-on: apex-debian13
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
+      && github.actor == 'deytenit'
+    steps:
+    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
+        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
+        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
+        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
+        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
+        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
+        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
+        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
+        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
+        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
+        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
+        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
+      env:
+        CHECKOUT_REF: ${{ github.sha }}
+        CHECKOUT_SUBMODULES: 'false'
+        CHECKOUT_TOKEN: ${{ github.token }}
+        PERSIST_CREDENTIALS: 'false'
+        HEXTRA_READ_KEY: ''
+    - name: Authenticate local registry
+      run: python3 .gitea/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: deytenit
+        REGISTRY_TOKEN: ${{ secrets.RELEASE_REGISTRY_TOKEN }}
+    - name: Verify successful build and immutable digest
+      id: provenance
+      run: python3 .gitea/scripts/provenance.py
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+    - name: Promote tested digest and create release tag
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+        GIT_WRITE_KEY: ${{ secrets.WWW_RELEASE_KEY }}
+      run: 'set -euo pipefail
+
+        VERSION=$(bash ci/scripts/calver-release.sh)
+
+        [[ "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]
+
+        if git show-ref --verify --quiet "refs/tags/$VERSION"; then exit 1; fi
+
+        docker buildx imagetools create --prefer-index=false "git.ermnvldmr.com/deytenit/ermnvldmr.com/www@$TESTED_DIGEST"
+        --tag "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"
+
+        test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION"
+        --format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST"
+
+        git tag "$VERSION" "$TESTED_SHA"
+
+        python3 .gitea/scripts/git_write.py "refs/tags/$VERSION"
+
+        export VERSION
+
+        mkdir -p .ci
+
+        python3 - <<''RELEASE_PROVENANCE''
+
+        import json, os
+
+        from pathlib import Path
+
+        Path(''.ci/www-release.json'').write_text(json.dumps({''sha'': os.environ[''TESTED_SHA''],
+        ''digest'': os.environ[''TESTED_DIGEST''], ''run_id'': os.environ[''BUILD_RUN_ID''],
+        ''repository'': ''deytenit/ermnvldmr.com'', ''release_tag'': os.environ[''VERSION'']}))
+
+        RELEASE_PROVENANCE
+
+        '
+    - uses: ./.gitea/actions/upload-artifact
+      with:
+        name: www-release-provenance
+        path: .ci/www-release.json
+        retention-days: 30
@@ -1,172 +0,0 @@
-name: packages/stl - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/stl/**'
-      - '.github/workflows/packages-stl-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-stl-${{ github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-stl:
-    name: Lint - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Lint STL package
-        run: pnpm --filter @ermnvldmr/stl lint
-
-  typecheck-stl:
-    name: Typecheck - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Typecheck STL package
-        run: pnpm --filter @ermnvldmr/stl typecheck
-
-  test-stl:
-    name: Test - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Test STL package
-        run: pnpm --filter @ermnvldmr/stl test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/stl/coverage/lcov.info
-          flags: stl
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-stl:
-    name: Build - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Build STL package
-        run: pnpm --filter @ermnvldmr/stl build
@@ -1,172 +0,0 @@
-name: packages/stl - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/stl/**'
-      - '.github/workflows/packages-stl-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-stl-${{ github.head_ref }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-stl:
-    name: Lint - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Lint STL package
-        run: pnpm --filter @ermnvldmr/stl lint
-
-  typecheck-stl:
-    name: Typecheck - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Typecheck STL package
-        run: pnpm --filter @ermnvldmr/stl typecheck
-
-  test-stl:
-    name: Test - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Test STL package
-        run: pnpm --filter @ermnvldmr/stl test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/stl/coverage/lcov.info
-          flags: stl
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-stl:
-    name: Build - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Build STL package
-        run: pnpm --filter @ermnvldmr/stl build
@@ -1,309 +0,0 @@
-name: packages/ui - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-ui-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-ui-${{ github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-ui:
-    name: Lint - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Lint UI package
-        run: pnpm --filter @ermnvldmr/ui lint
-
-  typecheck-ui:
-    name: Typecheck - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Typecheck UI package
-        run: pnpm --filter @ermnvldmr/ui typecheck
-
-  test-ui:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Test UI package
-        run: pnpm --filter @ermnvldmr/ui test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/lcov.info
-          flags: ui
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/ui test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/storybook/lcov.info
-          flags: ui-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-ui:
-    name: Build - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build UI package
-        run: pnpm --filter @ermnvldmr/ui build
@@ -1,318 +0,0 @@
-name: packages/ui - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-ui-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-ui-${{ github.head_ref }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-ui:
-    name: Lint - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Lint UI package
-        run: pnpm --filter @ermnvldmr/ui lint
-
-  typecheck-ui:
-    name: Typecheck - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Typecheck UI package
-        run: pnpm --filter @ermnvldmr/ui typecheck
-
-  test-ui:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Test UI package
-        run: pnpm --filter @ermnvldmr/ui test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/lcov.info
-          flags: ui
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-storybook-static-${{ github.run_id }}
-          path: packages/ui/storybook-static/
-          retention-days: 1
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-storybook-static-${{ github.run_id }}
-          path: packages/ui/storybook-static/
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/ui test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/storybook/lcov.info
-          flags: ui-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-ui:
-    name: Build - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build UI package
-        run: pnpm --filter @ermnvldmr/ui build
@@ -1,108 +0,0 @@
-name: services/docs - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/docs/**'
-
-concurrency:
-  group: ci-docs-${{ github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  setup-hugo:
-    name: Setup - Hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-  build-hugo:
-    name: Build - Hugo Site
-    needs: setup-hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-      - name: Build Hugo site
-        working-directory: services/docs
-        run: hugo --gc --minify
-
-  release-docker:
-    name: Release - Docker Image
-    needs: build-hugo
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/docs
-          tags: |
-            type=raw,value=latest
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/docs/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  deploy:
-    name: Deploy - VPS
-    needs: release-docker
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
-    steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.DEPLOY_VPS_HOST }}
-          username: ${{ secrets.DEPLOY_VPS_USER }}
-          key: ${{ secrets.DEPLOY_VPS_SSH_KEY }}
-          port: ${{ secrets.DEPLOY_VPS_SSH_PORT || 22 }}
-          script: |
-            cd /srv/ermnvldmr.com
-            git pull
-            chmod +x ci/scripts/deploy-new-tags.sh
-            # Use the short SHA to match the tag from release-docker
-            export DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-            ./ci/scripts/deploy-new-tags.sh
@@ -1,50 +0,0 @@
-name: services/docs - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/docs/**'
-      - '.github/workflows/services-docs-pr-required.yml'
-
-concurrency:
-  group: ci-pr-docs-${{ github.head_ref }}
-  cancel-in-progress: true
-
-jobs:
-  setup-hugo:
-    name: Setup - Hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-  build-hugo:
-    name: Build - Hugo Site
-    needs: setup-hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-      - name: Build Hugo site
-        working-directory: services/docs
-        run: hugo --gc --minify
@@ -1,200 +0,0 @@
-name: services/static - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/static/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-static-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-static-${{ github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-static:
-    name: Lint - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Lint static service
-        run: pnpm --filter @ermnvldmr/static lint
-
-  typecheck-static:
-    name: Typecheck - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Typecheck static service
-        run: pnpm --filter @ermnvldmr/static typecheck
-
-  build-static:
-    name: Build - Static Site
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build static service
-        run: pnpm --filter @ermnvldmr/static build
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-dist
-          path: services/static/dist/
-          retention-days: 1
-
-  deploy-s3:
-    name: Deploy - S3
-    needs: [lint-static, typecheck-static, build-static]
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: static-dist
-          path: services/static/dist/
-
-      - name: Deploy to S3
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }}
-          S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }}
-          AWS_REGION: ${{ secrets.STATIC_AWS_REGION }}
-          S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }}
-        run: |
-          chmod +x ci/scripts/deploy-static.sh
-          ./ci/scripts/deploy-static.sh
@@ -1,173 +0,0 @@
-name: services/static - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/static/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-static-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-static-${{ github.head_ref }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-static:
-    name: Lint - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Lint static service
-        run: pnpm --filter @ermnvldmr/static lint
-
-  typecheck-static:
-    name: Typecheck - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Typecheck static service
-        run: pnpm --filter @ermnvldmr/static typecheck
-
-  build-static:
-    name: Build - Static Site
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build static service
-        run: pnpm --filter @ermnvldmr/static build
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-dist-${{ github.run_id }}
-          path: services/static/dist/
-          retention-days: 1
@@ -1,34 +0,0 @@
-name: services/www - next/checkout-release-branch
-
-on:
-  workflow_dispatch:
-
-jobs:
-  workflow-create-release-branch:
-    name: Workflow - Create Release Branch
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      actions: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Determine Branch Name
-        id: branch
-        run: |
-          BRANCH_NAME=$(bash ci/scripts/semantic-release.sh checkout services/www)
-          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
-
-      - name: Create and Push Branch
-        run: |
-          git checkout -b ${{ steps.branch.outputs.branch_name }}
-          git push origin ${{ steps.branch.outputs.branch_name }}
-
-      - name: Trigger Release Workflow
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh workflow run services-www-releases-required.yml --ref ${{ steps.branch.outputs.branch_name }}
@@ -1,363 +0,0 @@
-name: services/www - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/www/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-www-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-www-${{ github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Build i18n package
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-      - name: Upload Unit coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/lcov.info
-          flags: www
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests with coverage
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-      - name: Upload Storybook coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/storybook/lcov.info
-          flags: www-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Build WWW service (all locales)
-        run: pnpm --filter @ermnvldmr/www build:all
-        env:
-          RSDOCTOR: 'true'
-      - name: Upload Rsdoctor report
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsdoctor-report
-          path: services/www/rsdoctor/
-          retention-days: 30
-
-  release-docker:
-    name: Release - Docker Image
-    needs: build-www
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=next
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
@@ -1,327 +0,0 @@
-name: services/www - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/www/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-www-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-www-${{ github.head_ref }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Build i18n package
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: www-storybook-static-${{ github.run_id }}
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-      - name: Upload Unit coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/lcov.info
-          flags: www
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: www-storybook-static-${{ github.run_id }}
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests with coverage
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-      - name: Upload Storybook coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/storybook/lcov.info
-          flags: www-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Build WWW service (all locales)
-        run: pnpm --filter @ermnvldmr/www build:all
-        env:
-          RSDOCTOR: 'true'
-      - name: Upload Rsdoctor report
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsdoctor-report-${{ github.run_id }}
-          path: services/www/rsdoctor/
-          retention-days: 7
@@ -1,306 +0,0 @@
-name: services/www - releases/dispatch-release
-
-on:
-  workflow_dispatch:
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-artifacts
-          path: |
-            packages/rsbuild-config/dist
-            packages/storybook-config/dist
-            packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW service
-        run: pnpm --filter @ermnvldmr/www build
-
-  release-tag-docker:
-    name: Release - Tag & Docker
-    needs: [lint-www, typecheck-www, test-www, test-storybook, build-www]
-    runs-on: ubuntu-latest
-    environment: services-www-releases-publish
-    permissions:
-      contents: write
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Calculate Release Version
-        id: version
-        run: |
-          RELEASE_VERSION=$(bash ci/scripts/semantic-release.sh release ${{ github.ref_name }})
-          # Extract MAJOR.MINOR for tagging
-          MAJOR_MINOR=$(echo "${{ github.ref_name }}" | cut -d/ -f3 | sed 's/^v//')
-          MAJOR=$(echo "$MAJOR_MINOR" | cut -d. -f1)
-          echo "version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
-          echo "major_minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
-          echo "major=$MAJOR" >> $GITHUB_OUTPUT
-
-      - name: Create and Push Tag
-        run: |
-          TAG_NAME="releases/www/v${{ steps.version.outputs.version }}"
-          git tag $TAG_NAME
-          git push origin $TAG_NAME
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=v${{ steps.version.outputs.version }}
-            type=raw,value=v${{ steps.version.outputs.major_minor }}
-            type=raw,value=v${{ steps.version.outputs.major }}
-            type=raw,value=latest
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  deploy:
-    name: Deploy - VPS
-    needs: release-tag-docker
-    runs-on: ubuntu-latest
-    environment:
-      name: services-www-releases-deploy
-      url: https://ermnvldmr.com
-    steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.DEPLOY_VPS_HOST }}
-          username: ${{ secrets.DEPLOY_VPS_USER }}
-          key: ${{ secrets.DEPLOY_VPS_SSH_KEY }}
-          port: ${{ secrets.DEPLOY_VPS_SSH_PORT || 22 }}
-          script: |
-            cd /srv/ermnvldmr.com
-            git pull
-            chmod +x ci/scripts/deploy-new-tags.sh
-            # Use the short SHA to match the tag from release-tag-docker
-            export WWW_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-            ./ci/scripts/deploy-new-tags.sh
@@ -1,274 +0,0 @@
-name: services/www - releases/required
-
-on:
-  push:
-    branches: ['releases/www/**']
-  workflow_dispatch:
-
-concurrency:
-  group: ci-www-rel-${{ github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-artifacts
-          path: |
-            packages/rsbuild-config/dist
-            packages/storybook-config/dist
-            packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW service
-        run: pnpm --filter @ermnvldmr/www build
-
-  release-rc-docker:
-    name: Release - RC Docker Image
-    needs: build-www
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Calculate RC Version
-        id: version
-        run: |
-          RC_VERSION=$(bash ci/scripts/semantic-release.sh rc ${{ github.ref_name }})
-          echo "rc_version=$RC_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=v${{ steps.version.outputs.rc_version }}
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
@@ -2,6 +2,9 @@
 dist/
 *.tsbuildinfo

+# service static assets (local only, synced with S3)
+**/public/static/
+
 # dependencies
 node_modules/

@@ -18,9 +21,12 @@ storybook-static/
 test-results/
 playwright-report/

-# environment variables
+# environment variables (.env.dev is encrypted and tracked; .env is plaintext)
 .env
-.env.production
+.env.keys
+
+# local development certificates
+.certs/

 # macOS-specific files
 .DS_Store
@@ -31,3 +37,18 @@ playwright-report/
 # agents plans and designs
 docs/plans/
 docs/superpowers/
+
+# SOPS and Kubernetes Secrets
+*.dec.yaml
+*.plain.yaml
+*.local.yaml
+*.key
+.sops/keys.txt
+ci/k8s/**/secret.yaml
+ci/cloud-init/user-data.yaml
+
+# Packer & QEMU Build Artifacts
+output-qemu/
+*.qcow2
+*.iso
+
@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: ci/k8s/.*secret.*\.yaml$
+    encrypted_regex: '^(data|stringData)$'
+    age: "age15zq3cje3ttmx2fhqp9cpeght6feq2w8e5m38799stjetj8urcccs36r4rc,age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl"
@@ -1,444 +1,146 @@
-# AGENTS.md - Development Guide
+# AGENTS.md

-## 📋 Project Overview
+Guidance and operational constraints for AI coding agents working on `ermnvldmr.com`.

-**ermnvldmr.com** is Vladimir Eremin's personal ecosystem of services delivered through a modern monorepo architecture. The project encompasses personal websites, documentation sites, and shared infrastructure for web-based content and services.
+## 1. System Overview & Tech Stack

-### Monorepo Architecture
+`ermnvldmr.com` is a pnpm monorepo hosting personal web services, dividing applications into `services/` and shared packages into `packages/`. The primary website (`services/www`) and static pages (`services/static`) are built with React 19 and Rsbuild (Rspack). Build-time Static Site Generation is performed via `@ermnvldmr/ssg`, a custom Rsbuild plugin that pre-renders React entry points to HTML with inlined critical CSS (via Critters). The documentation service (`services/docs`) runs on Hugo with the Hextra theme.

- **Repository Structure**: pnpm workspace monorepo
- **Package Manager**: pnpm v9.12.3+
- **Core Technology**: TypeScript (Strict mode)
- **Services**: Independent web services with shared dependencies
- **Packages**: Reusable configurations and component libraries
- **Build System**: Distributed builds with dependency management
- **CI/CD**: GitHub Actions with path-based triggers
+Shared workspace packages provide the UI design system (`@ermnvldmr/ui`), application component kits (`@ermnvldmr/kits`), standard types library (`@ermnvldmr/stl`), localization utilities (`@ermnvldmr/i18n`), monorepo CLI tooling (`@ermnvldmr/cli`), static site generator (`@ermnvldmr/ssg`), and reusable presets for ESLint, Rsbuild, and Storybook. Design components utilize Tailwind CSS v4, Radix UI primitives, React-Aria, and CVA, validated using Vitest and Storybook 8.

-### Design Philosophy
+| Technology | Version / Tool | Purpose |
+| :--- | :--- | :--- |
+| **Package Manager** | `pnpm` (>=9.12.3) | Workspace dependency and package management |
+| **Runtime Engine** | Node.js (>=20) | Server and build runtime environment |
+| **UI Library** | React 19 (`react`, `react-dom`) | Declarative UI rendering |
+| **Bundler Engine** | Rsbuild / Rspack | Rust-powered bundling, hot module reloading, and build pipeline |
+| **Static Site Generator** | `@ermnvldmr/ssg` / Hugo (>=0.110.0) | Build-time React HTML pre-rendering & Hugo docs engine |
+| **UI Primitives & Icons** | React Aria, Radix UI, Lucide React | Accessible interactive primitives and icon system |
+| **Styling & Utilities** | Tailwind CSS v4, CVA, `@ermnvldmr/stl` | Utility styling, component variant management, class utilities |
+| **Internationalization** | `@ermnvldmr/i18n` | Multi-locale routing and localization strings (`en`, `ru`) |
+| **Testing Framework** | Vitest, Testing Library, Playwright | Unit, integration, and Storybook interaction testing |
+| **Component Workshop** | Storybook 8 | Isolated component development environment |
+| **Static Analysis** | ESLint 9 (Flat Config), TypeScript 5.8 | Code linting, monorepo import boundary checks, strict typing |
+| **Secrets Encryption** | `@dotenvx/dotenvx` | Public-key encrypted `.env.dev` secrets management |

- **Component-First**: All UI elements developed as isolated, reusable components
- **Configuration Sharing**: Centralized tooling configurations across services
- **TypeScript-First**: Strict typing for all public APIs and components
- **Documentation-Driven**: TSDoc required for all exported elements
- **Dependency Isolation**: Clear separation between packages and services
- **Build Optimization**: Efficient dependency building and caching
+## 2. Project Structure & Key Directories

-## 🏗️ Repository Structure
-
-```
-├── packages/                   # Shared packages and configurations
-│   ├── eslint-config/         # Shared ESLint configurations
-│   ├── rsbuild-config/        # Shared Rsbuild configurations
-│   ├── storybook-config/      # Shared Storybook configurations
-│   ├── stl/                   # Standard Type Library (utilities)
-│   └── ui/                    # Shared React component library
-├── services/                   # Independent web services
-│   ├── www/                   # Main website (Rsbuild + React)
-│   └── docs/                  # Documentation site (Hugo)
-├── .github/workflows/         # CI/CD automation
-├── pnpm-workspace.yaml        # Workspace configuration
-└── [root config files]        # Global configurations
+```text
+ermnvldmr.com/
+├── ci/                      # CI/CD pipelines, Docker containers, deployment scripts
+├── docs/                    # Architectural documentation and design specifications
+├── packages/                # Monorepo shared packages and toolchain configurations
+│   ├── cli/                 # Monorepo CLI utility (`ermnvldmr-cli`) for tasks like S3 asset sync
+│   ├── eslint-config/       # Shared flat ESLint rule sets and monorepo import restriction rules
+│   ├── i18n/                # Localization engine, locale pathing, and translation keysets
+│   ├── kits/                # High-level domain & layout component kits (BentoGrid, InfoCard, PageHead, Page, etc.)
+│   ├── rsbuild-config/      # Shared Rsbuild and Rspack bundler configuration presets
+│   ├── ssg/                 # Build-time Static Site Generation plugin for Rsbuild React apps
+│   ├── stl/                 # Standard Types Library for core utilities, type definitions, and react helpers
+│   ├── storybook-config/    # Shared Storybook workshop configurations
+│   └── ui/                  # Design system React component library, styles, and Storybook stories
+├── services/                # Deployable web applications and services
+│   ├── docs/                # Technical documentation site (Hugo + Hextra theme)
+│   ├── static/              # Static landing pages service (Rsbuild + React 19)
+│   └── www/                 # Primary website (Rsbuild + React 19 + MDX + SSG)
+├── .env.dev                 # Encrypted environment variable storage (tracked in git)
+├── .env.keys                # Private decryption keys (UNTRACKED - do not commit)
+├── eslint.config.mjs        # Root ESLint flat configuration extending `@ermnvldmr/eslint-config`
+├── pnpm-workspace.yaml      # Monorepo workspace package definitions
+└── tsconfig.json            # Root TypeScript configuration with workspace path aliases
 ```

-### Package Organization
-
-#### Configuration Packages (`packages/`)
-
- **eslint-config**: Shared ESLint rules for TypeScript and React
- **rsbuild-config**: Shared Rsbuild and Rspack configurations for library and service builds
- **storybook-config**: Shared Storybook setup and configurations
-
-#### Library Packages (`packages/`)
-
- **stl** (Standard Type Library): Common utilities, types, and helper functions
- **ui**: React component library with design system and Storybook stories
- **i18n**: Internationalization utilities
-
-#### Service Packages (`services/`)
-
- **www**: Main website built with Rsbuild, React, and Tailwind CSS
- **static**: Static landing pages service built with Rsbuild and React
- **docs**: Documentation site built with Hugo and Hextra theme
-
-### Key Directory Rules
-
-#### `/packages/`
-
- **Purpose**: Shared configurations and reusable libraries
- **Dependencies**: Can depend on each other following build order (configs → stl → ui)
- **Exports**: Must provide proper TypeScript declarations
- **Building**: Required before dependent services can build
- **Testing**: Individual test suites for each package
-
-#### `/services/`
-
- **Purpose**: Independent web applications and sites
- **Dependencies**: Can consume packages but not other services
- **Deployment**: Independent deployment pipelines
- **Development**: Can be developed and tested in isolation
- **Configuration**: Inherit from shared packages but can override
-
-## 🛠️ Development Workflow
-
-### Monorepo Development Principles
-
- **Root-Level Scripts**: Check `package.json` at repository root for monorepo-wide operations
- **Service-Specific Scripts**: Each service in `services/` has its own development commands
- **Package Filtering**: Use pnpm workspace filtering to target specific packages/services
- **Dependency-Aware Building**: UI components must be built before dependent services
-
-### Package Development Workflow
-
-The monorepo follows a strict dependency hierarchy that must be respected:
-
-#### 1. Configuration Packages First
-
-Configuration packages provide shared tooling setups and must be built before anything else. Look for packages ending in `-config` in the `packages/` directory.
-
-#### 2. Library Packages
-
-Library packages (`stl`, `ui`) provide reusable code and components. They depend on configuration packages and must be built in dependency order (check their `package.json` dependencies).
-
-#### 3. Services
-
-Services consume packages but are independent of each other. They can be developed and deployed separately. Check `services/` directory for available services and their individual `package.json` files for available scripts.
-
-### Code Organization Principles
-
- **Dependency Order**: configs → stl → ui → services
- **Single Responsibility**: Each package serves one clear purpose
- **Explicit Dependencies**: All inter-package dependencies declared in package.json
- **Build Isolation**: Each package can be built independently
- **Configuration Inheritance**: Services inherit from shared configurations
- **Package Entry Points**:
-  - `.` (Main): Runtime code used in production (e.g., `import { ... } from '@ermnvldmr/stl'`).
-  - `/testing`: Test-related utilities and mocks (e.g., `import { ... } from '@ermnvldmr/stl/testing'`).
-  - `/dev`: Build-time dependencies (e.g., `import { ... } from '@ermnvldmr/stl/dev'`).
-  - All other entry points are forbidden. Strictly build-time packages must still expose via `/dev`.
- **Directory Structure (Packages & Services)**:
-  - `src/lib/`: Helpers, utilities, and types.
-    - `{category}/`: Grouped logic.
-    - `index.ts`: Barrel export for all of `lib/`.
-    - `testing.ts`: Testing utilities for the library.
-    - `dev.ts`: Build-time utilities for the library.
-  - `src/components/`: UI components.
-    - `{ComponentName}/`: Isolated component directory.
-    - `index.ts`: Barrel export for all components.
-    - `testing.ts`: Component-specific testing utilities.
-  - `src/static/`: Static assets (`.html`, `.css`, `.js`) directly in this directory (no subdirectories).
-  - `src/app/` (Services only): Page definitions.
-    - `{page}.tsx`: Single file per page, inlining the component in `createPage`.
-    - `{path}/{page}.tsx`: Nested routing structure.
-  - Top-level `src/index.ts`, `src/testing.ts`, and `src/dev.ts` should only re-export from `lib/` or `components/`.
-
-## 📝 Coding Conventions
-
-### Package Naming Convention
-
-All packages use the `@ermnvldmr/` namespace:
-
- `@ermnvldmr/eslint-config` - Shared ESLint configurations
- `@ermnvldmr/rsbuild-config` - Shared Rsbuild configurations
- `@ermnvldmr/storybook-config` - Shared Storybook configurations
- `@ermnvldmr/stl` - Standard Type Library
- `@ermnvldmr/ui` - Component library
- `@ermnvldmr/i18n` - Internationalization utilities
- `@ermnvldmr/www` - Main website service
- `@ermnvldmr/static` - Static landing pages service
- `@ermnvldmr/docs` - Documentation service
-
-### TypeScript Guidelines
-
- **Strict Mode**: All TypeScript strict checks must pass
- **No 'any'**: The use of `any` is strictly prohibited. Use `unknown` if the type is truly unknown, or define proper generic constraints.
- **No 'ts-ignore' or 'ts-expect-error'**: Never suppress compiler errors. If a third-party library has missing types, provide a local declaration file (.d.ts) instead.
- **No Unsafe Assertions**: Avoid `as any` or `as T` assertions. Prefer type guards, `instanceof` checks, or proper schema validation (e.g., Zod) to narrow types.
- **Explicit Types**: Avoid type inference for public APIs; prefer explicit type definitions for exports.
- **Interface First**: Use interfaces for component props and public APIs.
- **Cross-Package Types**: Export types from packages for service consumption.
-
-### TSDoc Documentation Requirements
-
-**MANDATORY for all exported elements**: types, functions, constants, components
-
-```typescript
-/**
- * Combines class names using clsx and tailwind-merge for consistent styling.
- *
- * @param inputs - Class name inputs to combine
- * @returns Combined and deduplicated class string
- *
- * @example
- * \`\`\`typescript
- * cn('px-4 py-2', 'bg-blue-500', 'px-6') // 'py-2 bg-blue-500 px-6'
- * cn('text-lg', condition && 'font-bold') // 'text-lg font-bold'
- * \`\`\`
- */
-export function cn(...inputs: ClassValue[]): string {
-  return twMerge(clsx(inputs));
-}
-```
-
-### Internationalization (i18n) Guidelines
-
- **Package**: Use the `@ermnvldmr/i18n` package for all translations across services.
- **Keyset Pattern**: Create `.i18n.ts` files alongside components that require translation.
- **Russian Translation Style**: Embrace the Russian language fully. Prefer phonetic transliteration/transcription for global brand names and descriptive terms over keeping them in English.
-  - **Brands**: 'GitHub' → 'ГитХаб', 'Instagram' → 'Инстаграм', 'Telegram' → 'Телеграм'.
-  - **Descriptive**: 'Email' → 'Электропочта'.
- **Source of Truth**: The English locale (`en`) serves as the primary reference for keys and structure.
-
-### Component Development Patterns
-
-#### UI Package Components
-
-```typescript
-/**
- * Props for the Button component.
- */
-export interface ButtonProps {
-  /** The button content */
-  children: React.ReactNode;
-  /** Visual style variant */
-  variant?: 'default' | 'destructive' | 'outline' | 'secondary' | 'ghost' | 'link';
-  /** Button size */
-  size?: 'default' | 'sm' | 'lg' | 'icon';
-}
-
-/**
- * Versatile button component with multiple variants and sizes.
- */
-export const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
-  ({ className, variant = 'default', size = 'default', ...props }, ref) => {
-    return (
-      <button
-        className={cn(buttonVariants({ variant, size, className }))}
-        ref={ref}
-        {...props}
-      />
-    );
-  }
-);
-```
-
-### File Naming Conventions
-
- **Components**: PascalCase (e.g., `Button.tsx`, `NavigationMenu.tsx`)
- **Utilities**: camelCase (e.g., `cn.ts`, `formatters.ts`)
- **Constants**: UPPER_SNAKE_CASE for exports (e.g., `API_ENDPOINTS`)
- **Types**: PascalCase with descriptive suffixes (e.g., `ButtonProps`, `ApiResponse`)
- **Config Files**: kebab-case (e.g., `rsbuild-config`, `eslint-config`)
-
-### Module Structure Patterns
-
-#### Package Structure
-
-```
-packages/ui/
-├── .config/
-│   ├── vitest/
-│   │   └── setup.ts
-│   └── storybook/
-│       ├── main.ts
-│       └── preview.tsx
-├── src/
-│   ├── components/           # Component categories
-│   │   ├── index.ts         # Production barrel
-│   │   ├── testing.ts       # Testing barrel
-│   │   └── Button/          # Isolated component
-│   ├── lib/                  # Core logic
-│   │   ├── index.ts
-│   │   ├── testing.ts
-│   │   └── dev.ts
-│   ├── static/               # Flat static assets (CSS, etc.)
-│   ├── index.ts              # Main entry point (runtime)
-│   ├── testing.ts            # Testing entry point
-│   └── dev.ts                # Dev entry point
-├── package.json
-├── rsbuild.config.ts
-└── tsconfig.json
-```
-
-#### Service Structure (www example)
-
-```
-services/www/
-├── .config/
-│   ├── vitest/
-│   │   └── setup.ts
-│   └── storybook/
-├── src/
-│   ├── app/                 # Single file per page
-│   │   ├── index.tsx        # Inlined createPage
-│   │   └── articles/
-│   ├── components/          # layouts, widgets
-│   ├── lib/                 # core, shared
-│   ├── static/              # global.css, index.html
-│   ├── index.ts
-│   └── ...
-├── public/                 # Direct static assets (images)
-├── rsbuild.config.ts
-└── package.json
-```
-
-## 🎨 Design System (UI Package)
-
-### Component Organization
-
- **Generic Components**: Layout utilities (Stack, VStack, HStack)
- **Themed Components**: Paper-themed variants with consistent styling
- **Radix Integration**: Accessibility-first components using Radix UI
- **Storybook Stories**: Every component has comprehensive documentation
-
-### Styling Approach
-
- **Tailwind CSS v4+**: Utility-first CSS framework
- **Class Variance Authority**: Type-safe variant generation
- **Custom Design Tokens**: Consistent spacing, colors, typography
- **Responsive Design**: Mobile-first responsive patterns
-
-### Component Categories
-
-```typescript
-// Generic Layout Components
-export { Stack } from './components/generic/Stack/Stack';
-export { VStack } from './components/generic/VStack/VStack';
-export { HStack } from './components/generic/HStack/HStack';
-
-// Themed Components (Paper)
-export { Button } from './components/paper/PaperButton/Button';
-export { Separator } from './components/paper/PaperSeparator/Separator';
-```
-
-## ⚙️ Configuration Management
-
-### Shared Configurations
-
-Each configuration package provides standardized setups:
-
-#### ESLint Configuration
-
-```javascript
-// Provides: base, react configurations
-import { baseConfig } from '@ermnvldmr/eslint-config/dev';
-```
-
-#### Vitest Configuration
-
-```typescript
-// Provides: base, react configurations from rsbuild-config
-import { baseVitestConfig, reactVitestConfig } from '@ermnvldmr/rsbuild-config/dev';
-import { mergeConfig } from 'vitest/config';
-```
-
-#### Rsbuild Configuration
-
-```typescript
-// Provides: definePackageConfig, defineServiceConfig
-import { definePackageConfig } from '@ermnvldmr/rsbuild-config/dev';
-```
-
-### Service Configuration Inheritance
-
-Services inherit from shared configs but can override:
-
-```typescript
-// In service package.json devDependencies
-"@ermnvldmr/eslint-config": "workspace:*"
-"@ermnvldmr/rsbuild-config": "workspace:*"
-```
-
-## 🚀 Build & Deployment
-
-### Build Dependencies
-
-The monorepo must respect a strict build order due to package dependencies:
-
-1. **Configuration packages** (eslint-config, rsbuild-config, etc.) - Foundation tooling
-2. **STL package** - Shared utilities and types
-3. **UI package** - Component library (depends on STL)
-4. **Services** - Applications that consume packages (www, docs)
-
-### CI/CD Pipeline Structure
-
-The repository uses path-based CI/CD triggers - each package and service has dedicated workflows in `.github/workflows/`. Examine the workflow files to understand:
-
- **Trigger Patterns**: Which file changes activate each pipeline
- **Build Dependencies**: How packages are built in sequence
- **Quality Gates**: Linting, type-checking, and testing requirements
- **Deployment Targets**: Where each service is deployed
-
-## 🔧 Development Environment
-
-### Prerequisites
-
- **Node.js**: v20+
- **pnpm**: v9.12.3+
- **TypeScript**: v5.8+
- **Hugo**: v0.110.0+ (for docs service)
-
-### Initial Setup
-
-To start development, follow the dependency hierarchy:
-
-1. **Install dependencies** using the root `package.json` scripts
-2. **Build configuration packages** first (check packages ending in `-config`)
-3. **Build library packages** in dependency order (STL before UI)
-4. **Start services** after dependencies are built
-
-### Development Commands
-
-The monorepo provides scripts at multiple levels:
-
- **Root Level**: Check root `package.json` for monorepo-wide operations
- **Package Level**: Each package has its own build, test, and development scripts
- **Service Level**: Services have development servers, build commands, and testing
-
-Use pnpm workspace filtering (`--filter`) to target specific packages or services. Examine individual `package.json` files to discover available scripts for each component.
-
-## 🧪 Testing Strategy
-
-### Testing Framework Distribution
-
- **Shared Configuration**: Vitest configs in `@ermnvldmr/rsbuild-config`
- **Package Testing**: Each package has its own test suite
- **Service Testing**: Services test their specific functionality
- **Component Testing**: UI package uses React Testing Library with Vitest
- **Storybook Testing**: Visual regression and interaction testing
-
-### Test Organization
-
-```typescript
-// Package-level testing (packages/stl/src/functions/cn/cn.test.ts)
-describe('cn function', () => {
-  it('combines class names correctly', () => {
-    expect(cn('px-4', 'py-2')).toBe('px-4 py-2');
-  });
-});
-
-// Component testing (packages/ui/src/components/paper/Button/Button.test.tsx)
-describe('components/paper/Button/Button', () => {
-  it('renders with correct variant', () => {
-    render(<Button variant="destructive">Test</Button>);
-    expect(screen.getByRole('button')).toHaveClass('destructive');
-  });
-});
-```
-
-### Coverage Strategy
-
- **Package Coverage**: Individual coverage reports per package
- **Service Coverage**: Service-specific coverage including Storybook tests
- **Aggregated Coverage**: Combined reporting for the entire monorepo
-
---
-
-_This guide serves as the architectural foundation for the monorepo. Focus on these stable patterns and structures rather than specific implementation details that may change over time._
-
-## 🤖 AI Agent Best Practices
-
-The following are explicit best practices and preferences intended for AI tools and agents operating within this repository:
-
- **Build System Preference**: Rsbuild and Rspack are the standard and strongly preferred build tools for all projects in this monorepo due to their Rust-based architecture and performance. Do not introduce Vite, Astro, or Webpack unless strictly necessary.
- **Framework Preference**: The monorepo has migrated away from Astro in favor of React + Rsbuild (with MDX support).
- **Content Sites**: Rspress is the preferred infrastructure for any new content-heavy or documentation sites.
+## 3. Setup & Commands
+
+### CLI Commands
+
+- **Install dependencies**: `pnpm install`
+- **Development servers**:
+  - Website (`services/www`): `pnpm www:dev` (or `pnpm dev:www`)
+  - Documentation (`services/docs`): `pnpm docs:dev` (or `pnpm dev:docs`)
+  - UI Component Storybook (`packages/ui`): `pnpm ui:storybook`
+  - Static landings (`services/static`): `pnpm static:dev` (or `pnpm dev:static`)
+  - UI package build watcher: `pnpm ui:dev`
+- **Build**:
+  - Full workspace build: `pnpm build`
+  - Workspace package dependencies only: `pnpm build:deps`
+  - Individual package build: `pnpm --filter @ermnvldmr/ui build`
+- **Linting & Formatting**:
+  - Lint workspace: `pnpm lint`
+  - Typecheck workspace: `pnpm typecheck`
+  - Format files: `pnpm format`
+- **Testing**:
+  - Run full test suite: `pnpm test`
+  - Test single package: `pnpm --filter @ermnvldmr/ui test`
+  - Test single file: `pnpm --filter @ermnvldmr/ui exec vitest run src/components/Button/Button.test.tsx`
+  - Test coverage: `pnpm test:coverage`
+
+### Environment Setup
+
+- Environment variables are managed using `@dotenvx/dotenvx`.
+- `.env.dev` contains encrypted values and is tracked in git.
+- `.env.keys` contains local decryption keys (`DOTENV_PRIVATE_KEY`) and must never be committed.
+- Environment variables:
+  - `LOCALE`: Target build language (`en` or `ru`, defaults to `en`).
+  - `RSDOCTOR`: Set `RSDOCTOR=true` during build to trigger Rsbuild bundle analysis.
+  - S3 static sync credentials: `COM_ERMNVLDMR_STATIC_S3_BUCKET`, `COM_ERMNVLDMR_STATIC_S3_REGION`, `COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL`, `COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID`, `COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY`.
+
+## 4. Non-Negotiable Coding Rules & Patterns
+
+### Typing & Documentation Rules
+
+- **Strict TypeScript**: `strict: true` is enforced globally.
+- **Forbidden Types**: `any` is strictly prohibited (`@typescript-eslint/no-explicit-any: error`).
+- **Forbidden Assertions**: Type assertions (`as Type`) are strictly prohibited (`@typescript-eslint/consistent-type-assertions: ['error', { assertionStyle: 'never' }]`). Use explicit type guards or type casting helpers (e.g., `castRef` from `@ermnvldmr/stl`).
+- **Forbidden Non-Null Assertion**: Non-null assertion operator (`!`) is prohibited (`@typescript-eslint/no-non-null-assertion: error`).
+- **Explicit Type Imports**: Imports used strictly for types MUST use `import type` (`@typescript-eslint/consistent-type-imports: error`).
+- **Interface Definitions**: Object shapes MUST use `interface`, not `type` aliases (`@typescript-eslint/consistent-type-definitions: ['error', 'interface']`).
+- **TSDoc Requirements**: JSDoc comments are required on all exported function declarations, interfaces, and type declarations (`jsdoc/require-jsdoc: error`). A description string is mandatory (`jsdoc/require-description: error`).
+
+### Component Architecture & Structure
+
+- Component implementations in `packages/ui` MUST live in dedicated PascalCase subdirectories:
+  `packages/ui/src/components/<ComponentName>/`
+  - `<ComponentName>.tsx` — Component logic and JSX
+  - `<ComponentName>.stories.tsx` — Storybook stories
+  - `<ComponentName>.test.tsx` — Vitest unit tests
+- **Styling**: Component variant logic must use `cva` (class-variance-authority). Utility class merging must use `cn(...)` from `@ermnvldmr/stl`.
+- **Accessibility**: Interactive elements must leverage `react-aria` hooks (`useButton`, `useFocusRing`, `useHover`) to maintain accessibility standards.
+- **Naming Conventions**:
+  - PascalCase for React component files and directories (`Button/Button.tsx`).
+  - camelCase for helper modules, hooks, and utilities (`path.ts`, `useTheme.ts`).
+  - kebab-case for configuration files (`eslint.config.mjs`, `postcss.config.mjs`).
+
+### State Management & Import Rules
+
+- **State Primitives**: Use standard React state (`useState`, `useReducer`, `useContext`) and `react-stately` / `react-aria` primitives. Do not introduce unapproved third-party state managers.
+- **Monorepo Relative Imports**: Code inside a package or service MUST use relative paths when referencing files within that same package. Importing the package's own published name inside itself (e.g. `import ... from '@ermnvldmr/ui'` inside `packages/ui`) is strictly prohibited and fails ESLint checks.
+
+### Anti-Patterns ("What NOT to do")
+
+- **DO NOT** use `any`, `as Type` assertions, or `!` non-null assertions.
+- **DO NOT** introduce Vite, Webpack, or Next.js configurations. Rsbuild (Rspack) is the monorepo's standardized React bundler.
+- **DO NOT** use self-referential package imports within workspace packages; use relative paths.
+- **DO NOT** suppress linter or compiler errors with `@ts-ignore`, `@ts-nocheck`, or inline eslint disables without explicit user approval.
+- **DO NOT** commit unencrypted `.env` files or secret keys (`.env.keys`).
+- **DO NOT** run destructive Git operations (such as force pushing to `main`/`next` or dropping uncommitted user work) without authorization.
+
+## 5. Critical Workflows & Safety Directives
+
+### Verification Workflow
+
+Before completing any task, run and pass every step in the following sequence:
+
+1. `pnpm typecheck` — 0 TypeScript compiler errors.
+2. `pnpm lint` — 0 ESLint warnings (`--max-warnings 0`).
+3. `pnpm test` — All unit and component tests passing.
+4. `pnpm build` — Clean workspace compilation.
+
+### Protected Boundaries
+
+The agent MUST NOT modify the following files or directories unless explicitly requested by the user:
+
+- `.env.keys` (untracked decryption keys).
+- `pnpm-lock.yaml` (dependencies must be managed exclusively through `pnpm` CLI commands).
+- `LICENSE` file.
+- `services/docs/content/` and `services/www/content/` creative and literary works.
@@ -1,6 +1,5 @@
 # [ermnvldmr.com](https://ermnvldmr.com)

-[![codecov](https://codecov.io/gh/deytenit/ermnvldmr.com/graph/badge.svg)](https://app.codecov.io/github/deytenit/ermnvldmr.com)

 The monorepo powering the front pages of my own

@@ -29,9 +28,12 @@ Composite (see [Copyright & License](#copyright--license))

 #### Packages

- **[@ermnvldmr/ui](./packages/ui)**: Shared React component library and design system.
- **[@ermnvldmr/stl](./packages/stl)**: Standard Template Library – common utilities and reusable logic.
+- **[@ermnvldmr/ui](./packages/ui)**: Shared React component library and design system primitives.
+- **[@ermnvldmr/kits](./packages/kits)**: High-level application & layout component kits (`BentoGrid`, `InfoCard`, `PageHead`, `Page`, `Time`, `Markdown`, `ThemeSwitch`).
+- **[@ermnvldmr/stl](./packages/stl)**: Standard Types Library – core utilities, type definitions, and React helpers.
 - **[@ermnvldmr/i18n](./packages/i18n)**: Internationalization utilities.
+- **[@ermnvldmr/ssg](./packages/ssg)**: Build-time Static Site Generation plugin for Rsbuild.
+- **[@ermnvldmr/cli](./packages/cli)**: Monorepo CLI utility (`ermnvldmr-cli`).
 - **[@ermnvldmr/eslint-config](./packages/eslint-config)**: Shared linting configurations.
 - **[@ermnvldmr/rsbuild-config](./packages/rsbuild-config)**: Shared build configurations (Rsbuild & Rspack).
 - **[@ermnvldmr/storybook-config](./packages/storybook-config)**: Shared Storybook configurations.
@@ -55,7 +57,7 @@ Want to contribute or understand the codebase.
  - UI Library: `pnpm ui:dev`
 - **Development Guide**: [AGENTS.md](./AGENTS.md)
 - **Component Development**: `pnpm ui:storybook`
- **Testing**: `pnpm test` or `pnpm test:coverage` (View results on [Codecov](https://app.codecov.io/github/deytenit/ermnvldmr.com))
+- **Testing**: `pnpm test` or `pnpm test:coverage`
 - **Code Quality**: `pnpm lint` and `pnpm typecheck`

 ### Designer
@@ -0,0 +1,42 @@
+#cloud-config
+# ==============================================================================
+# Cloud-Init User-Data Template for K3s Single-Node Cluster (com-ermnvldmr)
+# 
+# Usage:
+#   1. Copy this template to user-data.yaml:
+#        cp ci/cloud-init/user-data.template.yaml ci/cloud-init/user-data.yaml
+#   2. Replace the stubs below (SSH authorized key & Age private key).
+#   3. Pass user-data.yaml during VM creation in Yandex Cloud / Cloud Provider.
+#      Note: user-data.yaml is ignored by git to protect private keys.
+# ==============================================================================
+
+preserve_hostname: false
+hostname: com-ermnvldmr
+ssh_pwauth: false
+
+# ------------------------------------------------------------------------------
+# 1. User & SSH Key Configuration (Replace stub with your public SSH key)
+# ------------------------------------------------------------------------------
+users:
+  - name: adam
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLACEHOLDERFORYOURPUBLICSSHKEY user@hostname"
+
+write_files:
+  # ----------------------------------------------------------------------------
+  # 2. SOPS / Age Decryption Key (Replace stub with your private AGE key)
+  # ----------------------------------------------------------------------------
+  - path: /root/.config/sops/age/keys.txt
+    owner: root:root
+    permissions: '0600'
+    content: |
+      # public key: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+      AGE-SECRET-KEY-1PLACEHOLDERFORYOURPRIVATEAGEKEY
+
+# ------------------------------------------------------------------------------
+# 3. Bootstrap Cluster (Pre-baked script mounts disk, starts K3s, and syncs Flux)
+# ------------------------------------------------------------------------------
+runcmd:
+  - /usr/local/bin/bootstrap-cluster.sh
@@ -5,6 +5,16 @@ server {
    root /usr/share/nginx/html;
    index index.html;

+    # Prevent HTTP protocol downgrade behind reverse proxy on redirects
+    absolute_redirect off;
+
+    # Security Headers (Defense in depth)
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
    # Gzip compression
    gzip on;
    gzip_vary on;
@@ -25,13 +35,15 @@ server {
    # root is inherited from server block, so /en/static/js/file.js resolves correctly
    location ~* \.(js|css|woff|woff2|ttf|eot)$ {
        expires 1y;
-        add_header Cache-Control "public, immutable";
+        add_header Cache-Control "public, immutable" always;
+        add_header Access-Control-Allow-Origin "*" always;
    }

    # Cache images
    location ~* \.(png|jpg|jpeg|gif|ico|svg)$ {
        expires 1y;
-        add_header Cache-Control "public, no-transform";
+        add_header Cache-Control "public, no-transform" always;
+        add_header Access-Control-Allow-Origin "*" always;
    }

    # English locale — SPA fallback for non-asset routes
@@ -44,6 +56,14 @@ server {
        try_files $uri $uri/ $uri.html /ru/index.html;
    }

+    # Version probe for release rollout verification
+    location = /version.json {
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        add_header Content-Type "application/json" always;
+        add_header Access-Control-Allow-Origin "*" always;
+        try_files /version.json =404;
+    }
+
    # Error pages
    error_page 404 /en/index.html;
 }
@@ -1,6 +0,0 @@
-# Docker Image Tags
-DOCS_TAG=$DOCS_TAG
-WWW_TAG=$WWW_TAG
-
-# Application Settings
-DOMAIN=ermnvldmr.com
@@ -1,61 +0,0 @@
-name: com-ermnvldmr
-
-services:
-  nginx:
-    image: nginx:1.28-alpine
-    container_name: com-ermnvldmr-nginx
-    restart: always
-    ports:
-      - '80:80'
-      - '443:443'
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./nginx/conf.d:/etc/nginx/conf.d:ro
-      - /etc/letsencrypt:/etc/letsencrypt:ro
-    networks:
-      - com-ermnvldmr-direct
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.50'
-          memory: 256M
-    security_opt:
-      - no-new-privileges:true
-
-  docs:
-    image: ghcr.io/deytenit/ermnvldmr.com/docs:${DOCS_TAG}
-    container_name: com-ermnvldmr-docs
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-  www:
-    image: ghcr.io/deytenit/ermnvldmr.com/www:${WWW_TAG}
-    container_name: com-ermnvldmr-www
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-networks:
-  com-ermnvldmr-direct:
-    name: com-ermnvldmr-direct
-    driver: bridge
-  com-ermnvldmr-enclave:
-    name: com-ermnvldmr-enclave
-    internal: true
-    driver: bridge
@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name docs.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name docs.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/docs.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/docs.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-docs:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name www.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name www.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/www.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/www.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-www:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
@@ -1,30 +0,0 @@
-user nginx;
-worker_processes auto;
-error_log /var/log/nginx/error.log warn;
-pid /var/run/nginx.pid;
-
-events {
-    worker_connections 1024;
-}
-
-http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    # Optimization
-    sendfile on;
-    tcp_nopush on;
-    tcp_nodelay on;
-    keepalive_timeout 65;
-    types_hash_max_size 2048;
-    server_tokens off;
-
-    # Security Headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer-when-downgrade" always;
-    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
-
-    include /etc/nginx/conf.d/*.conf;
-}
@@ -14,8 +14,15 @@ RUN hugo --gc --minify
 # Stage 2: Runtime
 FROM nginx:alpine

+ARG COMMIT_SHA="unknown"
+ARG VERSION="latest"
+
 COPY --from=builder /src/services/docs/public /usr/share/nginx/html
 COPY ci/config/nginx/default.conf /etc/nginx/conf.d/default.conf

+# Generate version metadata for automated rollout verification
+RUN printf '{\n  "service": "docs",\n  "version": "%s",\n  "commit": "%s",\n  "builtAt": "%s"\n}\n' \
+    "${VERSION}" "${COMMIT_SHA}" "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" > /usr/share/nginx/html/version.json
+
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
@@ -13,9 +13,12 @@ COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
 # Copy all package.json files to allow pnpm to fetch dependencies
 COPY packages/eslint-config/package.json ./packages/eslint-config/
 COPY packages/rsbuild-config/package.json ./packages/rsbuild-config/
+COPY packages/ssg/package.json ./packages/ssg/
 COPY packages/stl/package.json ./packages/stl/
 COPY packages/storybook-config/package.json ./packages/storybook-config/
 COPY packages/ui/package.json ./packages/ui/
+COPY packages/kits/package.json ./packages/kits/
+COPY packages/cli/package.json ./packages/cli/
 COPY packages/i18n/package.json ./packages/i18n/
 COPY services/www/package.json ./services/www/

@@ -26,10 +29,7 @@ RUN pnpm install --frozen-lockfile
 COPY . .

 # Build dependencies
-RUN pnpm --filter @ermnvldmr/rsbuild-config build
-RUN pnpm --filter @ermnvldmr/stl build
-RUN pnpm --filter @ermnvldmr/i18n build
-RUN pnpm --filter @ermnvldmr/ui build
+RUN pnpm build:deps

 # Build the website (all locales)
 RUN pnpm --filter @ermnvldmr/www build:all
@@ -37,8 +37,15 @@ RUN pnpm --filter @ermnvldmr/www build:all
 # Stage 2: Runtime
 FROM nginx:alpine

+ARG COMMIT_SHA="unknown"
+ARG VERSION="latest"
+
 COPY --from=builder /app/services/www/dist /usr/share/nginx/html
 COPY ci/config/nginx/default.conf /etc/nginx/conf.d/default.conf

+# Generate version metadata for automated rollout verification
+RUN printf '{\n  "service": "www",\n  "version": "%s",\n  "commit": "%s",\n  "builtAt": "%s"\n}\n' \
+    "${VERSION}" "${COMMIT_SHA}" "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" > /usr/share/nginx/html/version.json
+
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docs
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: docs
+  template:
+    metadata:
+      labels:
+        app: docs
+    spec:
+      containers:
+        - name: docs
+          image: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs:sha-91f5245
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+- deployment.yaml
+- service.yaml
+images:
+- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs
+  newTag: sha-84772ff
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: docs-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: docs
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgres-config
+  namespace: com-ermnvldmr
+data:
+  postgresql.conf: |
+    # Low-memory tuned configuration for single-node K3s VM
+    listen_addresses = '*'
+    max_connections = 50
+    shared_buffers = 64MB
+    effective_cache_size = 128MB
+    maintenance_work_mem = 16MB
+    checkpoint_completion_target = 0.9
+    wal_buffers = 2MB
+    default_statistics_target = 100
+    random_page_cost = 1.1
+    effective_io_concurrency = 200
+    work_mem = 4MB
+    min_wal_size = 80MB
+    max_wal_size = 512MB
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+  - configmap.yaml
+  - secret.sops.yaml
+  - pvc.yaml
+  - statefulset.yaml
+  - service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-pvc
+  namespace: com-ermnvldmr
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 5Gi
@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: postgres-secrets
+    namespace: com-ermnvldmr
+type: Opaque
+stringData:
+    POSTGRES_DB: ENC[AES256_GCM,data:ChvCjVw=,iv:97n6Q+WzbVOwvRZGGHAfBXQDPx5mnUCSsUNs76xV1p4=,tag:mZLUB3q0UR+9ovqmndFrRg==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:V1q4xfE=,iv:RPHHhWLkdmKHG6CMubrw8JUfHlDXnL0x76JEo05O+mo=,tag:PV1YEyqeb8bTF/98SL1uKQ==,type:str]
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:aBWfOuPyeAEo0vf8fAYzlTfXooPKX6FPbHkpBQ+4zve0KBQh7/yvjQ==,iv:FB/fZoLirzPTbDIel7wRECQP85sFFlIdyoljrilbMxU=,tag:tTZz1PHhaLtmPO9Pg8Vh5g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRWFNtaHhPbmlodUZXSFgy
+            S1YwUjc4ZnZWdy9TM1NiejdrRHJuZnR5aG5rCjJrMWY2OXExZkpmUHpUNTE1T05x
+            dzBYbmI3ZmVHRlhXaHk5dFFEMjIxUUUKLS0tIEd0L2N4TUsxV0tjWm81cUQ4dVdS
+            WDVuSGxuNVAxeVk2UUdhQnFDV1FZOW8K4Fc8T/XM+E6F0iOqpSMbh/pOAI2vq3am
+            9rMDxzwfIL9hwNDoy5LVPdnBfOXlCoZ8OnMR9Euj8FBW6pHErkmBUA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age15zq3cje3ttmx2fhqp9cpeght6feq2w8e5m38799stjetj8urcccs36r4rc
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0K3k2cis1T3hrSmZGa2hq
+            ME1VQy9HSG5MWUhjdXgzb0cwNitYY1ZvRVI4Cm0vYXptOW9TUDJFZzZvNEJLOHJB
+            VnhnK1hOWUgxd2E1VmFDbFJPZUlQajAKLS0tIEszV0FRMHoyQ2lFUm5IWGtnVUNH
+            Q244Nmd2czZXSmxEMnk3cWV1bm8rS28KGyANylD4EQkhWKDHwmGQHyAm1ZjA5acw
+            VisJZnJ9KuFPB2Toi7FTMeHRNYPk1uXgwKoDFLSrzMElPXWDWm4B7A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:tvk/U3XXcRrJCI8I0yUID6jwnlPc1ftiOHs8uxqrbAtLN3KelHGy94fWyxYMoboHeh5R8pNErIxk9EsJok2wjrSENZWMXueVZHtMUWlyC4DhTDAVVYhJ6sL85f6cMiHWDNSlTk4AvfWvdvE6b/0coZ7Rybgw5kNeW6Stw4CSbu4=,iv:sfiOamzam1e0t01KaGHSsnZOBpBGEi3K0KK50QDmaFs=,tag:Ul6xShhIdvTuX3qS6Uo4Kg==,type:str]
+    version: 3.13.3
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-secrets
+  namespace: com-ermnvldmr
+type: Opaque
+stringData:
+  POSTGRES_DB: "umami"
+  POSTGRES_USER: "umami"
+  POSTGRES_PASSWORD: "CHANGE_ME_IN_ENCRYPTED_SOPS_SECRET"
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: com-ermnvldmr
+spec:
+  serviceName: postgres-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_DB
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_PASSWORD
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - name: postgres
+              containerPort: 5432
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: config
+              mountPath: /etc/postgresql/postgresql.conf
+              subPath: postgresql.conf
+          readinessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - $(POSTGRES_USER)
+                - -d
+                - $(POSTGRES_DB)
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - $(POSTGRES_USER)
+                - -d
+                - $(POSTGRES_DB)
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 5
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: postgres-pvc
+        - name: config
+          configMap:
+            name: postgres-config
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: umami-config
+  namespace: com-ermnvldmr
+data:
+  DATABASE_TYPE: "postgresql"
+  CLIENT_IP_HEADER: "X-Forwarded-For"
+  TRACKER_SCRIPT_NAME: "trace.js"
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: umami
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: umami
+  template:
+    metadata:
+      labels:
+        app: umami
+      annotations:
+        config/tracker-script-name: "trace.js"
+    spec:
+      containers:
+        - name: umami
+          image: ghcr.io/umami-software/umami:postgresql-v2.14.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+          envFrom:
+            - configMapRef:
+                name: umami-config
+            - secretRef:
+                name: umami-secrets
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              path: /api/heartbeat
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /api/heartbeat
+              port: 3000
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+  - configmap.yaml
+  - secret.sops.yaml
+  - deployment.yaml
+  - service.yaml
+images:
+  - name: ghcr.io/umami-software/umami
+    newTag: postgresql-v2.14.0
@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: umami-secrets
+    namespace: com-ermnvldmr
+type: Opaque
+stringData:
+    APP_SECRET: ENC[AES256_GCM,data:aaoXs+F/lXvP0kHNZ+Uoo0HB4GnYZ9raYOgEbRwIrkSFGSoTuv/PkvSOYDppDLKxhNMDLhbgTJwEMrHGZzIewQ==,iv:W3u4QPKetqBDSZdsRte5zYeFy9SlRmPw4ORGFTGzN7A=,tag:bkVyGsKgcMGODY4Chpv+8Q==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:XbAdd3hNGS+n42XgTQF5rg7AiBkbjFGHOeuTROLgjmIMCUh7afPSheFn6v8bSaibePYJdQBrdFK+kYW9o7aFYhe8Hz1cneATNP0PoQaqlxSrcnM+DeHQzFTC+98ACkskLgk27heZFjCdRr3A4LVRdcet/+2q/8U=,iv:UwxEwPeYdPYrvi30qso4yCZ6m20geusN+P7DOjowjEw=,tag:bQB7OupyNnCjn0INB8T7sg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4SHJWSm54SHorbTZBOGtF
+            VkRrQlpHbTgxSkh3L2ljZW42emEzQlBHa0hvCmxuQ3VjR2hQNzVlZ3FVS2Q3THp4
+            SEZGa09EM1BYSlUxWEtuMGp0Tld3R3cKLS0tIEcwcUd6ZkdDdTAvMDFtSGpCZ3ls
+            TVJYdHRDMXlWVmx4WStsT2hGUUZkeEkK26wJbgH0yvKPFXR4TC2rdeBD0axAs4WU
+            rfJ8MWet6AbEAyOmiAjigNbM9bJwGlDW1UThnGQ/fFQfJW6U4T1Tgw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age15zq3cje3ttmx2fhqp9cpeght6feq2w8e5m38799stjetj8urcccs36r4rc
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVUt1UlNLTHZmV1djWEZp
+            akVLUnliV2VQY0dzSmVMdmxMRTRoL2FWZm5rCm1WWkZPK2tEWW4rNVRObktuVVdk
+            cEdNTHd6V2t6ZjVRMWhRbk5GNXpFdjgKLS0tIHZoZS9wblR1bTFkMzV4OWxLSm5B
+            QWpwUG93dTc5MGNBbjAyVnNWMlRJblEK8ZRPL4/aCSKjPUg1K+kH9IigwZX1tB1U
+            Y1P8IYiuTJ+YD/UcQyh0Pp2d8l5gQsTc1ES9388wcKBKMeKHV9FqYg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:QZOb7pmfDpEn2/kefQQ8k4WJQddlF5jKTY5EaSm1Srt33DceELA3NPJMiozAzpbIEoLR6a7oR6C7zofHHVCBmYcRd2DSHqafW3EOtOt5noiAmkGOQKEWH7aSRFJqcy5EmBcVihd81Z1CkJI6MPcBeQvY0BlVqgm2YqX2QQBolgI=,iv:TB+Rn3ffe4HzVHjk2+XaKaLG1+589AmBhPjOXXKWHto=,tag:zfKVYP1h/4sWXSVtuhQH8Q==,type:str]
+    version: 3.13.3
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: umami-secrets
+  namespace: com-ermnvldmr
+type: Opaque
+stringData:
+  APP_SECRET: "CHANGE_ME_IN_ENCRYPTED_SOPS_SECRET"
+  DATABASE_URL: "postgresql://umami:CHANGE_ME@postgres-service.com-ermnvldmr.svc.cluster.local:5432/umami"
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: umami-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: umami
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: www
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: www
+  template:
+    metadata:
+      labels:
+        app: www
+    spec:
+      containers:
+        - name: www
+          image: git.ermnvldmr.com/deytenit/ermnvldmr.com/www:sha-6d33b71
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+- deployment.yaml
+- service.yaml
+images:
+- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/www
+  newTag: sha-84772ff
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: www-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: www
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: com-ermnvldmr
+  labels:
+    name: com-ermnvldmr
@@ -0,0 +1,31 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: ermnvldmr-repo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://git.ermnvldmr.com/deytenit/ermnvldmr.com.git
+  secretRef:
+    name: gitea-readonly
+  ref:
+    branch: next
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-sync
+  namespace: flux-system
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: ermnvldmr-repo
+  path: ./ci/k8s/clusters/production
+  prune: true
+  wait: true
+  timeout: 3m
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gotk-sync.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - flux-system
+  - ../../base/namespaces
+  - ../../infrastructure/cert-manager
+  - ../../infrastructure/networking
+  - ../../apps/postgres
+  - ../../apps/umami
+  - ../../apps/www
+  - ../../apps/docs
@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: admin@ermnvldmr.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: admin@ermnvldmr.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - install.yaml
+  - cluster-issuer.yaml
@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: beacon-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-strip-beacon@kubernetescrd
+    traefik.ingress.kubernetes.io/router.priority: "100"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - www.ermnvldmr.com
+      secretName: ermnvldmr-tls
+    - hosts:
+        - docs.ermnvldmr.com
+      secretName: docs-ermnvldmr-tls
+  rules:
+    - host: www.ermnvldmr.com
+      http:
+        paths:
+          - path: /trace
+            pathType: Prefix
+            backend:
+              service:
+                name: umami-service
+                port:
+                  number: 3000
+    - host: docs.ermnvldmr.com
+      http:
+        paths:
+          - path: /trace
+            pathType: Prefix
+            backend:
+              service:
+                name: umami-service
+                port:
+                  number: 3000
@@ -0,0 +1,80 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: www-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-sec-headers-common@kubernetescrd,com-ermnvldmr-sec-headers-www@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - www.ermnvldmr.com
+      secretName: ermnvldmr-tls
+  rules:
+    - host: www.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: www-service
+                port:
+                  number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: docs-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-sec-headers-common@kubernetescrd,com-ermnvldmr-sec-headers-docs@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - docs.ermnvldmr.com
+      secretName: docs-ermnvldmr-tls
+  rules:
+    - host: docs.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: docs-service
+                port:
+                  number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: umami-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-sec-headers-common@kubernetescrd,com-ermnvldmr-sec-headers-umami@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - umami.ermnvldmr.com
+      secretName: umami-ermnvldmr-tls
+  rules:
+    - host: umami.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: umami-service
+                port:
+                  number: 3000
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress.yaml
+  - middleware-strip-beacon.yaml
+  - ingress-beacon.yaml
+  - middleware-sec-headers-common.yaml
+  - middleware-sec-headers-www.yaml
+  - middleware-sec-headers-docs.yaml
+  - middleware-sec-headers-umami.yaml
@@ -0,0 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-common
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    stsSeconds: 63072000
+    stsIncludeSubdomains: true
+    stsPreload: true
+    forceSTSHeader: true
+    customFrameOptionsValue: "DENY"
+    contentTypeNosniff: true
+    browserXssFilter: false
+    referrerPolicy: "strict-origin-when-cross-origin"
+    customResponseHeaders:
+      Cross-Origin-Opener-Policy: "same-origin"
+      Permissions-Policy: "camera=(), microphone=(), geolocation=(), browsing-topics=()"
@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-docs
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    contentSecurityPolicy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://static.ermnvldmr.com; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; require-trusted-types-for 'script'; trusted-types default; upgrade-insecure-requests;"
@@ -0,0 +1,10 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-umami
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    contentSecurityPolicy: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests;"
+    customResponseHeaders:
+      Content-Security-Policy-Report-Only: "require-trusted-types-for 'script'; trusted-types default;"
@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-www
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    contentSecurityPolicy: "default-src 'self'; script-src 'self' 'sha256-gUpIj4OcSwECFlSp351SCYJAe1wTOCQlrKBlASuO3CY=' 'sha256-3VjVzYfJpuNMLKyrxQTIc8ACxv37paQ4Talwg1s/7N0='; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://static.ermnvldmr.com; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; require-trusted-types-for 'script'; trusted-types default; upgrade-insecure-requests;"
@@ -0,0 +1,9 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-beacon
+  namespace: com-ermnvldmr
+spec:
+  stripPrefix:
+    prefixes:
+      - /trace
@@ -0,0 +1,2 @@
+instance-id: debian-packer
+local-hostname: debian-k3s
				`@@ -0,0 +1 @@`
				`[git.ermnvldmr.com]:22222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXcvf3Lds3AKfGHGh00IWR9tSRbBBqrV/CC6JBGmcrD`