ci(www): separate release and deploy into manual gated workflows

## Summary

- **Cloudflare R2 Migration**:
- Migrated `static.ermnvldmr.com` asset storage to Cloudflare R2 bucket
`com-ermnvldmr-static` (location `WEUR`).
- Added support for `COM_ERMNVLDMR_STATIC_PUBLIC_URL` fallback in
`@ermnvldmr/cli` to properly format public asset URLs for non-dotted
bucket names.
- Relocated public CA cert to
`/dev/ssl/certs/ErmnvldmrDevelopmentRootCA.pem` and updated
`REMOTE_ROOT_CA_URL` references in `@ermnvldmr/rsbuild-config` and
`ensure-dev-certs.mjs`.
- Configured R2 CORS policies using wildcards
(`https://*.ermnvldmr.com`, `https://ermnvldmr.com`,
`https://localhost.ermnvldmr.com*`, `http://localhost*`,
`https://direct.yandex.ru`, `https://*.direct.yandex.ru`,
`https://localhost.yandex.ru*`).
  - Enforced minimum TLS 1.2 on zone `ermnvldmr.com`.
- Updated encrypted `.env.dev` and GitHub secrets in both
`deytenit/ermnvldmr.com` and `deytenit/apex.ermnvldmr.com`.

- **Multi-locale SSG Support**:
- Added `NormalModuleReplacementPlugin` to SSR runner in
`@ermnvldmr/ssg` for automatic `.en.mdx` -> `.${locale}.mdx`
substitution during Russian builds.
- Added page metadata extraction (`getPageOptions`) in `@ermnvldmr/ssg`
for pre-rendered `<title>` and `<meta name="description">` tags.
- Added unit test suite for `createPage` and updated `services/www`
build scripts (`build:all`, `build:en`, `build:ru`, `dev:en`, `dev:ru`).

.env.dev

@@ -2,11 +2,21 @@
 #/            public-key encryption for .env files          /
 #/       [how it works](https://dotenvx.com/encryption)     /
 #/----------------------------------------------------------/
+DOTENV_PUBLIC_KEY_DEV="02a9d0f6522086b04ac7763e008a6ad0273c58258715e613c977fd6c82a2030d92"
+
+# .env.dev
+#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
+#/            public-key encryption for .env files          /
+#/       [how it works](https://dotenvx.com/encryption)     /
+#/----------------------------------------------------------/
 DOTENV_PUBLIC_KEY="02a9d0f6522086b04ac7763e008a6ad0273c58258715e613c977fd6c82a2030d92"
 
 # .env
-COM_ERMNVLDMR_STATIC_S3_BUCKET="encrypted:BL1vJLB9uPSvsUvrJah4UegRU8uPdFjE7sya+Fae3rwOmVzWsK5+TP4z4YzigTAuwit4FANvANvhRV46se+ZgprYplU8Cw1tZ5mHKO4rWAjif2sJCnsGXUKp8GZ2J7PrMH35MY0YrXX4NVqe18b2NEv2B9K7"
-COM_ERMNVLDMR_STATIC_S3_REGION="encrypted:BAj3iuo7tWWNR2V4yQ+LHnFCB4JcZp7TTfUtvv+2FPntNhwc/fV95IeFWz6S0z6aPRkDG+UQzPXNwdMz7y8ZbTHbduDDrgydHu1fST1NfQd2s1Bbpf+yJTG7dPBSc5RSNKZkkpB4v55qg/UC"
-COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL="encrypted:BNkQrgsrxtz544vuJbgwWUh5cPjHG5wbmHNcxTUWrzbFJJsdncaAitviCvIrS7Q41w+FiWkssv3D05Tu8Inn2P62E6G3PU4gNxO2oLdmGEdrzUqB/xvxOvLvos42j54QOZf7lOqMPKH6SL2/rheCAo10gSCicCqkfh4xsCAbYpyL"
-COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID="encrypted:BCsp8p4bp3cB+9grxHo634isRUaFGU3MOc1lr8ClSFRYLjqjqukyrbJCTZWV2Xdo8iQ33EylmbzUltbwzTWMQcjJSvIskesVLyV93q60o/Mu9L9jg/apwHuBgHv4zVuHstJ0zkHWgapbNTIlWD3RCm0ujeX/H1gBH3U="
-COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY="encrypted:BM7aPliOyiPrqFPZMfqpn534Nu+Y0Nbh/YRoxv2KY6XAi2dNO0LSEf97DqSUQYdsnu9iibZmVNktF2K/D6mtHr9+gumF6KsmaLH65KE7c9ly7NdFQHL9I26wxRq1Sr3Zgrfs954J6oURSlBRKqJFdcTsBltuuupGuqJHyLS9+DE0jD+bl0Qg0lA="
+COM_ERMNVLDMR_STATIC_S3_BUCKET="encrypted:BE65d5I9m1jrHGVNKDmfGL3Cjb7LjhB4tVWyNzSPU1Zu5Y00+R8NXgqSBrzBnXVj3vVinibjihVt3fStegyiqI52GtSycX1NlFSVJlRFWadUJ6SVK+SYfB7sFKSJ2jKGfwRaXKMzaKCdPWY+ni685oPXU9Rp"
+COM_ERMNVLDMR_STATIC_S3_REGION="encrypted:BPQ2+ms76A+PLFUeKL1Cnz8bdOcsJou03e8AyGwzdhozpcAwhP5yWXSqhTK8ZccAvmfjJcM4NK+x2a2r4g0ALd/UaQDa9xy2eZ6QnXwkoHXu2ce+F86/HuFnzX0qWqYTWi4q+N4="
+COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL="encrypted:BCcK2ih1QrABMImpUj31KIQYlbp9zhnafzrXINAwvyCaCjbOst6UGnhhi5M3LtQ+Fhgpx52ZKGjmke1oVxnvU6BBGz/lAbSD5euhHNbJ6EIoSqc25XpcmgucIQGx1cfiJxsL4sDR95FyR3fNaS9KGr005DwQaIRKGg86gALUCPhaLekq/Sd6Nn+TDoqmigLJPozdxp33AFpmWF+EwayYae2u"
+COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID="encrypted:BPaBvzNo1eH3Z2ro+NFq4zLi4krZQT48h20r0etBfVFLDNS01gh5Uosy70Ip29rC8sa1JoP4Q8isJ2Xz0pr5Vxxa62vVFOJ9wJ6LkXbYF2bUm+UNyjfsIztJsMyiVZfPEEPEEKcniXZ3faqePwgLwCZSTa/Qry6znNmMV5FshSsP"
+COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY="encrypted:BFiOxOo/TNvSIMOjyeOswLcl+9AVdqp4axW+I46c1CL0ckSucQS+7CLpO8fNfakmW2bSibqru+xfWUbQT7FDH1YB3CPXUc0qPm1PsG0FiLixDefQuDrC/JHuA0Z3/dOAkn/e94BBuPtyJXxcLRP1v517MijPa0MuNqhI9BS3jFHKjWivqc9AVPs2ybglo14b/nEO1GqlM0TYflPoDhHoWjM="
+SOPS_AGE_KEY="encrypted:BKiJVxKYhiadu0kNCw8wVLYdaEWZreAVu2PaujxhvcXeCowCGjivEuQD/uhduAy/CwwDWyQkgQJ2FJMEKA47e7QDjS9TMdPCXO19/teR7LThgqTf6AbSM3sebln5zalgyplay4A/7cVytPXuOvVkaYyoh9CgzTVsPJKXRq5yMaDEx/9/91Yo8zUMF3z1vq3/preI5baK4/1xXewR3OwfZqnNGyd7LXkdqyT5"
+COM_ERMNVLDMR_DEV_ROOT_CA_KEY="encrypted:BP+GhCwutIMF2hSxIs92VNSoEAvfdhYRFSi5MUpFfCs+pNxJkZ7tFOAadMqSlPiLBcm9+A3yIn/04/oEtRNjXk/jlZQ2G21mt30sd89NARjJO+94ui6XbllW65E5/T+d8fDmRhz4c4OcNoKk70aXcdJqd1CJT7IlYQn++zQvB2el9cp9e7E22rvGtvum40iISEt/pVU84uHyQg6ZeCn+1czM+nLhPiWOAgveTz3EAgExlJW2de1ilDIuBCFXJy5+KvnCj3WNwRTAbIYgCwFnZMOUE5jYlhP6OZ2DQ3sWv7noG/Xaa/P+EomP9dwcamlAU32tRruyA8ZSp/ah9E8hFfmBqgKfSbRlWq3qGkq/F935DZfU/C+PjRcepS/eLZQ0mfD23B21VX2CjOhEkp5V+9I5L8XkXDjDg56JDRGvF/umpdqF/KpmtimqcgB0yDVY1Z3yT1U5IZ6Yf4WlqzhchdJXRWfo0bqK8Tk0b442/6AQgRP3n6DIrCjcpmr4jx+RJiejOr3xv3QtHGafDdkF2gO7DrYztdd6XpRjij0orBUiyYECgPsLHuwd+/2jXnxLVTavVTQ0Ddz0LLNjaYxqr8KK/B+0MeS/iuLXmACs8XCKwQmV8hPYQ0C/JXGiL4GOH0V70r6ghBxCDDMpJjPasCbiCBxSAMLkQ7ZmLbO0WVPPUTMAsZ8aKUy2MLe466zizXN640B4H6bkI7x/KC29sroEJWpUufD7f+t2tnVx/KLeAxAC6afuUCGi4ibFiwLHZjfimYKaYpuMcSZHQ64iONixyfUDIRNIOWQSiX1V5EBJgBDE0JVDnExmQYAIG5isYQEorC/7z6IJeZHc4NuiKDWuvd+jwwj8tN8PVAcACJKpQHpyUU20kvp4dYgBEeiQZpBfXWrnmOJZ0HgDHbvVxPW+SHTL/uoi/Tl9xdKe+z3Q/MoT8iYXggMPcFQIqVemQUTw9Tu0oNsSj3xueR9awJc2Le9aYbKTg54MAtcBnfKXN+3cYQkNVbqC5RfiAe2D3gfbT1OgApTUNz8n8v1dgAzTa+EB0i+w8nTsb3N/N4yAXMNSKdGeUl2rFRuQO7qlWorKc3pE+nBC2ex0sOMEUFYUXcyULaxsKM3ddakCAv9/jesnkrZl2gX7YDp8iqiFzh7l8jMAFHtFCMp3CSXlBAOpfQlGLY80qTSi1e8GrnV9Ow9t0DdS1wP7J6ES9DiNuEep5atHD+0MC6u0Dw0GtmsNnNRp77my/KI8ILhF4VBVBFQ5BiJDfdpAA3RNlANo2gK5ZCKPw4tXCYUknjYdwkqvUaIQCJcr2n+WkE2eCUCqjXTFr/KMvRByY6Fb1vAwcGoCWjP2g0Tliz3hcyh/72+umn05NO3cJSAfDEjfcYBUQZ/LCcy86G0EsHXP3NabgeHNXf/Z/VG7zWqQAPX0KaVrF9XC6I2FLkg1aNGWZfJGv4uohdIny7rWU7FWPaxy9GMk6x7xBh/Hk/5/rrGHCNGs+SegLglDs2+v4P56316k4kg//dmVl/vh3h0KC2P/1xiJZ10I91k7HqZLb2qdXToa4yOHB5Euu49UV/Qtv+cZU03fuT81sEv3YT819OdmwUZgkq0PT/Lrck+pbNDaUOakpgkGAbXy6SCvjM87jYN9Ia7druulWWO0pPi4T8daQ26ZQmZp57gdkpuh/He4kC5m1aWpT2s5STSbapChd9tFNjPhjCG1DZb7h0X8jg1VkxqutDDu17jOXrhElT1ejvYqYy9lIG1b1r7Jmjxo7LgGQuPMX6CIo/BLTsuNJyC5SfSCxEm56LvJgoNk2Vaeq6mLDOaKm2PNwPuYPnJw9xWBM0EetJBnsYMutPDMXhrB7x/8DKy5/hCsKICTfhlsboUHmbSfsikvGPYx7YOaOo8xFh4yAQ73T8hFX7kn2DBfRzGkJm8SQJRPj0Hjsf5mEFUt/OrieK/Jw10HKD6hDoEFmUDv5svC3nUY0FX0fTyi0jRAri+burrCQ0HXk/qj4Xs+WLiJgfQbprV2TwTIlzOdLb/jD8PeiElNzBxmOonRj76QKcbkOnPkCWCMFKapOJskxe0ASJVjYt142D0ndTa6F7oFu72ue5U+hyoToKeb7ONZilhF0+yL7akNfFKURUa/X+cEoewuSM7r8whWwZyG+M2cwGUTRMJiAC9wK7yE8MqdrEuQtILnCA0yRTPOh1Z9ifUY0asL1Tw9cbdGRW8svHH/oVHkWe3P+yepTNrn7xQlX/O1/p4FXRm0gSE3Fdnbli8VZdwVn2SET3WkPH9rJT2F7/hovfhx+lQzBQq9ZBpNLrWRdhXzCpiaC04o7q/eef+8dZwU62A1pd8uZ+0dI5T7lOVXoo03uF863YSOKX8ad2CiYUJ8gMvMA8FSWnsUbxiDaiXPj8kni5TLsvrkH/CKY/okG5SdRCF/XCcRcXP5dxdsS90tIWdd0xi/2wbalmn3CPQ2eVeDI3dP/jCRBkfiNtD70flhxVngZMZW+Rr1c0Cpo//fMCiV5ksDIBGin5AfOPmvSnPYWV5zcU3QEfl2F5fLXgDCbpaYjaOYjyRt9ZTqabSf1Ar4L9yQFBr4N9cNg4jKskvbha4BDmUL8J7xz/F/OXHFnEDV2YkMcpBfGM2XhKDevceOQcjrPkF5/e5LdwQeYhqgzzm6ur42OwHB2HBU7ulXn/LCk2eYCFa2D1f+2F3ExbwAvnDMhymdQdUniF/NzOfG/1L3yplFsqi270T/2gT1LdOQ/Fgp3FA81k/sMLbICcF/qCp/nS3x+iMZn9B+WLjUQvJy2PehXNcpXEvXWM/e1X4PWDUhwQi7+wjJwERX2W5SB1XjQa7n/osZqpOUG2ShssPNpS3mecaV+MTpRPVYTPFiDTIgkG7F/DSND0c2PDWsBLFus0h4jG70L94uDxVNiMJb/xq/7d2+7FMNPh9UJSK75XcKDhrRYJo3iU7mfl1U89vJB179ulGrdMpWd8v5DHWEDrn3NRBa0KWVYKpqeQ0195XXH1YlZjzK7615K/5ooOGUL42PlX2Hw1zxOJubsIl6LZt8V6wa6zJgywuVLsZb+kpjtHTHmVZyhY8IUnAn6Uj8erYXapvZ8rlhUpjvVuosn8gB9JM6vNct5dVn4e8Wbt6KnRcogHYUJT32QRSWsHCaZNEqwbX+dYaLx1FQZ5daYbXSWwiHhtAJRuYutbmWwWCRTVzyNNMh3sMAI1EcmMoOIX0DEhXYNe7daErR6vMyizQ+h5YKUYK4nUu270M0x/YKRHlxwK8WkEqWv8vfhZqzV0YGud1Hwd5JwWhIEZQ7cc1uPeYJJ5kAaIFqCffmwecS2gzVvOgDkNC5eENXSk7SzDpVgm8IcfZV47L17ni75tyJCS/kreODjap6VdpDNTyS1YJaaO2TMX/s4kWiEZ22Ma4CEv2eQq1uGazGamli+ZwExAtehw=="
+COM_ERMNVLDMR_STATIC_PUBLIC_URL="encrypted:BEZbNy1WbNKhgUWmKO648nvuVNyMNXrMnq64WkjsScTOcE/HFtMX3nQktbIvEYiTSNHvoceUeW10E9i4n+C5ZEHKIBi9VUk3nuqVIcwAr6xTfqKjM1cJlRNKFQzwhHbBTYcImLoxFvM56KU4L/9Ei/XuQ/QRz0KTabhvGMM="

.gemini/skills/github-fix/SKILL.md

@@ -0,0 +1,175 @@
+---
+name: github-fix
+description: Diagnose CI failures and review feedback on GitHub Pull Requests or Issues, repair code, verify quality checks, and commit changes.
+---
+
+# GitHub Fix Skill
+
+Use this skill when a user submits a `/fix` command on a GitHub Pull Request or Issue.
+
+## Overview
+
+The `/fix` command resolves build failures, test errors, and reviewer feedback. This skill enforces unified diagnosis, clean code repair, strict verification, and transparent progress reporting.
+
+```text
+/fix [optional instructions]
+  │
+  ├── 1. Unified Diagnosis (Fetch CI logs, inspect diff, parse comments)
+  ├── 2. Target Code Repair (Fix build errors and review feedback in one pass)
+  ├── 3. Verification (Run typecheck, lint, and tests)
+  ├── 4. Git Operations (Commit and push to the active branch)
+  └── 5. Thread Summary (Post itemized comment with mandatory disclosure)
+```
+
+---
+
+## Operational Workflow
+
+### Step 1: Unified Diagnosis
+
+Collect all diagnostic context before making code edits.
+
+#### Case A: Pull Request Context
+1. Identify the current PR number and branch:
+   ```bash
+   gh pr view --json number,headRefName,baseRefName
+   ```
+2. Fetch failed CI workflow logs:
+   ```bash
+   gh run view --log-failed
+   ```
+3. Inspect current changes in the PR:
+   ```bash
+   gh pr diff
+   ```
+4. Read all review comments and discussion threads:
+   ```bash
+   gh pr view --comments
+   ```
+5. Check inline review comments on specific files:
+   ```bash
+   gh api repos/{owner}/{repo}/pulls/{pull_number}/comments
+   ```
+
+#### Case B: Issue Context
+1. Read the issue description and thread comments:
+   ```bash
+   gh issue view <issue-number> --comments
+   ```
+2. Extract error stack traces, reproduction steps, and user instructions.
+
+---
+
+### Step 2: Target Code Repair
+
+Apply all necessary corrections in a single pass.
+
+1. Address all failures from CI logs (TypeScript errors, linter violations, test failures).
+2. Apply requested changes from code review comments.
+3. Incorporate any optional user instructions provided with `/fix`.
+4. Obey all repository conventions defined in `GEMINI.md`:
+   - **Strict TypeScript**: Do not use `any`, `as Type` assertions, or non-null `!` assertions. Use `castRef` from `@ermnvldmr/stl` when casting DOM references.
+   - **Type Imports**: Use `import type` for type declarations.
+   - **Interfaces**: Define object contracts with `interface`, not `type` aliases.
+   - **TSDoc**: Add descriptive JSDoc comments to all exported symbols and interfaces.
+   - **Styling**: Use Tailwind CSS v4 and `cva`. Merge class names with `cn` from `@ermnvldmr/stl`.
+   - **UI Primitives**: Use React Aria hooks and Radix UI primitives.
+   - **Import Boundaries**: Use relative paths for files within the same workspace package.
+
+---
+
+### Step 3: Verification
+
+Execute the complete verification sequence. All checks must pass with zero warnings or errors before proceeding.
+
+```bash
+# 1. Verify TypeScript types
+pnpm typecheck
+
+# 2. Verify ESLint rules
+pnpm lint
+
+# 3. Run unit and component tests
+pnpm test
+```
+
+> [!IMPORTANT]
+> If any check fails, resolve the failure immediately and rerun the verification sequence.
+
+---
+
+### Step 4: Git Operations
+
+Stage, commit, and push the resolved changes to the active branch.
+
+1. Stage modified and created files:
+   ```bash
+   git add <modified-files>
+   ```
+2. Commit with standard message:
+   ```bash
+   git commit -m "fix: apply review adjustments and CI fixes"
+   ```
+3. Push changes to the remote branch:
+   ```bash
+   git push origin HEAD
+   ```
+
+---
+
+### Step 5: Post Summary Comment
+
+Post an itemized summary comment to the GitHub PR or Issue thread.
+
+1. Format the comment with the template below.
+2. Submit the comment via GitHub CLI:
+   - For a Pull Request:
+     ```bash
+     gh pr comment <pr-number> --body "<comment-body>"
+     ```
+   - For an Issue:
+     ```bash
+     gh issue comment <issue-number> --body "<comment-body>"
+     ```
+
+---
+
+## GitHub Comment Template
+
+```markdown
+### Automated Fix Summary
+
+I addressed the reported issues and review feedback.
+
+#### Root Causes Identified
+- **CI / Test Failure**: `<Brief description of the failure>`
+- **Review Feedback**: `<Brief description of reviewer comments>`
+
+#### Changes Applied
+- `packages/<pkg>/src/...`: Fixed `<specific problem>`
+- `services/<svc>/src/...`: Updated `<specific problem>`
+
+#### Verification Results
+- `pnpm typecheck` passed (0 errors).
+- `pnpm lint` passed (0 warnings).
+- `pnpm test` passed (all tests clean).
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+---
+
+## Verification Checklist
+
+Before completing the task, verify every item in this checklist:
+
+- [ ] Failed CI logs inspected with `gh run view --log-failed`.
+- [ ] PR diff and review comments retrieved and analyzed.
+- [ ] Code repairs satisfy all requirements without introducing regressions.
+- [ ] No `any`, `as Type`, or `!` operators introduced.
+- [ ] `pnpm typecheck` completed with 0 errors.
+- [ ] `pnpm lint` completed with 0 warnings.
+- [ ] `pnpm test` completed with all tests passing.
+- [ ] Changes committed and pushed to the active branch.
+- [ ] Summary comment posted to the PR or Issue.
+- [ ] Mandatory disclosure line included at the end of the comment.

.gemini/skills/github-implement/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: github-implement
+description: Implement code changes from an approved issue plan, run monorepo validation, and create a pull request.
+---
+
+# GitHub Implement Skill
+
+Use this skill when an issue receives the `/implement` command.
+
+## Overview
+
+This skill guides the implementation of approved design plans. It enforces repository rules, executes automated validation, and prepares pull requests for the `next` branch.
+
+## Procedural Workflow
+
+### Phase 1: Context Ingestion
+
+1. Read the complete issue description and title.
+2. Locate the approved implementation plan in the issue comments.
+3. Parse additional instructions from the `/implement` comment.
+4. If requirements conflict or miss critical details, stop and request clarification.
+
+### Phase 2: Code Implementation
+
+Apply all modifications according to `GEMINI.md` conventions:
+
+1. **TypeScript Constraints**:
+   - Enable strict typing for all new code.
+   - Do not use the `any` type.
+   - Do not use type assertions (`as Type`).
+   - Do not use the non-null assertion operator (`!`).
+   - Use explicit type guards or helper functions such as `castRef`.
+   - Use `import type` for type-only imports.
+   - Define object structures with `interface`, not `type` aliases.
+
+2. **Documentation Rules**:
+   - Add JSDoc comments to all exported functions, interfaces, and types.
+   - Include clear description text in every JSDoc block.
+
+3. **Component Architecture**:
+   - Place components in dedicated directories under `packages/ui/src/components/<ComponentName>/`.
+   - Provide `<ComponentName>.tsx` for component logic.
+   - Provide `<ComponentName>.stories.tsx` for Storybook stories.
+   - Provide `<ComponentName>.test.tsx` for Vitest tests.
+   - Use `cva` for component variant management.
+   - Merge CSS utility classes with `cn(...)` from `@ermnvldmr/stl`.
+   - Use React Aria hooks and Radix UI primitives for accessible controls.
+
+4. **Monorepo Imports and State**:
+   - Use relative paths within the same package.
+   - Do not use self-referential package names.
+   - Use standard React state primitives. Do not add unapproved state managers.
+
+5. **Protected Boundaries**:
+   - Do not modify `.env.keys`, `pnpm-lock.yaml`, or `LICENSE`.
+   - Do not edit content files in `services/docs/content/` or `services/www/content/` unless explicitly instructed.
+
+### Phase 3: Monorepo Verification & Self-Correction
+
+Run validation commands in strict sequence:
+
+1. Run `pnpm typecheck`. Ensure zero compiler errors.
+2. Run `pnpm lint`. Ensure zero warnings and zero errors.
+3. Run `pnpm test`. Ensure all unit and component tests pass.
+4. Run `pnpm build`. Ensure clean compilation across all packages.
+
+**Iterative Self-Correction Loop**:
+- If any check fails, inspect the diagnostic output.
+- Identify the root cause.
+- Apply targeted fixes adhering to all code rules.
+- Re-run the verification sequence from step 1.
+- Repeat until all four checks pass completely.
+
+### Phase 4: Commit & Pull Request Preparation
+
+1. **Commit Message**:
+   - Format commits according to Conventional Commits: `<type>: implement issue #<number> (<title>)`.
+   - Example: `feat: implement issue #42 (add theme toggle)`.
+
+2. **Pull Request Target**:
+   - Set base branch to `next`.
+
+3. **Pull Request Body**:
+   - Link the issue: `Resolves #<number>`.
+   - Provide a concise summary of changes.
+   - Detail the implementation walkthrough.
+   - List the executed verification checks.
+   - Append the mandatory attribution line.
+
+4. **Mandatory Attribution**:
+   - Conclude all PR bodies and issue comments with:
+     `Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.`
+
+## Pull Request Template
+
+```markdown
+## Summary
+Resolves #<number>
+
+<Brief explanation of the implemented feature or fix>
+
+## Walkthrough of Changes
+- `<package-or-path>`: <Description of specific change>
+- `<package-or-path>`: <Description of specific change>
+
+## Verification Results
+- [x] `pnpm typecheck` passed (0 errors)
+- [x] `pnpm lint` passed (0 warnings)
+- [x] `pnpm test` passed (all tests green)
+- [x] `pnpm build` passed (clean build)
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+## Verification Checklist
+
+- [ ] Issue context, approved plan, and user instructions are satisfied.
+- [ ] TypeScript strict mode rules are respected (`no any`, `no as`, `no !`).
+- [ ] Exported symbols include JSDoc comments.
+- [ ] UI components reside in dedicated folders with tests and stories.
+- [ ] Monorepo boundaries and relative imports are respected.
+- [ ] All four verification checks passed cleanly.
+- [ ] Target branch is set to `next`.
+- [ ] PR description includes `Resolves #<number>`.
+- [ ] Mandatory attribution line is present.

.gemini/skills/github-plan/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: github-plan
+description: Analyze an issue thread, iterate on feedback, and produce or update an implementation plan for ermnvldmr.com.
+---
+
+# GitHub Issue Planning Skill (ASD-STE100 Standard)
+
+## Overview
+
+Use this skill when an issue receives the `/plan [optional instructions]` command.
+
+This skill creates or updates an implementation plan before code modification starts. All outputs must follow ASD-STE100 language constraints and repository standards.
+
+---
+
+## ASD-STE100 Writing Rules
+
+Follow these rules for all generated plans and documentation:
+
+| Rule | Limit | Approved Example | Non-Approved Example |
+| :--- | :--- | :--- | :--- |
+| **Procedural Sentences** | Max **20 words** | "Run `pnpm test`. Verify that all unit tests pass." | "You should run the pnpm test command to verify that all the unit tests pass properly without errors." |
+| **Descriptive Sentences** | Max **25 words** | "The `Button` component uses `cva` to manage style variants." | "The Button component is implemented using the cva library because it helps us manage complex style variants across different themes easily." |
+| **Voice** | **Active voice** | "The function validates the user input." | "The user input is validated by the function." |
+| **Mood and Tense** | **Present tense** and **Imperative mood** | "Click **Submit**. The form transmits the data." | "You will click submit and the form will be transmitting the data." |
+| **Noun Clusters** | Max **3 nouns** | "Theme configuration file" | "Theme variant style configuration file" |
+
+### Controlled Vocabulary Guidelines
+- Do not use conversational filler (for example: "basically", "let's dive in", "simply", "feel free to").
+- Use approved verbs: use *use* (not *utilize*), *stop* (not *terminate*), *start* (not *initiate*), *show* (not *exhibit*).
+- Use clear and literal technical terms.
+
+---
+
+## Planning Responsibilities
+
+### 1. Ingest Full Issue Context
+- Read the issue title, issue description, and all subsequent comments.
+- Identify user requirements, technical constraints, and reported symptoms.
+- Inspect relevant source files in the repository before proposing changes.
+- Read `GEMINI.md` to confirm current project conventions.
+
+### 2. Multi-Turn Plan Iteration
+- Check if an earlier implementation plan exists in the issue thread.
+- If an earlier plan exists:
+  - Do not create a plan from zero.
+  - Retain approved architectural decisions from previous turns.
+  - Apply the requested modifications or additions from the latest comment.
+  - Summarize the specific adjustments made to the previous plan.
+- If no earlier plan exists:
+  - Create a new baseline implementation plan from the issue requirements.
+
+### 3. Enforce Repository Architecture (`GEMINI.md`)
+Every proposed plan must comply with repository architecture:
+- **Build System**: Use Rsbuild and Rspack. Do not propose Vite, Webpack, or Next.js.
+- **Strict TypeScript**:
+  - Do not use `any`.
+  - Do not use type assertions (`as Type`). Use type guards or `castRef` from `@ermnvldmr/stl`.
+  - Do not use non-null assertions (`!`).
+  - Use `import type` for type-only imports.
+  - Define object shapes with `interface`, not `type` aliases.
+  - Require JSDoc comments on all exported symbols.
+- **Component Architecture** (`packages/ui`):
+  - Place components in `packages/ui/src/components/<ComponentName>/`.
+  - Provide `<ComponentName>.tsx`, `<ComponentName>.stories.tsx`, and `<ComponentName>.test.tsx`.
+  - Use `cva` for variant definitions.
+  - Merge class names with `cn(...)` from `@ermnvldmr/stl`.
+- **Accessibility & State**:
+  - Use React Aria hooks (`useButton`, `useFocusRing`, `useHover`) and Radix UI primitives.
+  - Use standard React state (`useState`, `useReducer`, `useContext`) and `react-stately`.
+  - Do not introduce external state management libraries.
+- **Monorepo Import Rules**:
+  - Use relative import paths within the same package.
+  - Do not import `@ermnvldmr/<package>` inside `<package>` itself.
+- **Protected Files**:
+  - Do not modify `.env.keys`, `pnpm-lock.yaml`, `LICENSE`, `services/docs/content/`, or `services/www/content/`.
+
+---
+
+## Output Plan Structure
+
+Format the generated plan with the following markdown template:
+
+```markdown
+### Goal
+[Describe the objective in 1-2 sentences. Keep each sentence under 25 words.]
+
+### Architecture & Technical Decisions
+- [Decision 1: Explain pattern, primitive, or component structure.]
+- [Decision 2: Explain typing or API contracts.]
+- [Decision 3: Explain state management or accessibility integration.]
+
+### File Changes
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.tsx` - [Purpose]
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.stories.tsx` - [Purpose]
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.test.tsx` - [Purpose]
+- `[MODIFY]` `packages/ui/src/index.ts` - [Export new component]
+
+### Verification Plan
+1. `pnpm typecheck` - Verify zero TypeScript compiler errors.
+2. `pnpm lint` - Verify zero ESLint warnings and errors.
+3. `pnpm test` - Run unit and integration tests.
+4. `pnpm build` - Run full workspace build.
+
+### Open Questions
+- [List open questions or ambiguities. If no open questions exist, write "None.".]
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+---
+
+## Common Traps and Solutions
+
+| Anti-Pattern | Correct Action |
+| :--- | :--- |
+| Regenerating a new plan after user feedback | Update the existing plan and highlight modified sections. |
+| Using `as Type` assertions in the proposed code | Propose explicit type guards or `castRef` helpers. |
+| Missing Storybook or Vitest files for UI components | Include `.stories.tsx` and `.test.tsx` in the file plan. |
+| Proposing external state libraries | Use React 19 primitives and `react-stately`. |
+| Omitting the attribution line | Append the mandatory disclosure line at the end. |
+
+---
+
+## Verification Checklist
+
+Before posting the plan response, verify all items:
+
+- [ ] The issue thread context and all user comments are analyzed.
+- [ ] Existing plans are updated rather than replaced from scratch.
+- [ ] Proposed code satisfies all `GEMINI.md` constraints (`strict: true`, no `any`, no `as`, no `!`).
+- [ ] All UI components include unit tests and Storybook stories.
+- [ ] All sentences follow ASD-STE100 limits (<=20 words for instructions, <=25 words for descriptions).
+- [ ] Active voice is used throughout the plan.
+- [ ] The output concludes with: `Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.`
+

.gitea/inactive/gemini-manual.yml.disabled

@@ -0,0 +1,319 @@
+name: gemini - manual
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+concurrency:
+  group: agent-issue-${{ github.event.issue.number || github.event.pull_request.number }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  actions: write
+
+jobs:
+  agent-dispatch:
+    name: Agent / Dispatch
+    if: >
+      (github.event.comment.author_association == 'OWNER' ||
+       github.event.comment.author_association == 'MEMBER' ||
+       github.event.comment.author_association == 'COLLABORATOR') &&
+      (contains(github.event.comment.body, '/plan') ||
+       contains(github.event.comment.body, '/implement') ||
+       contains(github.event.comment.body, '/fix'))
+    runs-on: [self-hosted, eliza]
+    container:
+      image: node:20-bookworm
+      options: --add-host host.docker.internal:host-gateway
+    env:
+      HTTP_PROXY: http://host.docker.internal:1080
+      HTTPS_PROXY: http://host.docker.internal:1080
+      ALL_PROXY: http://host.docker.internal:1080
+      NO_PROXY: localhost,127.0.0.1
+    timeout-minutes: 30
+
+    steps:
+      - name: Verify Collaborator Authorization
+        id: auth-check
+        run: |
+          AUTHOR_ASSOC="${{ github.event.comment.author_association }}"
+          echo "Author association: $AUTHOR_ASSOC"
+          if [[ "$AUTHOR_ASSOC" != "OWNER" && "$AUTHOR_ASSOC" != "MEMBER" && "$AUTHOR_ASSOC" != "COLLABORATOR" ]]; then
+            echo "::error::Unauthorized trigger by user with association '$AUTHOR_ASSOC'."
+            exit 1
+          fi
+
+      - name: Ensure GitHub CLI is Installed
+        run: |
+          if ! command -v gh &> /dev/null; then
+            echo "Installing GitHub CLI..."
+            curl -fsSL https://github.com/cli/cli/releases/download/v2.67.0/gh_2.67.0_linux_amd64.tar.gz | tar -xz -C /usr/local --strip-components=1
+          fi
+
+      - name: Acknowledge Command (Add Eyes Reaction)
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" -f content=eyes || true
+
+      - name: Checkout Codebase
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.12.3
+
+      - name: Setup Node.js with pnpm cache
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      - name: Install Dependencies & Build Workspace Packages
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm build:deps
+
+      - name: Restore Agent Conversation Context
+        uses: actions/cache@v4
+        id: agent-context-cache
+        with:
+          path: |
+            ~/.gemini/antigravity-cli/conversations
+            ~/.gemini/antigravity-cli/brain
+          key: agent-context-issue-${{ github.event.issue.number }}-${{ github.run_id }}
+          restore-keys: |
+            agent-context-issue-${{ github.event.issue.number }}-
+
+      - name: Setup Antigravity CLI & Credentials
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          AGY_AUTH_TOKEN: ${{ secrets.AGY_AUTH_TOKEN }}
+        run: |
+          # 1. Download official Antigravity CLI binary from google-antigravity/antigravity-cli
+          mkdir -p "$HOME/.local/bin"
+          if ! command -v agy &> /dev/null; then
+            echo "Fetching Antigravity CLI from google-antigravity/antigravity-cli..."
+            gh release download --repo google-antigravity/antigravity-cli -p "agy_cli_linux_x64.tar.gz" -O - | tar -xz -C "$HOME/.local/bin"
+            if [ -f "$HOME/.local/bin/antigravity" ] && [ ! -f "$HOME/.local/bin/agy" ]; then
+              mv "$HOME/.local/bin/antigravity" "$HOME/.local/bin/agy"
+            fi
+            ln -sf "$HOME/.local/bin/agy" "$HOME/.local/bin/antigravity"
+            chmod +x "$HOME/.local/bin/agy" "$HOME/.local/bin/antigravity"
+          fi
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+          echo "$HOME/.gemini/antigravity-cli/bin" >> $GITHUB_PATH
+          export PATH="$HOME/.local/bin:$HOME/.gemini/antigravity-cli/bin:$PATH"
+
+          # 2. Patch location eligibility check (open-antigravity-patcher CLI_GATE_X64)
+          node -e '
+            const fs = require("fs");
+            const file = process.env.HOME + "/.local/bin/agy";
+            if (!fs.existsSync(file)) process.exit(0);
+            const buf = fs.readFileSync(file);
+            let count = 0;
+            for (let i = 0; i < buf.length - 18; i++) {
+              if (buf[i] === 0x48 && buf[i+1] === 0x85 && buf[i+2] === 0xc0 && buf[i+3] === 0x0f && buf[i+4] === 0x84 &&
+                  buf[i+9] === 0x80 && buf[i+10] === 0x78 && buf[i+11] === 0x08 && buf[i+12] === 0x00 &&
+                  buf[i+13] === 0x0f && buf[i+14] === 0x85) {
+                buf[i+9] = 0x48; buf[i+10] = 0x85; buf[i+11] = 0xc0; buf[i+12] = 0x90;
+                count++;
+              }
+            }
+            if (count > 0) {
+              fs.writeFileSync(file, buf);
+              console.log(`Applied open-antigravity-patcher: ${count} gates patched.`);
+            } else {
+              console.log("Antigravity CLI is already patched or signature not found.");
+            }
+          '
+
+          # 3. Inject OAuth Token
+          mkdir -p ~/.gemini/antigravity-cli
+          if [ -n "$AGY_AUTH_TOKEN" ]; then
+            if echo "$AGY_AUTH_TOKEN" | base64 --decode >/dev/null 2>&1; then
+              echo "$AGY_AUTH_TOKEN" | base64 --decode > ~/.gemini/antigravity-cli/antigravity-oauth-token
+            else
+              echo "$AGY_AUTH_TOKEN" > ~/.gemini/antigravity-cli/antigravity-oauth-token
+            fi
+            chmod 600 ~/.gemini/antigravity-cli/antigravity-oauth-token
+          else
+            echo "::warning::AGY_AUTH_TOKEN secret is not set."
+          fi
+
+      - name: Configure Git Bot Identity
+        run: |
+          git config --global user.name "Adam Jensen [bot]"
+          git config --global user.email "adam@ermnvldmr.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      # --- COMMAND: /plan ---
+      - name: Handle /plan (Issue Planning)
+        if: contains(github.event.comment.body, '/plan') && github.event.issue.pull_request == null
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          echo "Generating plan for Issue #${ISSUE_NUMBER}..."
+          ISSUE_DATA=$(gh issue view "$ISSUE_NUMBER" --comments --json title,body,comments)
+
+          CONTINUE_FLAG=""
+          if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+            CONTINUE_FLAG="--continue"
+          fi
+
+          PROMPT="You are operating via GitHub Actions in non-interactive headless mode on Issue #${ISSUE_NUMBER}.\n\nIssue Context:\n${ISSUE_DATA}\n\nLatest instruction:\n${COMMENT_BODY}\n\nPlease generate/update a detailed technical implementation plan adhering to project GEMINI.md guidelines."
+
+          PLAN_OUTPUT=$(agy $CONTINUE_FLAG --mode plan --dangerously-skip-permissions --print-timeout 20m -p "$PROMPT" || echo "Agent encountered an error generating the plan.")
+
+          DISCLOSURE="\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          gh issue comment "$ISSUE_NUMBER" --body "${PLAN_OUTPUT}${DISCLOSURE}"
+
+      # --- COMMAND: /implement ---
+      - name: Handle /implement (Issue Implementation & PR)
+        if: contains(github.event.comment.body, '/implement') && github.event.issue.pull_request == null
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          BRANCH_NAME="agent/issue-${ISSUE_NUMBER}"
+          git checkout -b "$BRANCH_NAME"
+
+          ISSUE_DATA=$(gh issue view "$ISSUE_NUMBER" --comments --json title,body,comments)
+
+          CONTINUE_FLAG=""
+          if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+            CONTINUE_FLAG="--continue"
+          fi
+
+          PROMPT="You are operating via GitHub Actions in non-interactive headless mode to implement Issue #${ISSUE_NUMBER}.\n\nContext:\n${ISSUE_DATA}\n\nLatest instruction:\n${COMMENT_BODY}\n\nTask: Inspect relevant files, implement the necessary code changes directly in the workspace adhering to GEMINI.md rules, and verify them. Do not exit or stop before applying edits to the source code."
+          agy $CONTINUE_FLAG --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+          echo "Running repository verification gates..."
+          pnpm typecheck
+          pnpm lint
+          pnpm test
+
+          ISSUE_TITLE=$(gh issue view "$ISSUE_NUMBER" --json title -q .title)
+          git add -A
+          if git diff --staged --quiet; then
+            echo "No changes produced by agent."
+            gh issue comment "$ISSUE_NUMBER" --body "No changes were produced for implementation.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+            exit 0
+          fi
+
+          git commit -m "feat: implement issue #${ISSUE_NUMBER} (${ISSUE_TITLE})"
+          git push -u origin "$BRANCH_NAME" --force
+
+          PR_BODY="Resolves #${ISSUE_NUMBER}\n\nAutomated implementation generated via \`/implement\`.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          gh pr create \
+            --title "feat: ${ISSUE_TITLE}" \
+            --body "$PR_BODY" \
+            --base next \
+            --head "$BRANCH_NAME"
+
+      # --- COMMAND: /fix ---
+      - name: Handle /fix (PR Review Adjustments & CI Failure Debugging)
+        if: contains(github.event.comment.body, '/fix')
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_OR_PR_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          IS_PR="${{ github.event.issue.pull_request != null }}"
+          if [ "$IS_PR" = "true" ]; then
+            # Verify PR is not from an untrusted cross-repository fork
+            IS_CROSS_REPO=$(gh pr view "$ISSUE_OR_PR_NUMBER" --json isCrossRepository -q .isCrossRepository)
+            if [ "$IS_CROSS_REPO" = "true" ]; then
+              echo "::error::Cross-repository fork PRs cannot be automatically processed in privileged context."
+              exit 1
+            fi
+
+            gh pr checkout "$ISSUE_OR_PR_NUMBER"
+            BRANCH_NAME=$(git branch --show-current)
+            PR_DIFF=$(gh pr diff "$ISSUE_OR_PR_NUMBER" || true)
+
+            FAILED_RUN_ID=$(gh run list --branch "$BRANCH_NAME" --status failure --limit 1 --json databaseId -q '.[0].databaseId' || true)
+            CI_LOGS=""
+            if [ -n "$FAILED_RUN_ID" ] && [ "$FAILED_RUN_ID" != "null" ]; then
+              echo "Found failed CI run: #$FAILED_RUN_ID. Fetching failure logs..."
+              CI_LOGS=$(gh run view "$FAILED_RUN_ID" --log-failed | tail -n 200 || true)
+            fi
+
+            CONTINUE_FLAG=""
+            if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+              CONTINUE_FLAG="--continue"
+            fi
+
+            PROMPT="You are operating via GitHub Actions in non-interactive headless mode to fix/adjust PR #${ISSUE_OR_PR_NUMBER} on branch ${BRANCH_NAME}.\n\nFeedback / Comment:\n${COMMENT_BODY}\n\nPR Diff:\n${PR_DIFF}\n\nFailed CI Logs (if any):\n${CI_LOGS}\n\nTask: Apply the necessary fixes directly to the files, ensuring all lint, typecheck, and test checks pass. Do not exit without applying the changes."
+            agy $CONTINUE_FLAG --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+            echo "Running repository verification gates..."
+            pnpm typecheck
+            pnpm lint
+            pnpm test
+
+            git add -A
+            if git diff --staged --quiet; then
+              echo "No additional changes were needed."
+              gh pr comment "$ISSUE_OR_PR_NUMBER" --body "Analyzed the request; no additional changes were needed.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+              exit 0
+            fi
+
+            git commit -m "fix: apply review adjustments and CI fixes"
+            git push origin "$BRANCH_NAME"
+
+            gh pr comment "$ISSUE_OR_PR_NUMBER" --body "Applied adjustments and verified build/test suite.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          else
+            echo "Handling /fix on Issue #${ISSUE_OR_PR_NUMBER}..."
+            BRANCH_NAME="agent/fix-issue-${ISSUE_OR_PR_NUMBER}"
+            git checkout -b "$BRANCH_NAME"
+
+            ISSUE_DATA=$(gh issue view "$ISSUE_OR_PR_NUMBER" --comments --json title,body,comments)
+            PROMPT="You are operating via GitHub Actions in non-interactive headless mode to fix issue #${ISSUE_OR_PR_NUMBER}.\n\nContext:\n${ISSUE_DATA}\n\nInstruction:\n${COMMENT_BODY}\n\nTask: Apply the necessary fixes directly to the files adhering to GEMINI.md rules."
+            agy --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+            pnpm typecheck
+            pnpm lint
+            pnpm test
+
+            git add -A
+            git commit -m "fix: resolve issue #${ISSUE_OR_PR_NUMBER}"
+            git push -u origin "$BRANCH_NAME" --force
+
+            gh pr create \
+              --title "fix: resolve issue #${ISSUE_OR_PR_NUMBER}" \
+              --body "Resolves #${ISSUE_OR_PR_NUMBER}\n\nFix applied via \`/fix\`.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*" \
+              --base next \
+              --head "$BRANCH_NAME"
+          fi
+
+      - name: Complete Command (Add Rocket Reaction)
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" -f content=rocket || true
+
+      - name: Report Failure on Comment
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh issue comment "$ISSUE_NUMBER" --body "⚠️ Workflow failed during execution. View run logs: [Action Run #${{ github.run_id }}](${RUN_URL})\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*" || true

.gitea/known_hosts

@@ -0,0 +1 @@
+[git.ermnvldmr.com]:22222,[45.150.33.239]:22222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXcvf3Lds3AKfGHGh00IWR9tSRbBBqrV/CC6JBGmcrD

.gitea/workflows/ci-next-build-golden-image.yml

@@ -0,0 +1,70 @@
+name: ci - next/build-golden-image
+'on':
+  workflow_dispatch: null
+concurrency:
+  group: ci-golden-image
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  validate-scripts:
+    name: Validate - Provisioner Scripts
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Validate Shell Script Syntax
+      run: bash -n ci/packer/scripts/*.sh
+  build-image:
+    name: Build - Golden Image
+    needs: validate-scripts
+    runs-on: apex-debian13
+    outputs:
+      image_name: ${{ steps.vars.outputs.image_name }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Calculate Image Name
+      id: vars
+      run: 'SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)"
+
+        IMAGE_NAME="com-ermnvldmr-debian-12-k3s-amd64-${SHORT_SHA}.qcow2"
+
+        echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
+
+        '
+    - name: Install Build Tools
+      run: 'sudo apt-get update
+
+        sudo apt-get install -y qemu-utils
+
+        '
+    - name: Build Debian K3s Golden Image
+      run: bash ci/scripts/build-golden-image.sh
+    - name: Prepare and Upload Image Artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: golden-image
+        path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+        retention-days: 30
+  upload-s3:
+    name: Upload - S3 Storage
+    needs: build-image
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Download Image Artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: golden-image
+        path: output-qemu
+    - name: Upload to Static S3 (/dev/images/)
+      run: bash ci/scripts/upload-golden-image.sh "${IMAGE_NAME}"
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY }}
+        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION || 'auto' }}
+        S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL }}
+        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET }}
+        IMAGE_NAME: ${{ needs.build-image.outputs.image_name }}

.gitea/workflows/packages-kits-next-required.yml

@@ -0,0 +1,332 @@
+name: packages/kits - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/kits/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-kits-next-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-next-kits-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs & UI
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Build UI
+      run: pnpm --filter @ermnvldmr/ui build
+    - name: Upload Rsbuild Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+    - name: Upload UI dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+        retention-days: 30
+  lint-kits:
+    name: Lint - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Lint Kits package
+      run: pnpm --filter @ermnvldmr/kits lint
+  typecheck-kits:
+    name: Typecheck - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Typecheck Kits package
+      run: pnpm --filter @ermnvldmr/kits typecheck
+  test-kits:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Test Kits package
+      run: pnpm --filter @ermnvldmr/kits test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits Storybook
+      run: pnpm --filter @ermnvldmr/kits build-storybook
+    - name: Upload Storybook build
+      uses: actions/upload-artifact@v4
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: actions/download-artifact@v4
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/kits test:storybook:ci
+  build-kits:
+    name: Build - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits package
+      run: pnpm --filter @ermnvldmr/kits build

.gitea/workflows/packages-kits-pr-required.yml

@@ -0,0 +1,332 @@
+name: packages/kits - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/kits/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-kits-pr-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-pr-kits-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs & UI
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Build UI
+      run: pnpm --filter @ermnvldmr/ui build
+    - name: Upload Rsbuild Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+    - name: Upload UI dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+        retention-days: 30
+  lint-kits:
+    name: Lint - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Lint Kits package
+      run: pnpm --filter @ermnvldmr/kits lint
+  typecheck-kits:
+    name: Typecheck - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Typecheck Kits package
+      run: pnpm --filter @ermnvldmr/kits typecheck
+  test-kits:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Test Kits package
+      run: pnpm --filter @ermnvldmr/kits test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits Storybook
+      run: pnpm --filter @ermnvldmr/kits build-storybook
+    - name: Upload Storybook build
+      uses: actions/upload-artifact@v4
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: actions/download-artifact@v4
+      with:
+        name: kits-storybook-static-${{ github.run_id }}
+        path: packages/kits/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/kits test:storybook:ci
+  build-kits:
+    name: Build - Kits
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download UI dist
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-dist-${{ github.run_id }}
+        path: packages/ui/dist
+    - name: Build Kits package
+      run: pnpm --filter @ermnvldmr/kits build

.gitea/workflows/packages-ssg-next-required.yml

@@ -0,0 +1,133 @@
+name: packages/ssg - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/ssg/**
+    - .gitea/workflows/packages-ssg-next-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-ssg-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-ssg:
+    name: Lint - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Lint SSG package
+      run: pnpm --filter @ermnvldmr/ssg lint
+  typecheck-ssg:
+    name: Typecheck - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Typecheck SSG package
+      run: pnpm --filter @ermnvldmr/ssg typecheck
+  build-ssg:
+    name: Build - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Build SSG package
+      run: pnpm --filter @ermnvldmr/ssg build

.gitea/workflows/packages-ssg-pr-required.yml

@@ -0,0 +1,133 @@
+name: packages/ssg - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/ssg/**
+    - .gitea/workflows/packages-ssg-pr-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-pr-ssg-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-ssg:
+    name: Lint - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Lint SSG package
+      run: pnpm --filter @ermnvldmr/ssg lint
+  typecheck-ssg:
+    name: Typecheck - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Typecheck SSG package
+      run: pnpm --filter @ermnvldmr/ssg typecheck
+  build-ssg:
+    name: Build - SSG
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Build SSG package
+      run: pnpm --filter @ermnvldmr/ssg build

.gitea/workflows/packages-stl-next-required.yml

@@ -0,0 +1,156 @@
+name: packages/stl - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/stl/**
+    - .gitea/workflows/packages-stl-next-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-stl-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-stl:
+    name: Lint - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Lint STL package
+      run: pnpm --filter @ermnvldmr/stl lint
+  typecheck-stl:
+    name: Typecheck - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Typecheck STL package
+      run: pnpm --filter @ermnvldmr/stl typecheck
+  test-stl:
+    name: Test - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Test STL package
+      run: pnpm --filter @ermnvldmr/stl test:coverage
+  build-stl:
+    name: Build - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Build STL package
+      run: pnpm --filter @ermnvldmr/stl build

.gitea/workflows/packages-stl-pr-required.yml

@@ -0,0 +1,157 @@
+name: packages/stl - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/stl/**
+    - .gitea/workflows/packages-stl-pr-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+  workflow_dispatch: {}
+concurrency:
+  group: ci-pr-stl-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Upload Config Artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+  lint-stl:
+    name: Lint - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Lint STL package
+      run: pnpm --filter @ermnvldmr/stl lint
+  typecheck-stl:
+    name: Typecheck - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Typecheck STL package
+      run: pnpm --filter @ermnvldmr/stl typecheck
+  test-stl:
+    name: Test - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Test STL package
+      run: pnpm --filter @ermnvldmr/stl test:coverage
+  build-stl:
+    name: Build - STL
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Build STL package
+      run: pnpm --filter @ermnvldmr/stl build

.gitea/workflows/packages-ui-next-required.yml

@@ -0,0 +1,284 @@
+name: packages/ui - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-ui-next-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-ui-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Rsbuild Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-ui:
+    name: Lint - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Lint UI package
+      run: pnpm --filter @ermnvldmr/ui lint
+  typecheck-ui:
+    name: Typecheck - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Typecheck UI package
+      run: pnpm --filter @ermnvldmr/ui typecheck
+  test-ui:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Test UI package
+      run: pnpm --filter @ermnvldmr/ui test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/ui test:storybook:ci
+  build-ui:
+    name: Build - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build UI package
+      run: pnpm --filter @ermnvldmr/ui build

.gitea/workflows/packages-ui-pr-required.yml

@@ -0,0 +1,293 @@
+name: packages/ui - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/packages-ui-pr-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-pr-ui-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Rsbuild Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-ui:
+    name: Lint - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Lint UI package
+      run: pnpm --filter @ermnvldmr/ui lint
+  typecheck-ui:
+    name: Typecheck - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Typecheck UI package
+      run: pnpm --filter @ermnvldmr/ui typecheck
+  test-ui:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Test UI package
+      run: pnpm --filter @ermnvldmr/ui test:coverage
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build UI Storybook
+      run: pnpm --filter @ermnvldmr/ui build-storybook
+    - name: Upload Storybook build
+      uses: actions/upload-artifact@v4
+      with:
+        name: ui-storybook-static-${{ github.run_id }}
+        path: packages/ui/storybook-static/
+        retention-days: 30
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: actions/download-artifact@v4
+      with:
+        name: ui-storybook-static-${{ github.run_id }}
+        path: packages/ui/storybook-static/
+    - name: Test Storybook
+      run: pnpm --filter @ermnvldmr/ui test:storybook:ci
+  build-ui:
+    name: Build - UI
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build UI package
+      run: pnpm --filter @ermnvldmr/ui build

.gitea/workflows/services-docs-next-required.yml

@@ -0,0 +1,144 @@
+name: services/docs - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/docs/**
+    - .gitea/workflows/services-docs-next-required.yml
+    - ci/docker/docs/**
+    - ci/config/nginx/**
+    - ci/scripts/**
+  workflow_dispatch:
+
+concurrency:
+  group: ci-docs-${{ github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  setup-hugo:
+    name: Setup - Hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    - name: Setup Hugo
+      run: hugo version | grep extended
+
+  build-hugo:
+    name: Build - Hugo Site
+    needs: setup-hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    - name: Setup Hugo
+      run: hugo version | grep extended
+    - name: Build Hugo site
+      working-directory: services/docs
+      run: hugo --gc --minify
+
+  release-docker:
+    name: Release - Docker Image
+    needs: build-hugo
+    runs-on: apex-debian13
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      short_sha: ${{ steps.vars.outputs.short_sha }}
+      version: ${{ steps.vars.outputs.version }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        fetch-depth: 0
+    - name: Log in to Gitea Container Registry
+      run: python3 ci/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Compute version and metadata
+      id: vars
+      run: |
+        SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+        VERSION=$(bash ci/scripts/calver-release.sh docs)
+        echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
+    - name: Create and push release tag
+      if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+      run: bash ci/scripts/calver-release.sh tag docs "${{ github.sha }}" "${{ steps.vars.outputs.version }}"
+      env:
+        GIT_WRITE_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
+    - name: Extract Docker metadata
+      id: meta
+      run: python3 ci/scripts/docker.py metadata
+      env:
+        IMAGES: git.ermnvldmr.com/${{ github.repository }}/docs
+        TAG_RULES: |
+          type=raw,value=latest
+          type=raw,value=${{ steps.vars.outputs.version }}
+          type=sha,format=short
+        SOURCE_SHA: ${{ github.sha }}
+    - name: Build and push Docker image
+      run: python3 ci/scripts/docker.py build
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
+        LABELS: ${{ steps.meta.outputs.labels }}
+        BUILD_ARGS: |
+          COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+          VERSION=${{ steps.vars.outputs.version }}
+        DOCKERFILE: ci/docker/docs/Dockerfile
+        PLATFORMS: ''
+        PUSH: 'true'
+        CONTEXT: .
+        SOURCE_SHA: ${{ github.sha }}
+        RUN_ID: ${{ github.run_id }}
+
+  deploy:
+    name: Deploy - Kubernetes (GitOps)
+    needs: release-docker
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    permissions:
+      contents: write
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        ref: next
+    - name: Setup Kustomize
+      run: test "$(kustomize version)" = v5.3.0
+    - name: Deploy via GitOps
+      run: |
+        DOCS_TAG="${{ needs.release-docker.outputs.version }}"
+        bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"
+      env:
+        GIT_WRITE_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
+
+  verify-rollout:
+    name: Verify - Production Rollout
+    needs:
+    - release-docker
+    - deploy
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        ref: next
+    - name: Await production rollout
+      run: |
+        DOCS_TAG="${{ needs.release-docker.outputs.version }}"
+        bash ci/scripts/await-rollout.sh docs "${DOCS_TAG}"

.gitea/workflows/services-docs-pr-required.yml

@@ -0,0 +1,40 @@
+name: services/docs - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/docs/**
+    - .gitea/workflows/services-docs-pr-required.yml
+    - ci/scripts/**
+concurrency:
+  group: ci-pr-docs-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-hugo:
+    name: Setup - Hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    - name: Setup Hugo
+      run: hugo version | grep extended
+  build-hugo:
+    name: Build - Hugo Site
+    needs: setup-hugo
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    - name: Setup Hugo
+      run: hugo version | grep extended
+    - name: Build Hugo site
+      working-directory: services/docs
+      run: hugo --gc --minify

.gitea/workflows/services-static-next-required.yml

@@ -0,0 +1,195 @@
+name: services/static - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/static/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-static-next-required.yml
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-static-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Config Artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-static:
+    name: Lint - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Lint static service
+      run: pnpm --filter @ermnvldmr/static lint
+  typecheck-static:
+    name: Typecheck - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Typecheck static service
+      run: pnpm --filter @ermnvldmr/static typecheck
+  build-static:
+    name: Build - Static Site
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Build static service
+      run: pnpm --filter @ermnvldmr/static build
+    - name: Upload build artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: static-dist
+        path: services/static/dist/
+        retention-days: 30
+  deploy-s3:
+    name: Deploy - S3
+    needs:
+    - lint-static
+    - typecheck-static
+    - build-static
+    runs-on: apex-debian13
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Download build artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: static-dist
+        path: services/static/dist/
+    - name: Deploy to S3
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }}
+        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }}
+        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }}
+        AWS_REGION: ${{ secrets.STATIC_AWS_REGION }}
+        S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }}
+      run: 'chmod +x ci/scripts/deploy-static.sh
+
+        ./ci/scripts/deploy-static.sh
+
+        '

.gitea/workflows/services-static-pr-required.yml

@@ -0,0 +1,166 @@
+name: services/static - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/static/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-static-pr-required.yml
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-pr-static-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build i18n
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload Config Artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-static:
+    name: Lint - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Lint static service
+      run: pnpm --filter @ermnvldmr/static lint
+  typecheck-static:
+    name: Typecheck - Static
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Typecheck static service
+      run: pnpm --filter @ermnvldmr/static typecheck
+  build-static:
+    name: Build - Static Site
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Config Artifacts
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Build static service
+      run: pnpm --filter @ermnvldmr/static build
+    - name: Upload build artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: static-dist-${{ github.run_id }}
+        path: services/static/dist/
+        retention-days: 30

.gitea/workflows/services-www-deploy-manual.yml

@@ -0,0 +1,88 @@
+name: services/www - manual deploy
+'on':
+  workflow_dispatch:
+    inputs:
+      tested_sha:
+        description: Full tested source commit (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+      tested_digest:
+        description: OCI sha256 digest from the successful build (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+      build_run_id:
+        description: Successful WWW build run ID (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+      release_tag:
+        description: Previously approved release tag (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+      release_run_id:
+        description: Approved release run ID (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+permissions:
+  contents: write
+  actions: read
+jobs:
+  deploy:
+    name: Deploy - Kubernetes (GitOps)
+    runs-on: apex-debian13
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next' && github.actor == 'deytenit'
+    outputs:
+      short_sha: ${{ steps.provenance.outputs.short_sha }}
+      tested_digest: ${{ steps.provenance.outputs.tested_digest }}
+      release_tag: ${{ steps.provenance.outputs.release_tag }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        ref: next
+    - name: Authenticate local registry
+      run: python3 ci/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Verify successful build and approved release
+      id: provenance
+      run: python3 ci/scripts/provenance.py
+      env:
+        IS_DEPLOY: 'true'
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+        RELEASE_TAG: ${{ inputs.release_tag }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+    - name: Setup Kustomize
+      run: test "$(kustomize version)" = v5.3.0
+    - name: Deploy via GitOps
+      run: |
+        RELEASE_TAG="${{ steps.provenance.outputs.release_tag }}"
+        TESTED_DIGEST="${{ steps.provenance.outputs.tested_digest }}"
+        TESTED_SHA="${{ steps.provenance.outputs.tested_sha }}"
+
+        echo "Deploying www digest $TESTED_DIGEST ($RELEASE_TAG)..."
+        bash ci/scripts/deploy-gitops.sh www "$TESTED_DIGEST"
+      env:
+        GIT_WRITE_KEY: ${{ secrets.WWW_DEPLOY_KEY }}
+
+  verify-rollout:
+    name: Verify - Production Rollout
+    needs: deploy
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        ref: next
+    - name: Await production rollout
+      run: |
+        bash ci/scripts/await-rollout.sh www "${{ needs.deploy.outputs.short_sha }}"

.gitea/workflows/services-www-next-required.yml

@@ -0,0 +1,377 @@
+name: services/www - next/required
+'on':
+  push:
+    branches:
+    - next
+    paths:
+    - services/www/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-www-next-required.yml
+    - ci/docker/www/**
+    - ci/config/nginx/**
+    - ci/scripts/**
+    - pnpm-lock.yaml
+    - ci/scripts/**
+  workflow_dispatch: null
+concurrency:
+  group: ci-www-${{ github.ref_name }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Upload Rsbuild Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Build i18n package
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-www:
+    name: Lint - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Lint WWW service
+      run: pnpm --filter @ermnvldmr/www lint
+  typecheck-www:
+    name: Typecheck - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Typecheck WWW service
+      run: pnpm --filter @ermnvldmr/www typecheck
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Build WWW Storybook
+      run: pnpm --filter @ermnvldmr/www build-storybook
+    - name: Upload Storybook build
+      uses: actions/upload-artifact@v4
+      with:
+        name: storybook-static
+        path: services/www/storybook-static/
+        retention-days: 30
+  test-www:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Test WWW service
+      run: pnpm --filter @ermnvldmr/www test:coverage
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-static
+        path: services/www/storybook-static/
+    - name: Serve Storybook and run tests with coverage
+      run: pnpm --filter @ermnvldmr/www test:storybook:ci
+  build-www:
+    name: Build - WWW Service
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist
+        path: packages/storybook-config/dist
+    - name: Build WWW service (all locales)
+      run: pnpm --filter @ermnvldmr/www build:all
+      env:
+        RSDOCTOR: 'true'
+    - name: Upload Rsdoctor report
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsdoctor-report
+        path: services/www/rsdoctor/
+        retention-days: 30
+  build-docker:
+    name: Build - Docker Image
+    needs:
+    - lint-www
+    - typecheck-www
+    - test-www
+    - test-storybook
+    - build-www
+    runs-on: apex-debian13
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      short_sha: ${{ steps.vars.outputs.short_sha }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Calculate Short SHA
+      id: vars
+      run: |
+        SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+        echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+    - name: Log in to Gitea Container Registry
+      run: python3 ci/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Extract Docker metadata
+      id: meta
+      run: python3 ci/scripts/docker.py metadata
+      env:
+        IMAGES: git.ermnvldmr.com/${{ github.repository }}/www
+        TAG_RULES: |
+          type=sha,format=short
+        SOURCE_SHA: ${{ github.sha }}
+    - name: Build and push Docker image
+      run: python3 ci/scripts/docker.py build
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
+        LABELS: ${{ steps.meta.outputs.labels }}
+        BUILD_ARGS: |
+          COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+          VERSION=${{ steps.vars.outputs.short_sha }}
+        DOCKERFILE: ci/docker/www/Dockerfile
+        PLATFORMS: ''
+        PUSH: 'true'
+        CONTEXT: .
+        SOURCE_SHA: ${{ github.sha }}
+        RUN_ID: ${{ github.run_id }}
+      id: image
+    - name: Record tested digest provenance
+      env:
+        IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
+      run: |
+        mkdir -p .ci
+        python3 - <<'PROVENANCE'
+        import json, os
+        from pathlib import Path
+        Path('.ci/www-provenance.json').write_text(json.dumps({
+            'sha': os.environ['GITHUB_SHA'],
+            'digest': os.environ['IMAGE_DIGEST'],
+            'run_id': os.environ['GITHUB_RUN_ID'],
+            'repository': os.environ['GITHUB_REPOSITORY']
+        }))
+        PROVENANCE
+    - uses: actions/upload-artifact@v4
+      with:
+        name: www-provenance
+        path: .ci/www-provenance.json
+        retention-days: 30

.gitea/workflows/services-www-pr-required.yml

@@ -0,0 +1,302 @@
+name: services/www - pr/required
+'on':
+  pull_request:
+    branches:
+    - next
+    paths:
+    - services/www/**
+    - packages/ui/**
+    - packages/stl/**
+    - packages/i18n/**
+    - .gitea/workflows/services-www-pr-required.yml
+    - pnpm-lock.yaml
+    - ci/scripts/**
+concurrency:
+  group: ci-pr-www-${{ github.head_ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  actions: read
+jobs:
+  setup-stage:
+    name: Setup - Stage
+    runs-on: apex-debian13
+    outputs: {}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Pack dependency cache
+      run: python3 ci/scripts/cache.py pack
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ steps.dependency-cache.outputs.key }}
+        path: .ci/pnpm-store.tar
+        retention-days: 7
+  build-configs:
+    name: Build - Configs
+    needs: setup-stage
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Build Rsbuild config
+      run: pnpm --filter @ermnvldmr/rsbuild-config build
+    - name: Build Storybook config
+      run: pnpm --filter @ermnvldmr/storybook-config build
+    - name: Upload Rsbuild Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+        retention-days: 30
+    - name: Upload Storybook Config
+      uses: actions/upload-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+        retention-days: 30
+    - name: Build i18n package
+      run: pnpm --filter @ermnvldmr/i18n build
+    - name: Upload i18n dist
+      uses: actions/upload-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+        retention-days: 30
+  lint-www:
+    name: Lint - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Lint WWW service
+      run: pnpm --filter @ermnvldmr/www lint
+  typecheck-www:
+    name: Typecheck - WWW
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Typecheck WWW service
+      run: pnpm --filter @ermnvldmr/www typecheck
+  build-storybook:
+    name: Build - Storybook
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Build WWW Storybook
+      run: pnpm --filter @ermnvldmr/www build-storybook
+    - name: Upload Storybook build
+      uses: actions/upload-artifact@v4
+      with:
+        name: www-storybook-static-${{ github.run_id }}
+        path: services/www/storybook-static/
+        retention-days: 30
+  test-www:
+    name: Test - Unit
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Test WWW service
+      run: pnpm --filter @ermnvldmr/www test:coverage
+  test-storybook:
+    name: Test - Storybook
+    needs: build-storybook
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Install Playwright browsers
+      run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
+    - name: Download Storybook build
+      uses: actions/download-artifact@v4
+      with:
+        name: www-storybook-static-${{ github.run_id }}
+        path: services/www/storybook-static/
+    - name: Serve Storybook and run tests with coverage
+      run: pnpm --filter @ermnvldmr/www test:storybook:ci
+  build-www:
+    name: Build - WWW Service
+    needs: build-configs
+    runs-on: apex-debian13
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Setup environment
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
+    - name: Restore repository dependency cache
+      id: dependency-cache
+      run: python3 ci/scripts/cache.py restore
+      env:
+        CACHE_TOKEN: ${{ github.token }}
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+    - name: Download Rsbuild Config
+      uses: actions/download-artifact@v4
+      with:
+        name: rsbuild-config-dist-${{ github.run_id }}
+        path: packages/rsbuild-config/dist
+    - name: Download i18n dist
+      uses: actions/download-artifact@v4
+      with:
+        name: i18n-dist-${{ github.run_id }}
+        path: packages/i18n/dist
+    - name: Download Storybook Config
+      uses: actions/download-artifact@v4
+      with:
+        name: storybook-config-dist-${{ github.run_id }}
+        path: packages/storybook-config/dist
+    - name: Build WWW service (all locales)
+      run: pnpm --filter @ermnvldmr/www build:all
+      env:
+        RSDOCTOR: 'true'
+    - name: Upload Rsdoctor report
+      uses: actions/upload-artifact@v4
+      with:
+        name: rsdoctor-report-${{ github.run_id }}
+        path: services/www/rsdoctor/
+        retention-days: 30

.gitea/workflows/services-www-release-manual.yml

@@ -0,0 +1,91 @@
+name: services/www - manual release
+'on':
+  workflow_dispatch:
+    inputs:
+      tested_sha:
+        description: Full tested source commit (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+      tested_digest:
+        description: OCI sha256 digest (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+      build_run_id:
+        description: Successful WWW build run ID (leave blank for latest)
+        required: false
+        type: string
+        default: ''
+permissions:
+  contents: write
+  packages: write
+  actions: read
+jobs:
+  release:
+    name: Release - Tag and Promote
+    runs-on: apex-debian13
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next' && github.actor == 'deytenit'
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Authenticate local registry
+      run: python3 ci/scripts/docker.py login
+      env:
+        REGISTRY: git.ermnvldmr.com
+        REGISTRY_USER: ${{ github.repository_owner }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    - name: Verify successful build and immutable digest
+      id: provenance
+      run: python3 ci/scripts/provenance.py
+      env:
+        TESTED_SHA: ${{ inputs.tested_sha }}
+        TESTED_DIGEST: ${{ inputs.tested_digest }}
+        BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+    - name: Promote tested digest and create release tag
+      env:
+        TESTED_SHA: ${{ steps.provenance.outputs.tested_sha }}
+        TESTED_DIGEST: ${{ steps.provenance.outputs.tested_digest }}
+        BUILD_RUN_ID: ${{ steps.provenance.outputs.build_run_id }}
+        PROVENANCE_TOKEN: ${{ github.token }}
+        GIT_WRITE_KEY: ${{ secrets.WWW_DEPLOY_KEY }}
+      run: |
+        set -euo pipefail
+
+        VERSION=$(bash ci/scripts/calver-release.sh www)
+        TAG_NAME="services/www-$VERSION"
+
+        echo "Tagging Git commit $TESTED_SHA with $TAG_NAME..."
+        bash ci/scripts/calver-release.sh tag www "$TESTED_SHA" "$VERSION"
+
+        echo "Promoting Docker image to $VERSION and latest..."
+        docker buildx imagetools create --prefer-index=false \
+          "git.ermnvldmr.com/${{ github.repository }}/www@$TESTED_DIGEST" \
+          --tag "git.ermnvldmr.com/${{ github.repository }}/www:$VERSION" \
+          --tag "git.ermnvldmr.com/${{ github.repository }}/www:latest"
+
+        test "$(docker buildx imagetools inspect "git.ermnvldmr.com/${{ github.repository }}/www:$VERSION" --format '{{.Manifest.Digest}}')" = "$TESTED_DIGEST"
+
+        export VERSION TAG_NAME
+        mkdir -p .ci
+        python3 - <<'RELEASE_PROVENANCE'
+        import json, os
+        from pathlib import Path
+
+        Path('.ci/www-release.json').write_text(json.dumps({
+            'sha': os.environ['TESTED_SHA'],
+            'digest': os.environ['TESTED_DIGEST'],
+            'run_id': os.environ['BUILD_RUN_ID'],
+            'repository': os.environ['GITHUB_REPOSITORY'],
+            'release_tag': os.environ['TAG_NAME'],
+            'version': os.environ['VERSION']
+        }))
+        RELEASE_PROVENANCE
+    - uses: actions/upload-artifact@v4
+      with:
+        name: www-release-provenance
+        path: .ci/www-release.json
+        retention-days: 30

.github/workflows/packages-kits-next-required.yml

@@ -1,361 +0,0 @@
-name: packages/kits - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/kits/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-kits-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-next-kits-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs & UI
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Build UI
-        run: pnpm --filter @ermnvldmr/ui build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-      - name: Upload UI dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-          retention-days: 1
-
-  lint-kits:
-    name: Lint - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Lint Kits package
-        run: pnpm --filter @ermnvldmr/kits lint
-
-  typecheck-kits:
-    name: Typecheck - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Typecheck Kits package
-        run: pnpm --filter @ermnvldmr/kits typecheck
-
-  test-kits:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Test Kits package
-        run: pnpm --filter @ermnvldmr/kits test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/lcov.info
-          flags: kits
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits Storybook
-        run: pnpm --filter @ermnvldmr/kits build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-          retention-days: 1
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/kits test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/storybook/lcov.info
-          flags: kits-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-kits:
-    name: Build - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits package
-        run: pnpm --filter @ermnvldmr/kits build

.github/workflows/packages-kits-pr-required.yml

@@ -1,361 +0,0 @@
-name: packages/kits - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/kits/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-kits-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-kits-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs & UI
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Build UI
-        run: pnpm --filter @ermnvldmr/ui build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-      - name: Upload UI dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-          retention-days: 1
-
-  lint-kits:
-    name: Lint - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Lint Kits package
-        run: pnpm --filter @ermnvldmr/kits lint
-
-  typecheck-kits:
-    name: Typecheck - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Typecheck Kits package
-        run: pnpm --filter @ermnvldmr/kits typecheck
-
-  test-kits:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Test Kits package
-        run: pnpm --filter @ermnvldmr/kits test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/lcov.info
-          flags: kits
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits Storybook
-        run: pnpm --filter @ermnvldmr/kits build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-          retention-days: 1
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: kits-storybook-static-${{ github.run_id }}
-          path: packages/kits/storybook-static/
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/kits test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/kits/coverage/storybook/lcov.info
-          flags: kits-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-kits:
-    name: Build - Kits
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download UI dist
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-dist-${{ github.run_id }}
-          path: packages/ui/dist
-      - name: Build Kits package
-        run: pnpm --filter @ermnvldmr/kits build

.github/workflows/packages-ssg-next-required.yml

@@ -1,145 +0,0 @@
-name: packages/ssg - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/ssg/**'
-      - '.github/workflows/packages-ssg-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-ssg-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-ssg:
-    name: Lint - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Lint SSG package
-        run: pnpm --filter @ermnvldmr/ssg lint
-
-  typecheck-ssg:
-    name: Typecheck - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Typecheck SSG package
-        run: pnpm --filter @ermnvldmr/ssg typecheck
-
-  build-ssg:
-    name: Build - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Build SSG package
-        run: pnpm --filter @ermnvldmr/ssg build

.github/workflows/packages-ssg-pr-required.yml

@@ -1,145 +0,0 @@
-name: packages/ssg - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/ssg/**'
-      - '.github/workflows/packages-ssg-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-ssg-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-ssg:
-    name: Lint - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Lint SSG package
-        run: pnpm --filter @ermnvldmr/ssg lint
-
-  typecheck-ssg:
-    name: Typecheck - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Typecheck SSG package
-        run: pnpm --filter @ermnvldmr/ssg typecheck
-
-  build-ssg:
-    name: Build - SSG
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Build SSG package
-        run: pnpm --filter @ermnvldmr/ssg build

.github/workflows/packages-stl-next-required.yml

@@ -1,176 +0,0 @@
-name: packages/stl - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/stl/**'
-      - '.github/workflows/packages-stl-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-stl-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-stl:
-    name: Lint - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Lint STL package
-        run: pnpm --filter @ermnvldmr/stl lint
-
-  typecheck-stl:
-    name: Typecheck - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Typecheck STL package
-        run: pnpm --filter @ermnvldmr/stl typecheck
-
-  test-stl:
-    name: Test - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Test STL package
-        run: pnpm --filter @ermnvldmr/stl test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/stl/coverage/lcov.info
-          flags: stl
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-stl:
-    name: Build - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Build STL package
-        run: pnpm --filter @ermnvldmr/stl build

.github/workflows/packages-stl-pr-required.yml

@@ -1,176 +0,0 @@
-name: packages/stl - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/stl/**'
-      - '.github/workflows/packages-stl-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-stl-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-
-  lint-stl:
-    name: Lint - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Lint STL package
-        run: pnpm --filter @ermnvldmr/stl lint
-
-  typecheck-stl:
-    name: Typecheck - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Typecheck STL package
-        run: pnpm --filter @ermnvldmr/stl typecheck
-
-  test-stl:
-    name: Test - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Test STL package
-        run: pnpm --filter @ermnvldmr/stl test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/stl/coverage/lcov.info
-          flags: stl
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-stl:
-    name: Build - STL
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Build STL package
-        run: pnpm --filter @ermnvldmr/stl build

.github/workflows/packages-ui-next-required.yml

@@ -1,313 +0,0 @@
-name: packages/ui - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-ui-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-ui-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-ui:
-    name: Lint - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Lint UI package
-        run: pnpm --filter @ermnvldmr/ui lint
-
-  typecheck-ui:
-    name: Typecheck - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Typecheck UI package
-        run: pnpm --filter @ermnvldmr/ui typecheck
-
-  test-ui:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Test UI package
-        run: pnpm --filter @ermnvldmr/ui test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/lcov.info
-          flags: ui
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/ui test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/storybook/lcov.info
-          flags: ui-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-ui:
-    name: Build - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build UI package
-        run: pnpm --filter @ermnvldmr/ui build

.github/workflows/packages-ui-pr-required.yml

@@ -1,322 +0,0 @@
-name: packages/ui - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/packages-ui-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-ui-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-ui:
-    name: Lint - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Lint UI package
-        run: pnpm --filter @ermnvldmr/ui lint
-
-  typecheck-ui:
-    name: Typecheck - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Typecheck UI package
-        run: pnpm --filter @ermnvldmr/ui typecheck
-
-  test-ui:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Test UI package
-        run: pnpm --filter @ermnvldmr/ui test:coverage
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/lcov.info
-          flags: ui
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build UI Storybook
-        run: pnpm --filter @ermnvldmr/ui build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: ui-storybook-static-${{ github.run_id }}
-          path: packages/ui/storybook-static/
-          retention-days: 1
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: ui-storybook-static-${{ github.run_id }}
-          path: packages/ui/storybook-static/
-      - name: Test Storybook
-        run: pnpm --filter @ermnvldmr/ui test:storybook:ci
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./packages/ui/coverage/storybook/lcov.info
-          flags: ui-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-ui:
-    name: Build - UI
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build UI package
-        run: pnpm --filter @ermnvldmr/ui build

.github/workflows/services-docs-next-required.yml

@@ -1,112 +0,0 @@
-name: services/docs - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/docs/**'
-
-concurrency:
-  group: ci-docs-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-hugo:
-    name: Setup - Hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-  build-hugo:
-    name: Build - Hugo Site
-    needs: setup-hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-      - name: Build Hugo site
-        working-directory: services/docs
-        run: hugo --gc --minify
-
-  release-docker:
-    name: Release - Docker Image
-    needs: build-hugo
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/docs
-          tags: |
-            type=raw,value=latest
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/docs/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  deploy:
-    name: Deploy - VPS
-    needs: release-docker
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
-    steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.DEPLOY_VPS_HOST }}
-          username: ${{ secrets.DEPLOY_VPS_USER }}
-          key: ${{ secrets.DEPLOY_VPS_SSH_KEY }}
-          port: ${{ secrets.DEPLOY_VPS_SSH_PORT || 22 }}
-          script: |
-            cd /srv/ermnvldmr.com
-            git pull
-            chmod +x ci/scripts/deploy-new-tags.sh
-            # Use the short SHA to match the tag from release-docker
-            export DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-            ./ci/scripts/deploy-new-tags.sh

.github/workflows/services-docs-pr-required.yml

@@ -1,54 +0,0 @@
-name: services/docs - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/docs/**'
-      - '.github/workflows/services-docs-pr-required.yml'
-
-concurrency:
-  group: ci-pr-docs-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-hugo:
-    name: Setup - Hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-  build-hugo:
-    name: Build - Hugo Site
-    needs: setup-hugo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          fetch-depth: 0
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          extended: true
-
-      - name: Build Hugo site
-        working-directory: services/docs
-        run: hugo --gc --minify

.github/workflows/services-static-next-required.yml

@@ -1,204 +0,0 @@
-name: services/static - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/static/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-static-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-static-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-static:
-    name: Lint - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Lint static service
-        run: pnpm --filter @ermnvldmr/static lint
-
-  typecheck-static:
-    name: Typecheck - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Typecheck static service
-        run: pnpm --filter @ermnvldmr/static typecheck
-
-  build-static:
-    name: Build - Static Site
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Build static service
-        run: pnpm --filter @ermnvldmr/static build
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-dist
-          path: services/static/dist/
-          retention-days: 1
-
-  deploy-s3:
-    name: Deploy - S3
-    needs: [lint-static, typecheck-static, build-static]
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: static-dist
-          path: services/static/dist/
-
-      - name: Deploy to S3
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }}
-          S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }}
-          AWS_REGION: ${{ secrets.STATIC_AWS_REGION }}
-          S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }}
-        run: |
-          chmod +x ci/scripts/deploy-static.sh
-          ./ci/scripts/deploy-static.sh

.github/workflows/services-static-pr-required.yml

@@ -1,177 +0,0 @@
-name: services/static - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/static/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-static-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-static-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-static:
-    name: Lint - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Lint static service
-        run: pnpm --filter @ermnvldmr/static lint
-
-  typecheck-static:
-    name: Typecheck - Static
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Typecheck static service
-        run: pnpm --filter @ermnvldmr/static typecheck
-
-  build-static:
-    name: Build - Static Site
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Build static service
-        run: pnpm --filter @ermnvldmr/static build
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-dist-${{ github.run_id }}
-          path: services/static/dist/
-          retention-days: 1

.github/workflows/services-www-next-checkout-release-branch.yml

@@ -1,59 +0,0 @@
-name: services/www - next/checkout-release-branch
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  workflow-release-branch:
-    name: Workflow - Create or Update Release Branch
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      actions: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Determine Mode and Branch Name
-        id: plan
-        run: |
-          REF="${{ github.ref_name }}"
-          if [[ "$REF" =~ ^releases/www/v[0-9]+\.[0-9]+$ ]]; then
-            # Dispatched against an existing release branch: update it.
-            echo "mode=update" >> "$GITHUB_OUTPUT"
-            echo "branch_name=$REF" >> "$GITHUB_OUTPUT"
-          else
-            # Dispatched against next (or any other ref): create a new release branch.
-            BRANCH_NAME=$(bash ci/scripts/semantic-release.sh checkout services/www)
-            echo "mode=create" >> "$GITHUB_OUTPUT"
-            echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create and Push Branch
-        if: steps.plan.outputs.mode == 'create'
-        run: |
-          git checkout -b ${{ steps.plan.outputs.branch_name }}
-          git push origin ${{ steps.plan.outputs.branch_name }}
-
-      - name: Rebase Existing Branch onto next
-        if: steps.plan.outputs.mode == 'update'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          # Bring the release branch up to date with its father (next),
-          # replaying any release-branch-only commits on top of the latest next.
-          git fetch origin next
-          git rebase FETCH_HEAD
-          git push --force-with-lease origin ${{ steps.plan.outputs.branch_name }}
-
-      - name: Trigger Release Workflow
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh workflow run services-www-releases-required.yml --ref ${{ steps.plan.outputs.branch_name }}

.github/workflows/services-www-next-required.yml

@@ -1,367 +0,0 @@
-name: services/www - next/required
-
-on:
-  push:
-    branches: [next]
-    paths:
-      - 'services/www/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-www-next-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-www-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Build i18n package
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-      - name: Upload Unit coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/lcov.info
-          flags: www
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests with coverage
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-      - name: Upload Storybook coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/storybook/lcov.info
-          flags: www-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist
-          path: packages/storybook-config/dist
-      - name: Build WWW service (all locales)
-        run: pnpm --filter @ermnvldmr/www build:all
-        env:
-          RSDOCTOR: 'true'
-      - name: Upload Rsdoctor report
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsdoctor-report
-          path: services/www/rsdoctor/
-          retention-days: 30
-
-  release-docker:
-    name: Release - Docker Image
-    needs: build-www
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=next
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/services-www-pr-required.yml

@@ -1,331 +0,0 @@
-name: services/www - pr/required
-
-on:
-  pull_request:
-    branches: [next]
-    paths:
-      - 'services/www/**'
-      - 'packages/ui/**'
-      - 'packages/stl/**'
-      - 'packages/i18n/**'
-      - '.github/workflows/services-www-pr-required.yml'
-      - 'pnpm-lock.yaml'
-
-concurrency:
-  group: ci-pr-www-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Upload Rsbuild Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-          retention-days: 1
-      - name: Upload Storybook Config
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-          retention-days: 1
-      - name: Build i18n package
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload i18n dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: www-storybook-static-${{ github.run_id }}
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-      - name: Upload Unit coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/lcov.info
-          flags: www
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: www-storybook-static-${{ github.run_id }}
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests with coverage
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-      - name: Upload Storybook coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./services/www/coverage/storybook/lcov.info
-          flags: www-storybook
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Rsbuild Config
-        uses: actions/download-artifact@v4
-        with:
-          name: rsbuild-config-dist-${{ github.run_id }}
-          path: packages/rsbuild-config/dist
-      - name: Download i18n dist
-        uses: actions/download-artifact@v4
-        with:
-          name: i18n-dist-${{ github.run_id }}
-          path: packages/i18n/dist
-      - name: Download Storybook Config
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-config-dist-${{ github.run_id }}
-          path: packages/storybook-config/dist
-      - name: Build WWW service (all locales)
-        run: pnpm --filter @ermnvldmr/www build:all
-        env:
-          RSDOCTOR: 'true'
-      - name: Upload Rsdoctor report
-        uses: actions/upload-artifact@v4
-        with:
-          name: rsdoctor-report-${{ github.run_id }}
-          path: services/www/rsdoctor/
-          retention-days: 7

.github/workflows/services-www-releases-dispatch-release.yml

@@ -1,310 +0,0 @@
-name: services/www - releases/dispatch-release
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-artifacts
-          path: |
-            packages/rsbuild-config/dist
-            packages/storybook-config/dist
-            packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW service
-        run: pnpm --filter @ermnvldmr/www build
-
-  release-tag-docker:
-    name: Release - Tag & Docker
-    needs: [lint-www, typecheck-www, test-www, test-storybook, build-www]
-    runs-on: ubuntu-latest
-    environment: services-www-releases-publish
-    permissions:
-      contents: write
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Calculate Release Version
-        id: version
-        run: |
-          RELEASE_VERSION=$(bash ci/scripts/semantic-release.sh release ${{ github.ref_name }})
-          # Extract MAJOR.MINOR for tagging
-          MAJOR_MINOR=$(echo "${{ github.ref_name }}" | cut -d/ -f3 | sed 's/^v//')
-          MAJOR=$(echo "$MAJOR_MINOR" | cut -d. -f1)
-          echo "version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
-          echo "major_minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
-          echo "major=$MAJOR" >> $GITHUB_OUTPUT
-
-      - name: Create and Push Tag
-        run: |
-          TAG_NAME="releases/www/v${{ steps.version.outputs.version }}"
-          git tag $TAG_NAME
-          git push origin $TAG_NAME
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=v${{ steps.version.outputs.version }}
-            type=raw,value=v${{ steps.version.outputs.major_minor }}
-            type=raw,value=v${{ steps.version.outputs.major }}
-            type=raw,value=latest
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  deploy:
-    name: Deploy - VPS
-    needs: release-tag-docker
-    runs-on: ubuntu-latest
-    environment:
-      name: services-www-releases-deploy
-      url: https://ermnvldmr.com
-    steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.DEPLOY_VPS_HOST }}
-          username: ${{ secrets.DEPLOY_VPS_USER }}
-          key: ${{ secrets.DEPLOY_VPS_SSH_KEY }}
-          port: ${{ secrets.DEPLOY_VPS_SSH_PORT || 22 }}
-          script: |
-            cd /srv/ermnvldmr.com
-            git pull
-            chmod +x ci/scripts/deploy-new-tags.sh
-            # Use the short SHA to match the tag from release-tag-docker
-            export WWW_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-            ./ci/scripts/deploy-new-tags.sh

.github/workflows/services-www-releases-required.yml

@@ -1,278 +0,0 @@
-name: services/www - releases/required
-
-on:
-  push:
-    branches: ['releases/www/**']
-  workflow_dispatch:
-
-concurrency:
-  group: ci-www-rel-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-artifacts
-          path: |
-            packages/rsbuild-config/dist
-            packages/storybook-config/dist
-            packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW service
-        run: pnpm --filter @ermnvldmr/www build
-
-  release-rc-docker:
-    name: Release - RC Docker Image
-    needs: build-www
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Calculate RC Version
-        id: version
-        run: |
-          RC_VERSION=$(bash ci/scripts/semantic-release.sh rc ${{ github.ref_name }})
-          echo "rc_version=$RC_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=v${{ steps.version.outputs.rc_version }}
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -25,6 +25,9 @@ playwright-report/
 .env
 .env.keys
 
+# local development certificates
+.certs/
+
 # macOS-specific files
 .DS_Store
 
@@ -34,3 +37,18 @@ playwright-report/
 # agents plans and designs
 docs/plans/
 docs/superpowers/
+
+# SOPS and Kubernetes Secrets
+*.dec.yaml
+*.plain.yaml
+*.local.yaml
+*.key
+.sops/keys.txt
+ci/k8s/**/secret.yaml
+ci/cloud-init/user-data.yaml
+
+# Packer & QEMU Build Artifacts
+output-qemu/
+*.qcow2
+*.iso
+

.sops.yaml

@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: ci/k8s/.*secret.*\.yaml$
+    encrypted_regex: '^(data|stringData)$'
+    age: "age15zq3cje3ttmx2fhqp9cpeght6feq2w8e5m38799stjetj8urcccs36r4rc,age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl"

GEMINI.md

@@ -123,7 +123,7 @@ ermnvldmr.com/
 - **DO NOT** use self-referential package imports within workspace packages; use relative paths.
 - **DO NOT** suppress linter or compiler errors with `@ts-ignore`, `@ts-nocheck`, or inline eslint disables without explicit user approval.
 - **DO NOT** commit unencrypted `.env` files or secret keys (`.env.keys`).
-- **DO NOT** run `git commit` or execute automated git commits under any circumstances.
+- **DO NOT** run destructive Git operations (such as force pushing to `main`/`next` or dropping uncommitted user work) without authorization.
 
 ## 5. Critical Workflows & Safety Directives
 
@@ -143,5 +143,4 @@ The agent MUST NOT modify the following files or directories unless explicitly r
 - `.env.keys` (untracked decryption keys).
 - `pnpm-lock.yaml` (dependencies must be managed exclusively through `pnpm` CLI commands).
 - `LICENSE` file.
-- `ci/` deployment configurations, Dockerfiles, and GitHub Actions workflows.
 - `services/docs/content/` and `services/www/content/` creative and literary works.

README.md

@@ -1,6 +1,5 @@
 # [ermnvldmr.com](https://ermnvldmr.com)
 
-[![codecov](https://codecov.io/gh/deytenit/ermnvldmr.com/graph/badge.svg)](https://app.codecov.io/github/deytenit/ermnvldmr.com)
 
 The monorepo powering the front pages of my own
 
@@ -58,7 +57,7 @@ Want to contribute or understand the codebase.
   - UI Library: `pnpm ui:dev`
 - **Development Guide**: [AGENTS.md](./AGENTS.md)
 - **Component Development**: `pnpm ui:storybook`
-- **Testing**: `pnpm test` or `pnpm test:coverage` (View results on [Codecov](https://app.codecov.io/github/deytenit/ermnvldmr.com))
+- **Testing**: `pnpm test` or `pnpm test:coverage`
 - **Code Quality**: `pnpm lint` and `pnpm typecheck`
 
 ### Designer

ci/cloud-init/user-data.template.yaml

@@ -0,0 +1,42 @@
+#cloud-config
+# ==============================================================================
+# Cloud-Init User-Data Template for K3s Single-Node Cluster (com-ermnvldmr)
+# 
+# Usage:
+#   1. Copy this template to user-data.yaml:
+#        cp ci/cloud-init/user-data.template.yaml ci/cloud-init/user-data.yaml
+#   2. Replace the stubs below (SSH authorized key & Age private key).
+#   3. Pass user-data.yaml during VM creation in Yandex Cloud / Cloud Provider.
+#      Note: user-data.yaml is ignored by git to protect private keys.
+# ==============================================================================
+
+preserve_hostname: false
+hostname: com-ermnvldmr
+ssh_pwauth: false
+
+# ------------------------------------------------------------------------------
+# 1. User & SSH Key Configuration (Replace stub with your public SSH key)
+# ------------------------------------------------------------------------------
+users:
+  - name: adam
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLACEHOLDERFORYOURPUBLICSSHKEY user@hostname"
+
+write_files:
+  # ----------------------------------------------------------------------------
+  # 2. SOPS / Age Decryption Key (Replace stub with your private AGE key)
+  # ----------------------------------------------------------------------------
+  - path: /root/.config/sops/age/keys.txt
+    owner: root:root
+    permissions: '0600'
+    content: |
+      # public key: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+      AGE-SECRET-KEY-1PLACEHOLDERFORYOURPRIVATEAGEKEY
+
+# ------------------------------------------------------------------------------
+# 3. Bootstrap Cluster (Pre-baked script mounts disk, starts K3s, and syncs Flux)
+# ------------------------------------------------------------------------------
+runcmd:
+  - /usr/local/bin/bootstrap-cluster.sh

ci/config/nginx/default.conf

@@ -5,6 +5,16 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Prevent HTTP protocol downgrade behind reverse proxy on redirects
+    absolute_redirect off;
+
+    # Security Headers (Defense in depth)
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
     # Gzip compression
     gzip on;
     gzip_vary on;
@@ -25,13 +35,15 @@ server {
     # root is inherited from server block, so /en/static/js/file.js resolves correctly
     location ~* \.(js|css|woff|woff2|ttf|eot)$ {
         expires 1y;
-        add_header Cache-Control "public, immutable";
+        add_header Cache-Control "public, immutable" always;
+        add_header Access-Control-Allow-Origin "*" always;
     }
 
     # Cache images
     location ~* \.(png|jpg|jpeg|gif|ico|svg)$ {
         expires 1y;
-        add_header Cache-Control "public, no-transform";
+        add_header Cache-Control "public, no-transform" always;
+        add_header Access-Control-Allow-Origin "*" always;
     }
 
     # English locale — SPA fallback for non-asset routes
@@ -44,6 +56,14 @@ server {
         try_files $uri $uri/ $uri.html /ru/index.html;
     }
 
+    # Version probe for release rollout verification
+    location = /version.json {
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        add_header Content-Type "application/json" always;
+        add_header Access-Control-Allow-Origin "*" always;
+        try_files /version.json =404;
+    }
+
     # Error pages
     error_page 404 /en/index.html;
 }

ci/deploy/.env.template

@@ -1,6 +0,0 @@
-# Docker Image Tags
-DOCS_TAG=$DOCS_TAG
-WWW_TAG=$WWW_TAG
-
-# Application Settings
-DOMAIN=ermnvldmr.com

ci/deploy/docker-compose.yml

@@ -1,61 +0,0 @@
-name: com-ermnvldmr
-
-services:
-  nginx:
-    image: nginx:1.28-alpine
-    container_name: com-ermnvldmr-nginx
-    restart: always
-    ports:
-      - '80:80'
-      - '443:443'
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./nginx/conf.d:/etc/nginx/conf.d:ro
-      - /etc/letsencrypt:/etc/letsencrypt:ro
-    networks:
-      - com-ermnvldmr-direct
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.50'
-          memory: 256M
-    security_opt:
-      - no-new-privileges:true
-
-  docs:
-    image: ghcr.io/deytenit/ermnvldmr.com/docs:${DOCS_TAG}
-    container_name: com-ermnvldmr-docs
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-  www:
-    image: ghcr.io/deytenit/ermnvldmr.com/www:${WWW_TAG}
-    container_name: com-ermnvldmr-www
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-networks:
-  com-ermnvldmr-direct:
-    name: com-ermnvldmr-direct
-    driver: bridge
-  com-ermnvldmr-enclave:
-    name: com-ermnvldmr-enclave
-    internal: true
-    driver: bridge

ci/deploy/nginx/conf.d/docs.conf

@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name docs.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name docs.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/docs.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/docs.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-docs:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}

ci/deploy/nginx/conf.d/www.conf

@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name www.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name www.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/www.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/www.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-www:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}

ci/deploy/nginx/nginx.conf

@@ -1,30 +0,0 @@
-user nginx;
-worker_processes auto;
-error_log /var/log/nginx/error.log warn;
-pid /var/run/nginx.pid;
-
-events {
-    worker_connections 1024;
-}
-
-http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    # Optimization
-    sendfile on;
-    tcp_nopush on;
-    tcp_nodelay on;
-    keepalive_timeout 65;
-    types_hash_max_size 2048;
-    server_tokens off;
-
-    # Security Headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer-when-downgrade" always;
-    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
-
-    include /etc/nginx/conf.d/*.conf;
-}

ci/docker/docs/Dockerfile

@@ -14,8 +14,15 @@ RUN hugo --gc --minify
 # Stage 2: Runtime
 FROM nginx:alpine
 
+ARG COMMIT_SHA="unknown"
+ARG VERSION="latest"
+
 COPY --from=builder /src/services/docs/public /usr/share/nginx/html
 COPY ci/config/nginx/default.conf /etc/nginx/conf.d/default.conf
 
+# Generate version metadata for automated rollout verification
+RUN printf '{\n  "service": "docs",\n  "version": "%s",\n  "commit": "%s",\n  "builtAt": "%s"\n}\n' \
+    "${VERSION}" "${COMMIT_SHA}" "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" > /usr/share/nginx/html/version.json
+
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]

ci/docker/www/Dockerfile

@@ -37,8 +37,15 @@ RUN pnpm --filter @ermnvldmr/www build:all
 # Stage 2: Runtime
 FROM nginx:alpine
 
+ARG COMMIT_SHA="unknown"
+ARG VERSION="latest"
+
 COPY --from=builder /app/services/www/dist /usr/share/nginx/html
 COPY ci/config/nginx/default.conf /etc/nginx/conf.d/default.conf
 
+# Generate version metadata for automated rollout verification
+RUN printf '{\n  "service": "www",\n  "version": "%s",\n  "commit": "%s",\n  "builtAt": "%s"\n}\n' \
+    "${VERSION}" "${COMMIT_SHA}" "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" > /usr/share/nginx/html/version.json
+
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]

ci/k8s/apps/docs/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docs
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: docs
+  template:
+    metadata:
+      labels:
+        app: docs
+    spec:
+      containers:
+        - name: docs
+          image: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs:sha-91f5245
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2

ci/k8s/apps/docs/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+- deployment.yaml
+- service.yaml
+images:
+- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs
+  newName: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs
+  newTag: sha-4e0bb72

ci/k8s/apps/docs/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: docs-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: docs
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

ci/k8s/apps/postgres/configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgres-config
+  namespace: com-ermnvldmr
+data:
+  postgresql.conf: |
+    # Low-memory tuned configuration for single-node K3s VM
+    listen_addresses = '*'
+    max_connections = 50
+    shared_buffers = 64MB
+    effective_cache_size = 128MB
+    maintenance_work_mem = 16MB
+    checkpoint_completion_target = 0.9
+    wal_buffers = 2MB
+    default_statistics_target = 100
+    random_page_cost = 1.1
+    effective_io_concurrency = 200
+    work_mem = 4MB
+    min_wal_size = 80MB
+    max_wal_size = 512MB

ci/k8s/apps/postgres/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+  - configmap.yaml
+  - secret.sops.yaml
+  - pvc.yaml
+  - statefulset.yaml
+  - service.yaml

ci/k8s/apps/postgres/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-pvc
+  namespace: com-ermnvldmr
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 5Gi

ci/k8s/apps/postgres/secret.sops.yaml

@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: postgres-secrets
+    namespace: com-ermnvldmr
+type: Opaque
+stringData:
+    POSTGRES_DB: ENC[AES256_GCM,data:ChvCjVw=,iv:97n6Q+WzbVOwvRZGGHAfBXQDPx5mnUCSsUNs76xV1p4=,tag:mZLUB3q0UR+9ovqmndFrRg==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:V1q4xfE=,iv:RPHHhWLkdmKHG6CMubrw8JUfHlDXnL0x76JEo05O+mo=,tag:PV1YEyqeb8bTF/98SL1uKQ==,type:str]
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:aBWfOuPyeAEo0vf8fAYzlTfXooPKX6FPbHkpBQ+4zve0KBQh7/yvjQ==,iv:FB/fZoLirzPTbDIel7wRECQP85sFFlIdyoljrilbMxU=,tag:tTZz1PHhaLtmPO9Pg8Vh5g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRWFNtaHhPbmlodUZXSFgy
+            S1YwUjc4ZnZWdy9TM1NiejdrRHJuZnR5aG5rCjJrMWY2OXExZkpmUHpUNTE1T05x
+            dzBYbmI3ZmVHRlhXaHk5dFFEMjIxUUUKLS0tIEd0L2N4TUsxV0tjWm81cUQ4dVdS
+            WDVuSGxuNVAxeVk2UUdhQnFDV1FZOW8K4Fc8T/XM+E6F0iOqpSMbh/pOAI2vq3am
+            9rMDxzwfIL9hwNDoy5LVPdnBfOXlCoZ8OnMR9Euj8FBW6pHErkmBUA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age15zq3cje3ttmx2fhqp9cpeght6feq2w8e5m38799stjetj8urcccs36r4rc
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0K3k2cis1T3hrSmZGa2hq
+            ME1VQy9HSG5MWUhjdXgzb0cwNitYY1ZvRVI4Cm0vYXptOW9TUDJFZzZvNEJLOHJB
+            VnhnK1hOWUgxd2E1VmFDbFJPZUlQajAKLS0tIEszV0FRMHoyQ2lFUm5IWGtnVUNH
+            Q244Nmd2czZXSmxEMnk3cWV1bm8rS28KGyANylD4EQkhWKDHwmGQHyAm1ZjA5acw
+            VisJZnJ9KuFPB2Toi7FTMeHRNYPk1uXgwKoDFLSrzMElPXWDWm4B7A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:tvk/U3XXcRrJCI8I0yUID6jwnlPc1ftiOHs8uxqrbAtLN3KelHGy94fWyxYMoboHeh5R8pNErIxk9EsJok2wjrSENZWMXueVZHtMUWlyC4DhTDAVVYhJ6sL85f6cMiHWDNSlTk4AvfWvdvE6b/0coZ7Rybgw5kNeW6Stw4CSbu4=,iv:sfiOamzam1e0t01KaGHSsnZOBpBGEi3K0KK50QDmaFs=,tag:Ul6xShhIdvTuX3qS6Uo4Kg==,type:str]
+    version: 3.13.3

ci/k8s/apps/postgres/secret.template.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-secrets
+  namespace: com-ermnvldmr
+type: Opaque
+stringData:
+  POSTGRES_DB: "umami"
+  POSTGRES_USER: "umami"
+  POSTGRES_PASSWORD: "CHANGE_ME_IN_ENCRYPTED_SOPS_SECRET"

ci/k8s/apps/postgres/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432

ci/k8s/apps/postgres/statefulset.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: com-ermnvldmr
+spec:
+  serviceName: postgres-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_DB
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_PASSWORD
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - name: postgres
+              containerPort: 5432
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: config
+              mountPath: /etc/postgresql/postgresql.conf
+              subPath: postgresql.conf
+          readinessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - $(POSTGRES_USER)
+                - -d
+                - $(POSTGRES_DB)
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - $(POSTGRES_USER)
+                - -d
+                - $(POSTGRES_DB)
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 5
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: postgres-pvc
+        - name: config
+          configMap:
+            name: postgres-config

ci/k8s/apps/umami/configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: umami-config
+  namespace: com-ermnvldmr
+data:
+  DATABASE_TYPE: "postgresql"
+  CLIENT_IP_HEADER: "X-Forwarded-For"
+  TRACKER_SCRIPT_NAME: "trace.js"

ci/k8s/apps/umami/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: umami
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: umami
+  template:
+    metadata:
+      labels:
+        app: umami
+      annotations:
+        config/tracker-script-name: "trace.js"
+    spec:
+      containers:
+        - name: umami
+          image: ghcr.io/umami-software/umami:postgresql-v2.14.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+          envFrom:
+            - configMapRef:
+                name: umami-config
+            - secretRef:
+                name: umami-secrets
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              path: /api/heartbeat
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /api/heartbeat
+              port: 3000
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3

ci/k8s/apps/umami/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+  - configmap.yaml
+  - secret.sops.yaml
+  - deployment.yaml
+  - service.yaml
+images:
+  - name: ghcr.io/umami-software/umami
+    newTag: postgresql-v2.14.0

ci/k8s/apps/umami/secret.sops.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: umami-secrets
+    namespace: com-ermnvldmr
+type: Opaque
+stringData:
+    APP_SECRET: ENC[AES256_GCM,data:aaoXs+F/lXvP0kHNZ+Uoo0HB4GnYZ9raYOgEbRwIrkSFGSoTuv/PkvSOYDppDLKxhNMDLhbgTJwEMrHGZzIewQ==,iv:W3u4QPKetqBDSZdsRte5zYeFy9SlRmPw4ORGFTGzN7A=,tag:bkVyGsKgcMGODY4Chpv+8Q==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:XbAdd3hNGS+n42XgTQF5rg7AiBkbjFGHOeuTROLgjmIMCUh7afPSheFn6v8bSaibePYJdQBrdFK+kYW9o7aFYhe8Hz1cneATNP0PoQaqlxSrcnM+DeHQzFTC+98ACkskLgk27heZFjCdRr3A4LVRdcet/+2q/8U=,iv:UwxEwPeYdPYrvi30qso4yCZ6m20geusN+P7DOjowjEw=,tag:bQB7OupyNnCjn0INB8T7sg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4SHJWSm54SHorbTZBOGtF
+            VkRrQlpHbTgxSkh3L2ljZW42emEzQlBHa0hvCmxuQ3VjR2hQNzVlZ3FVS2Q3THp4
+            SEZGa09EM1BYSlUxWEtuMGp0Tld3R3cKLS0tIEcwcUd6ZkdDdTAvMDFtSGpCZ3ls
+            TVJYdHRDMXlWVmx4WStsT2hGUUZkeEkK26wJbgH0yvKPFXR4TC2rdeBD0axAs4WU
+            rfJ8MWet6AbEAyOmiAjigNbM9bJwGlDW1UThnGQ/fFQfJW6U4T1Tgw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age15zq3cje3ttmx2fhqp9cpeght6feq2w8e5m38799stjetj8urcccs36r4rc
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVUt1UlNLTHZmV1djWEZp
+            akVLUnliV2VQY0dzSmVMdmxMRTRoL2FWZm5rCm1WWkZPK2tEWW4rNVRObktuVVdk
+            cEdNTHd6V2t6ZjVRMWhRbk5GNXpFdjgKLS0tIHZoZS9wblR1bTFkMzV4OWxLSm5B
+            QWpwUG93dTc5MGNBbjAyVnNWMlRJblEK8ZRPL4/aCSKjPUg1K+kH9IigwZX1tB1U
+            Y1P8IYiuTJ+YD/UcQyh0Pp2d8l5gQsTc1ES9388wcKBKMeKHV9FqYg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:QZOb7pmfDpEn2/kefQQ8k4WJQddlF5jKTY5EaSm1Srt33DceELA3NPJMiozAzpbIEoLR6a7oR6C7zofHHVCBmYcRd2DSHqafW3EOtOt5noiAmkGOQKEWH7aSRFJqcy5EmBcVihd81Z1CkJI6MPcBeQvY0BlVqgm2YqX2QQBolgI=,iv:TB+Rn3ffe4HzVHjk2+XaKaLG1+589AmBhPjOXXKWHto=,tag:zfKVYP1h/4sWXSVtuhQH8Q==,type:str]
+    version: 3.13.3

ci/k8s/apps/umami/secret.template.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: umami-secrets
+  namespace: com-ermnvldmr
+type: Opaque
+stringData:
+  APP_SECRET: "CHANGE_ME_IN_ENCRYPTED_SOPS_SECRET"
+  DATABASE_URL: "postgresql://umami:CHANGE_ME@postgres-service.com-ermnvldmr.svc.cluster.local:5432/umami"

ci/k8s/apps/umami/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: umami-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: umami
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000

ci/k8s/apps/www/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: www
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: www
+  template:
+    metadata:
+      labels:
+        app: www
+    spec:
+      containers:
+        - name: www
+          image: git.ermnvldmr.com/deytenit/ermnvldmr.com/www:sha-6d33b71
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2

ci/k8s/apps/www/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+- deployment.yaml
+- service.yaml
+images:
+- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/www
+  newName: git.ermnvldmr.com/deytenit/ermnvldmr.com/www
+  newTag: sha-4e0bb72

ci/k8s/apps/www/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: www-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: www
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

ci/k8s/base/namespaces/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml

ci/k8s/base/namespaces/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: com-ermnvldmr
+  labels:
+    name: com-ermnvldmr

ci/k8s/clusters/production/flux-system/gotk-sync.yaml

@@ -0,0 +1,29 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: ermnvldmr-repo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://git.ermnvldmr.com/deytenit/ermnvldmr.com.git
+  ref:
+    branch: next
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-sync
+  namespace: flux-system
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: ermnvldmr-repo
+  path: ./ci/k8s/clusters/production
+  prune: true
+  wait: true
+  timeout: 3m
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

ci/k8s/clusters/production/flux-system/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gotk-sync.yaml

ci/k8s/clusters/production/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - flux-system
+  - ../../base/namespaces
+  - ../../infrastructure/cert-manager
+  - ../../infrastructure/networking
+  - ../../apps/postgres
+  - ../../apps/umami
+  - ../../apps/www
+  - ../../apps/docs

ci/k8s/infrastructure/cert-manager/cluster-issuer.yaml

@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: admin@ermnvldmr.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: admin@ermnvldmr.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik

ci/k8s/infrastructure/cert-manager/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - install.yaml
+  - cluster-issuer.yaml

ci/k8s/infrastructure/networking/ingress-beacon.yaml

@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: beacon-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-strip-beacon@kubernetescrd
+    traefik.ingress.kubernetes.io/router.priority: "100"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - www.ermnvldmr.com
+      secretName: ermnvldmr-tls
+    - hosts:
+        - docs.ermnvldmr.com
+      secretName: docs-ermnvldmr-tls
+  rules:
+    - host: www.ermnvldmr.com
+      http:
+        paths:
+          - path: /trace
+            pathType: Prefix
+            backend:
+              service:
+                name: umami-service
+                port:
+                  number: 3000
+    - host: docs.ermnvldmr.com
+      http:
+        paths:
+          - path: /trace
+            pathType: Prefix
+            backend:
+              service:
+                name: umami-service
+                port:
+                  number: 3000

ci/k8s/infrastructure/networking/ingress.yaml

@@ -0,0 +1,80 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: www-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-sec-headers-common@kubernetescrd,com-ermnvldmr-sec-headers-www@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - www.ermnvldmr.com
+      secretName: ermnvldmr-tls
+  rules:
+    - host: www.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: www-service
+                port:
+                  number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: docs-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-sec-headers-common@kubernetescrd,com-ermnvldmr-sec-headers-docs@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - docs.ermnvldmr.com
+      secretName: docs-ermnvldmr-tls
+  rules:
+    - host: docs.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: docs-service
+                port:
+                  number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: umami-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: com-ermnvldmr-sec-headers-common@kubernetescrd,com-ermnvldmr-sec-headers-umami@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - umami.ermnvldmr.com
+      secretName: umami-ermnvldmr-tls
+  rules:
+    - host: umami.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: umami-service
+                port:
+                  number: 3000

ci/k8s/infrastructure/networking/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress.yaml
+  - middleware-strip-beacon.yaml
+  - ingress-beacon.yaml
+  - middleware-sec-headers-common.yaml
+  - middleware-sec-headers-www.yaml
+  - middleware-sec-headers-docs.yaml
+  - middleware-sec-headers-umami.yaml

ci/k8s/infrastructure/networking/middleware-sec-headers-common.yaml

@@ -0,0 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-common
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    stsSeconds: 63072000
+    stsIncludeSubdomains: true
+    stsPreload: true
+    forceSTSHeader: true
+    customFrameOptionsValue: "DENY"
+    contentTypeNosniff: true
+    browserXssFilter: false
+    referrerPolicy: "strict-origin-when-cross-origin"
+    customResponseHeaders:
+      Cross-Origin-Opener-Policy: "same-origin"
+      Permissions-Policy: "camera=(), microphone=(), geolocation=(), browsing-topics=()"

ci/k8s/infrastructure/networking/middleware-sec-headers-docs.yaml

@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-docs
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    contentSecurityPolicy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://static.ermnvldmr.com; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; require-trusted-types-for 'script'; trusted-types default; upgrade-insecure-requests;"

ci/k8s/infrastructure/networking/middleware-sec-headers-umami.yaml

@@ -0,0 +1,10 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-umami
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    contentSecurityPolicy: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests;"
+    customResponseHeaders:
+      Content-Security-Policy-Report-Only: "require-trusted-types-for 'script'; trusted-types default;"

ci/k8s/infrastructure/networking/middleware-sec-headers-www.yaml

@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sec-headers-www
+  namespace: com-ermnvldmr
+spec:
+  headers:
+    contentSecurityPolicy: "default-src 'self'; script-src 'self' 'sha256-gUpIj4OcSwECFlSp351SCYJAe1wTOCQlrKBlASuO3CY=' 'sha256-3VjVzYfJpuNMLKyrxQTIc8ACxv37paQ4Talwg1s/7N0='; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://static.ermnvldmr.com; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; require-trusted-types-for 'script'; trusted-types default; upgrade-insecure-requests;"

ci/k8s/infrastructure/networking/middleware-strip-beacon.yaml

@@ -0,0 +1,9 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-beacon
+  namespace: com-ermnvldmr
+spec:
+  stripPrefix:
+    prefixes:
+      - /trace

ci/known_hosts

@@ -0,0 +1 @@
+[git.ermnvldmr.com]:22222,[45.150.33.239]:22222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXcvf3Lds3AKfGHGh00IWR9tSRbBBqrV/CC6JBGmcrD

ci/packer/cidata/meta-data

@@ -0,0 +1,2 @@
+instance-id: debian-packer
+local-hostname: debian-k3s

ci/packer/cidata/user-data

@@ -0,0 +1,14 @@
+#cloud-config
+ssh_pwauth: true
+disable_root: false
+chpasswd:
+  list: |
+    debian:packer
+    root:packer
+  expire: false
+users:
+  - default
+  - name: debian
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    lock_passwd: false

ci/packer/debian-12-k3s.pkr.hcl

@@ -0,0 +1,76 @@
+packer {
+  required_plugins {
+    qemu = {
+      version = ">= 1.1.0"
+      source  = "github.com/hashicorp/qemu"
+    }
+  }
+}
+
+variable "debian_cloud_image_url" {
+  type    = string
+  default = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2"
+}
+
+variable "debian_cloud_image_checksum" {
+  type    = string
+  default = "file:https://cloud.debian.org/images/cloud/bookworm/latest/SHA512SUMS"
+}
+
+variable "vm_name" {
+  type    = string
+  default = "com-ermnvldmr-debian-12-k3s-amd64.qcow2"
+}
+
+variable "accelerator" {
+  type    = string
+  default = "kvm"
+}
+
+source "qemu" "debian_k3s" {
+  iso_url           = var.debian_cloud_image_url
+  iso_checksum      = var.debian_cloud_image_checksum
+  disk_image        = true
+  disk_size         = "10G"
+  format            = "qcow2"
+  output_directory  = "output-qemu"
+  shutdown_command  = "echo 'packer' | sudo -S shutdown -P now"
+  accelerator       = var.accelerator
+  cd_files          = ["ci/packer/cidata/user-data", "ci/packer/cidata/meta-data"]
+  cd_label          = "cidata"
+  ssh_username      = "debian"
+  ssh_password      = "packer"
+  ssh_timeout       = "5m"
+  vm_name           = var.vm_name
+  cpus              = 2
+  memory            = 2048
+  net_device        = "virtio-net"
+  disk_interface    = "virtio"
+  headless          = true
+
+  qemuargs = [
+    ["-m", "2048M"],
+    ["-smp", "2"]
+  ]
+}
+
+build {
+  sources = ["source.qemu.debian_k3s"]
+
+  provisioner "shell" {
+    execute_command = "echo 'packer' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
+    scripts = [
+      "ci/packer/scripts/01-base-system.sh",
+      "ci/packer/scripts/02-install-k3s.sh",
+      "ci/packer/scripts/03-cleanup.sh"
+    ]
+  }
+
+  post-processor "shell-local" {
+    inline = [
+      "echo 'Optimizing qcow2 image with 2M cluster size...'",
+      "qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c output-qemu/${var.vm_name} output-qemu/debian-12-k3s-optimized.qcow2",
+      "mv output-qemu/debian-12-k3s-optimized.qcow2 output-qemu/${var.vm_name}"
+    ]
+  }
+}

ci/packer/http/preseed.cfg

@@ -0,0 +1,54 @@
+d-i debian-installer/locale string en_US.UTF-8
+d-i keyboard-configuration/xkb-keymap select us
+
+d-i netcfg/choose_interface select auto
+d-i netcfg/get_hostname string debian-k3s
+d-i netcfg/get_domain string local
+
+d-i mirror/country string manual
+d-i mirror/http/hostname string deb.debian.org
+d-i mirror/http/directory string /debian
+d-i mirror/http/proxy string
+
+d-i passwd/root-login boolean true
+d-i passwd/root-password password packer
+d-i passwd/root-password-again password packer
+d-i passwd/make-user boolean false
+
+d-i clock-setup/utc boolean true
+d-i time/zone string UTC
+
+d-i partman-auto/method string regular
+d-i partman-auto/disk string /dev/vda
+d-i partman-auto/choose_recipe select gpt-boot-root
+d-i partman-auto/expert_recipe string                         \
+      gpt-boot-root ::                                        \
+              512 512 512 fat32                               \
+                      $primary{ }                             \
+                      $bootable{ }                            \
+                      method{ efi }                           \
+                      format{ }                               \
+              .                                               \
+              1024 10000 -1 ext4                              \
+                      $primary{ }                             \
+                      method{ format } format{ }              \
+                      use_filesystem{ } filesystem{ ext4 }    \
+                      mountpoint{ / }                         \
+              .
+d-i partman-partitioning/confirm_write_new_label boolean true
+d-i partman/choose_partition select finish
+d-i partman/confirm boolean true
+d-i partman/confirm_nooverwrite boolean true
+
+d-i apt-setup/non-free-firmware boolean true
+d-i apt-setup/non-free boolean true
+d-i apt-setup/contrib boolean true
+
+tasksel tasksel/first multiselect standard, ssh-server
+d-i pkgsel/include string sudo curl ca-certificates qemu-guest-agent cloud-init
+d-i pkgsel/upgrade select full-upgrade
+
+d-i grub-installer/only_debian boolean true
+d-i grub-installer/bootdev string default
+
+d-i finish-install/reboot_in_progress note

ci/packer/scripts/01-base-system.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+set -eu
+export DEBIAN_FRONTEND=noninteractive
+
+echo "=== Configuring Base System for Cloud Image ==="
+
+# Install essential kernel modules and utilities
+apt-get update
+apt-get install -y --no-install-recommends \
+    socat \
+    conntrack \
+    ipset \
+    iptables \
+    ufw \
+    fail2ban \
+    unattended-upgrades \
+    curl \
+    ca-certificates \
+    git \
+    isc-dhcp-client \
+    tar \
+    gzip
+
+# Ensure virtio kernel modules are loaded on boot
+cat << 'EOF' > /etc/modules-load.d/virtio.conf
+virtio
+virtio_net
+virtio_blk
+virtio_pci
+virtiofs
+EOF
+
+# Configure GRUB for Serial Console (ttyS0 / COM1) and predictable network names
+sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0"/' /etc/default/grub
+sed -i 's/^#GRUB_TERMINAL=.*/GRUB_TERMINAL="console serial"/' /etc/default/grub
+echo 'GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"' >> /etc/default/grub
+update-grub
+
+# Enable serial console getty with root auto-login for emergency console recovery
+mkdir -p /etc/systemd/system/serial-getty@ttyS0.service.d
+cat << 'EOF' > /etc/systemd/system/serial-getty@ttyS0.service.d/autologin.conf
+[Service]
+ExecStart=
+ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud 115200,38400,9600 %I $TERM
+EOF
+systemctl enable serial-getty@ttyS0.service || true
+
+# Ensure SSH server auto-generates host keys if missing before starting
+mkdir -p /etc/systemd/system/ssh.service.d
+cat << 'EOF' > /etc/systemd/system/ssh.service.d/10-generate-host-keys.conf
+[Service]
+ExecStartPre=-/usr/bin/ssh-keygen -A
+EOF
+
+# Configure ds-identify to always enable cloud-init unconditionally
+mkdir -p /etc/cloud
+cat << 'EOF' > /etc/cloud/ds-identify.cfg
+policy: enabled
+EOF
+
+# Configure cloud-init to support all standard cloud datasources (OpenStack, Ec2, NoCloud, ConfigDrive)
+cat << 'EOF' > /etc/cloud/cloud.cfg.d/99-cloud-init.cfg
+datasource_list: [ NoCloud, ConfigDrive, OpenStack, Ec2, None ]
+disable_vm_template: false
+EOF
+
+# Explicitly enable cloud-init systemd services
+systemctl enable cloud-init-local.service cloud-init.service cloud-config.service cloud-final.service || true
+
+# Ensure automatic DHCP via systemd-networkd and ifupdown
+mkdir -p /etc/systemd/network
+cat << 'EOF' > /etc/systemd/network/10-eth.network
+[Match]
+Name=eth* en*
+
+[Network]
+DHCP=yes
+EOF
+systemctl enable systemd-networkd systemd-resolved || true
+
+# Ensure DHCP on eth0 for legacy ifupdown
+mkdir -p /etc/network/interfaces.d
+cat << 'EOF' > /etc/network/interfaces.d/eth0
+auto eth0
+iface eth0 inet dhcp
+EOF
+
+# Apply kernel hardening sysctl parameters
+cat << 'EOF' > /etc/sysctl.d/99-k3s-hardening.conf
+# Network SYN Flood Protection
+net.ipv4.tcp_syncookies = 1
+# Disable ICMP redirects
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+# Disable Source Routing
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+# Anti-spoofing (Reverse Path Filtering)
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+# Required for K8s pod networking
+net.ipv4.ip_forward = 1
+# System Hardening
+kernel.kptr_restrict = 2
+fs.protected_hardlinks = 1
+fs.protected_symlinks = 1
+fs.inotify.max_user_watches = 524288
+fs.inotify.max_user_instances = 512
+EOF
+sysctl --system || true
+
+# Configure baseline UFW firewall & fail2ban
+ufw default deny incoming
+ufw default allow outgoing
+ufw default allow routed
+ufw allow 22/tcp comment 'SSH'
+ufw allow 80/tcp comment 'HTTP Traefik'
+ufw allow 443/tcp comment 'HTTPS Traefik'
+ufw allow 6443/tcp comment 'K3s API'
+ufw allow in on cni0 || true
+ufw allow in on flannel.1 || true
+ufw allow from 10.42.0.0/16 comment 'K3s Pod CIDR'
+ufw allow from 10.43.0.0/16 comment 'K3s Service CIDR'
+ufw --force enable
+systemctl enable fail2ban || true
+
+echo "=== Base System Configuration Complete ==="

ci/packer/scripts/02-install-k3s.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+set -eu
+export DEBIAN_FRONTEND=noninteractive
+
+echo "=== Installing K3s Binary (First-Boot Isolation) ==="
+
+export INSTALL_K3S_SKIP_ENABLE="true"
+export INSTALL_K3S_SKIP_START="true"
+export INSTALL_K3S_VERSION="v1.31.2+k3s1"
+
+# Download official K3s installer and install binary/systemd unit without starting
+install -m 0755 /tmp/scripts/k3s /usr/local/bin/k3s
+INSTALL_K3S_SKIP_DOWNLOAD=true sh /tmp/scripts/k3s-install.sh
+
+# Verify k3s binary is located in /usr/local/bin
+which k3s
+k3s --version
+
+# Ensure systemd service is NOT running
+systemctl stop k3s.service || true
+systemctl disable k3s.service || true
+
+# Create configuration directory and default config
+mkdir -p /etc/rancher/k3s
+cat << 'EOF' > /etc/rancher/k3s/config.yaml
+write-kubeconfig-mode: "0644"
+EOF
+chmod 644 /etc/rancher/k3s/config.yaml
+
+# Pre-stage default GitOps root sync manifest
+mkdir -p /etc/flux
+install -m 0644 /tmp/scripts/flux-install.yaml /etc/flux/install.yaml
+cat << 'EOF' > /etc/flux/cluster-sync.yaml
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: ermnvldmr-repo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://git.ermnvldmr.com/deytenit/ermnvldmr.com.git
+  ref:
+    branch: next
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-sync
+  namespace: flux-system
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: ermnvldmr-repo
+  path: ./ci/k8s/clusters/production
+  prune: true
+  wait: true
+  timeout: 3m
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+EOF
+
+# Install the cluster bootstrap script into /usr/local/bin
+cat << 'EOF' > /usr/local/bin/bootstrap-cluster.sh
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "=== [Bootstrap] Checking for Secondary Persistent Data Disk ==="
+if [ -b /dev/vdb ]; then
+  echo "Secondary disk /dev/vdb detected."
+  if ! blkid /dev/vdb >/dev/null 2>&1; then
+    echo "Formatting /dev/vdb with ext4 filesystem..."
+    mkfs.ext4 -F -L k3s-storage /dev/vdb
+  fi
+  mkdir -p /var/lib/rancher/k3s/storage
+  if ! grep -qs '/var/lib/rancher/k3s/storage' /proc/mounts; then
+    mount /dev/vdb /var/lib/rancher/k3s/storage
+    echo "LABEL=k3s-storage /var/lib/rancher/k3s/storage ext4 defaults,noatime 0 2" >> /etc/fstab
+    echo "Mounted /dev/vdb to /var/lib/rancher/k3s/storage."
+  fi
+fi
+
+echo "=== [Bootstrap] Starting K3s Service ==="
+systemctl enable --now k3s.service
+
+echo "=== [Bootstrap] Waiting for K3s API server ready ==="
+export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+until kubectl get nodes >/dev/null 2>&1; do
+  echo "Waiting for Kubernetes API..."
+  sleep 2
+done
+
+echo "=== [Bootstrap] Cluster node is online ==="
+kubectl get nodes
+
+echo "=== [Bootstrap] Setting up Kubectl access for non-root users ==="
+for home_dir in /home/*; do
+  if [ -d "$home_dir" ]; then
+    user_name=$(basename "$home_dir")
+    mkdir -p "$home_dir/.kube"
+    cp /etc/rancher/k3s/k3s.yaml "$home_dir/.kube/config"
+    chown -R "$user_name:$user_name" "$home_dir/.kube"
+    chmod 600 "$home_dir/.kube/config"
+  fi
+done
+
+echo "=== [Bootstrap] Creating flux-system namespace ==="
+kubectl create namespace flux-system --dry-run=client -o yaml | kubectl apply -f -
+
+echo "=== [Bootstrap] Injecting SOPS age decryption key ==="
+if [ -f /root/.config/sops/age/keys.txt ]; then
+  kubectl create secret generic sops-age \
+    --namespace=flux-system \
+    --from-file=age.agekey=/root/.config/sops/age/keys.txt \
+    --dry-run=client -o yaml | kubectl apply -f -
+  echo "sops-age secret created."
+else
+  echo "WARNING: /root/.config/sops/age/keys.txt not found. Inject key manually via kubectl."
+fi
+
+echo "=== [Bootstrap] Installing Flux Operator / Custom Resources ==="
+kubectl apply -f /etc/flux/install.yaml
+
+echo "=== [Bootstrap] Applying initial GitOps root sync ==="
+if [ -f /etc/flux/cluster-sync.yaml ]; then
+  kubectl apply -f /etc/flux/cluster-sync.yaml
+fi
+
+echo "=== [Bootstrap] First-Boot Bootstrap Sequence Complete ==="
+EOF
+
+chmod 755 /usr/local/bin/bootstrap-cluster.sh
+
+echo "=== K3s Pre-installation Complete ==="

ci/packer/scripts/03-cleanup.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -eu
+export DEBIAN_FRONTEND=noninteractive
+
+echo "=== Sanitizing Machine Identity & Temporary Files ==="
+
+# Lock temporary packer build user
+passwd -l debian || true
+
+# Apply SSH security hardening before final image capture
+mkdir -p /etc/ssh/sshd_config.d
+cat << 'EOF' > /etc/ssh/sshd_config.d/99-security-hardening.conf
+PasswordAuthentication no
+PermitRootLogin prohibit-password
+KbdInteractiveAuthentication no
+X11Forwarding no
+MaxAuthTries 3
+ClientAliveInterval 300
+ClientAliveCountMax 2
+EOF
+
+# Clean APT caches and logs
+apt-get autoremove -y --purge
+apt-get clean
+rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# Reset machine-id for unique DHCP lease acquisition on clone
+truncate -s 0 /etc/machine-id
+rm -f /var/lib/dbus/machine-id
+ln -sf /etc/machine-id /var/lib/dbus/machine-id
+
+# Ensure SSH host keys are generated and valid
+ssh-keygen -A
+
+# Reset DNS with reliable fallback resolvers
+rm -f /etc/cloud/cloud-init.disabled /run/systemd/generator*/cloud-init.disabled
+cat << 'EOF' > /etc/resolv.conf
+nameserver 1.1.1.1
+nameserver 8.8.8.8
+nameserver 77.88.8.8
+EOF
+cloud-init clean --logs --seed || true
+rm -rf /var/lib/cloud/*
+
+# Clean bash history
+rm -f /root/.bash_history /home/*/.bash_history
+
+# Sync filesystem
+sync
+
+echo "=== Cleanup Complete ==="

ci/scripts/await-rollout.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+set -euo pipefail
+
+SERVICE="${1:-}"
+TARGET_COMMIT="${2:-}"
+ENDPOINT="${3:-https://${SERVICE}.ermnvldmr.com/version.json}"
+
+if [ -z "$SERVICE" ] || [ -z "$TARGET_COMMIT" ]; then
+  echo "Usage: $0 <service: www|docs> <target_commit> [endpoint_url]" >&2
+  exit 1
+fi
+
+echo "========================================================"
+echo "Verifying production deployment on $ENDPOINT"
+echo "Expected commit: $TARGET_COMMIT"
+echo "========================================================"
+
+MAX_ATTEMPTS=45
+ATTEMPT=1
+CF_BLOCKED_COUNT=0
+
+while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
+  echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."
+
+  RESP_FILE=$(mktemp)
+  HTTP_CODE=$(curl -sL --max-time 10 \
+    -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" \
+    -H "Accept: application/json" \
+    -o "$RESP_FILE" \
+    -w "%{http_code}" \
+    "$ENDPOINT" || echo "000")
+
+  if [ "$HTTP_CODE" = "200" ]; then
+    LIVE_COMMIT=$(jq -r '.commit // empty' "$RESP_FILE" 2>/dev/null || true)
+    LIVE_VERSION=$(jq -r '.version // empty' "$RESP_FILE" 2>/dev/null || true)
+    echo "  Live commit: ${LIVE_COMMIT:-<none>}, Live version: ${LIVE_VERSION:-<none>}"
+
+    if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ] || [ "$LIVE_VERSION" = "$TARGET_COMMIT" ]; then
+      echo "✅ Success! Production $SERVICE has successfully rolled out $TARGET_COMMIT."
+      rm -f "$RESP_FILE"
+      exit 0
+    fi
+  elif [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "503" ]; then
+    echo "  HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP."
+    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1))
+  else
+    echo "  HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out."
+  fi
+
+  rm -f "$RESP_FILE"
+
+  if [ $CF_BLOCKED_COUNT -ge 5 ]; then
+    echo "⚠️ Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE)."
+    echo "The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster."
+    echo "Skipping further external HTTP verification to avoid false negative."
+    exit 0
+  fi
+
+  ATTEMPT=$((ATTEMPT + 1))
+  sleep 10
+done
+
+echo "❌ Deployment verification timed out after 7.5 minutes."
+exit 1

ci/scripts/build-golden-image.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mkdir -p output-qemu
+
+echo "Downloading official Debian 12 cloud image..."
+curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
+
+echo "Expanding disk image to 10G..."
+qemu-img resize base.qcow2 10G
+
+echo "Connecting disk image via NBD..."
+sudo modprobe nbd max_part=8
+sudo qemu-nbd --connect=/dev/nbd0 base.qcow2
+sleep 1
+sudo partx -u /dev/nbd0 || true
+
+echo "Mounting disk filesystem..."
+sudo mkdir -p /mnt/target
+sudo mount /dev/nbd0p1 /mnt/target
+
+echo "Mounting host virtual filesystems and configuring DNS..."
+sudo rm -f /mnt/target/etc/resolv.conf
+echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf
+echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf
+sudo mount --bind /dev /mnt/target/dev
+sudo mount --bind /dev/pts /mnt/target/dev/pts
+sudo mount --bind /proc /mnt/target/proc
+sudo mount --bind /sys /mnt/target/sys
+
+echo "Copying provisioner scripts..."
+sudo mkdir -p /mnt/target/tmp/scripts
+sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/
+sudo cp /opt/ci/assets/k3s /opt/ci/assets/k3s-install.sh /mnt/target/tmp/scripts/
+sudo cp /opt/ci/assets/flux-install-local.yaml /mnt/target/tmp/scripts/flux-install.yaml
+sudo chmod +x /mnt/target/tmp/scripts/*.sh
+
+echo "Running provisioner scripts in chroot..."
+sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh
+sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh
+sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh
+sudo rm -rf /mnt/target/tmp/scripts
+
+echo "Unmounting filesystems..."
+sudo umount /mnt/target/sys
+sudo umount /mnt/target/proc
+sudo umount /mnt/target/dev/pts
+sudo umount /mnt/target/dev
+sudo umount /mnt/target
+sudo qemu-nbd --disconnect /dev/nbd0
+
+echo "Compressing and optimizing qcow2 with 2M cluster size..."
+qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+echo "Golden image built successfully."

ci/scripts/cache.py

@@ -0,0 +1,87 @@
+import hashlib
+import json
+import os
+import platform
+import subprocess
+import sys
+import tarfile
+import tempfile
+import urllib.error
+import urllib.parse
+import urllib.request
+import zipfile
+from pathlib import Path
+
+SERVER='https://git.ermnvldmr.com'
+
+
+def eligible(run, repository, current_run):
+    if run.get('repository',{}).get('full_name')!=repository:
+        return False
+    if str(run.get('id'))==current_run:
+        return True
+    return run.get('head_branch')=='next' and run.get('event') in ('push','workflow_dispatch') and run.get('status')=='completed' and run.get('conclusion')=='success'
+
+
+def request(url):
+    if not url.startswith(SERVER+'/'):
+        raise ValueError('Unexpected cache artifact host')
+    class LocalRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, req, fp, code, msg, headers, newurl):
+            if not newurl.startswith(SERVER+'/'):
+                raise ValueError('Unexpected cache storage host')
+            return super().redirect_request(req,fp,code,msg,headers,newurl)
+    req=urllib.request.Request(url,headers={'Authorization':'token '+os.environ['CACHE_TOKEN']})
+    return urllib.request.build_opener(LocalRedirect).open(req,timeout=60)
+
+
+def api(path):
+    with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+path) as response:
+        return json.load(response)
+
+
+def main():
+    store=Path(subprocess.check_output(['pnpm','store','path','--silent'],text=True).strip())
+    archive=Path('.ci/pnpm-store.tar')
+    if sys.argv[1]=='pack':
+        archive.parent.mkdir(exist_ok=True)
+        store.mkdir(parents=True,exist_ok=True)
+        with tarfile.open(archive,'w') as target:target.add(store,arcname='.')
+        return
+    versions=subprocess.check_output(['node','--version'],text=True).strip()+'-'+subprocess.check_output(['pnpm','--version'],text=True).strip()
+    key='pnpm-'+platform.system().lower()+'-'+platform.machine()+'-'+versions+'-'+hashlib.sha256(Path('pnpm-lock.yaml').read_bytes()).hexdigest()
+    with open(os.environ['GITHUB_OUTPUT'],'a') as output:output.write('key='+key+'\n')
+    try:
+        artifacts=api('/actions/artifacts?name='+urllib.parse.quote(key))['artifacts']
+        artifacts.sort(key=lambda a:a['id'],reverse=True)
+        for artifact in artifacts:
+            if artifact.get('expired',True) or artifact.get('name')!=key:
+                continue
+            run_id=artifact.get('workflow_run',{}).get('id')
+            if not run_id:
+                continue
+            run=api('/actions/runs/'+str(run_id))
+            if not eligible(run,os.environ['GITHUB_REPOSITORY'],os.environ['GITHUB_RUN_ID']):
+                continue
+            with tempfile.TemporaryDirectory(prefix='pnpm-artifact-cache-') as directory:
+                downloaded=Path(directory)/'cache.zip'
+                with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+'/actions/artifacts/'+str(artifact['id'])+'/zip') as response,downloaded.open('wb') as target:
+                    while chunk:=response.read(1048576):target.write(chunk)
+                with zipfile.ZipFile(downloaded) as zipped:
+                    members=[name for name in zipped.namelist() if name.rsplit('/',1)[-1]=='pnpm-store.tar']
+                    if len(members)!=1:
+                        raise ValueError('Invalid cache archive')
+                    packed=Path(directory)/'store.tar'
+                    with zipped.open(members[0]) as source,packed.open('wb') as target:
+                        while chunk:=source.read(1048576):target.write(chunk)
+                store.mkdir(parents=True,exist_ok=True)
+                with tarfile.open(packed) as tar:tar.extractall(store,filter='data')
+            print('Restored repository-scoped pnpm cache artifact')
+            return
+    except (urllib.error.HTTPError,urllib.error.URLError,ValueError,tarfile.TarError,zipfile.BadZipFile):
+        print('Cache unavailable; dependencies will be fetched normally')
+        return
+    print('No eligible cache artifact; dependencies will be fetched normally')
+
+
+if __name__=='__main__':main()

ci/scripts/calver-release.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+set -euo pipefail
+
+MODE="version"
+SERVICE=""
+COMMIT="HEAD"
+EXPLICIT_VERSION=""
+
+if [ $# -ge 2 ] && [ "$1" = "tag" ]; then
+    MODE="tag"
+    SERVICE="$2"
+    COMMIT="${3:-HEAD}"
+    EXPLICIT_VERSION="${4:-}"
+elif [ $# -ge 1 ]; then
+    SERVICE="$1"
+fi
+
+YEAR_MONTH=$(date -u +'%Y.%m')
+git fetch --tags --quiet 2>/dev/null || true
+
+if [ -n "$SERVICE" ]; then
+    PREFIX="services/${SERVICE}-"
+    if [ -n "$EXPLICIT_VERSION" ]; then
+        VERSION="$EXPLICIT_VERSION"
+    else
+        PATTERN="${PREFIX}${YEAR_MONTH}.*"
+        LATEST_TAG=$(git tag -l "$PATTERN" | sort -V | tail -n1 || echo "")
+        if [ -z "$LATEST_TAG" ]; then
+            MICRO=1
+        else
+            LATEST_MICRO="${LATEST_TAG#"${PREFIX}${YEAR_MONTH}."}"
+            if [[ "$LATEST_MICRO" =~ ^[0-9]+$ ]]; then
+                MICRO=$((LATEST_MICRO + 1))
+            else
+                MICRO=1
+            fi
+        fi
+        VERSION="${YEAR_MONTH}.${MICRO}"
+    fi
+    TAG_NAME="${PREFIX}${VERSION}"
+else
+    if [ -n "$EXPLICIT_VERSION" ]; then
+        VERSION="$EXPLICIT_VERSION"
+    else
+        PATTERN="${YEAR_MONTH}.*"
+        LATEST_TAG=$(git tag -l "$PATTERN" | sort -V | tail -n1 || echo "")
+        if [ -z "$LATEST_TAG" ]; then
+            MICRO=0
+        else
+            LATEST_MICRO="${LATEST_TAG#"${YEAR_MONTH}."}"
+            if [[ "$LATEST_MICRO" =~ ^[0-9]+$ ]]; then
+                MICRO=$((LATEST_MICRO + 1))
+            else
+                MICRO=0
+            fi
+        fi
+        VERSION="${YEAR_MONTH}.${MICRO}"
+    fi
+    TAG_NAME="$VERSION"
+fi
+
+if [ "$MODE" = "tag" ]; then
+    ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+    if git rev-parse -q --verify "refs/tags/$TAG_NAME" >/dev/null; then
+        EXISTING_COMMIT=$(git rev-parse "refs/tags/$TAG_NAME")
+        if [ "$EXISTING_COMMIT" = "$(git rev-parse "$COMMIT")" ]; then
+            echo "Tag $TAG_NAME already points to $COMMIT"
+        else
+            echo "Tag $TAG_NAME exists but points to $EXISTING_COMMIT, skipping create"
+        fi
+    else
+        echo "Creating tag $TAG_NAME on $COMMIT..."
+        git tag "$TAG_NAME" "$COMMIT"
+    fi
+    echo "Pushing tag $TAG_NAME..."
+    python3 "$ROOT_DIR/ci/scripts/git_write.py" "refs/tags/$TAG_NAME"
+    echo "Successfully created and pushed tag $TAG_NAME"
+fi
+echo "$VERSION"