ci: add security, coverage, and release automation

.github/workflows/ci.yml

@@ -113,4 +113,44 @@ jobs:
         run: npm install --legacy-peer-deps --no-fund
 
       - name: Run npm audit
-        run: npm audit --audit-level=moderate || true
+        run: npm audit --audit-level=high --omit=dev
+
+      - name: Check production dependency licenses
+        run: npx --yes license-checker@25.0.1 --production --failOn "GPL;AGPL"
+
+      - name: Write license report
+        if: always()
+        run: npx --yes license-checker@25.0.1 --production --json > license-report.json
+
+      - name: Upload license report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: license-report
+          path: license-report.json
+
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm install --legacy-peer-deps --no-fund
+
+      - name: Run tests with coverage thresholds
+        run: npm run test:coverage
+
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: "30 3 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze TypeScript
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3

.github/workflows/release.yml

@@ -0,0 +1,54 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    name: Prepare release
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+
+    steps:
+      - name: Release Please
+        id: release
+        uses: googleapis/release-please-action@v4
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  publish:
+    name: Publish package
+    needs: release
+    if: needs.release.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release.outputs.tag_name }}
+
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps --no-fund
+
+      - name: Verify package
+        run: npm run typecheck && npm run test && npm run build
+
+      - name: Publish to npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}

CONTRIBUTING.md

@@ -10,23 +10,23 @@ Be respectful and constructive. We're building a framework for the Stellar ecosy
 
 ### Prerequisites
 
-- Node.js 18+
-- npm or yarn
+- Node.js 22 or newer
+- npm 10 or newer
 - Git
 
 ### Development Setup
 
 1. **Fork and clone the repository**
 
    ```bash
-   git clone https://github.com/YOUR-USERNAME/sorokit-core.git
-   cd sorokit-core
+   git clone https://github.com/YOUR-USERNAME/core.git
+   cd core
    ```
 
 2. **Install dependencies**
 
    ```bash
-   npm install
+   npm ci
    ```
 
 3. **Verify the setup**
@@ -35,13 +35,15 @@ Be respectful and constructive. We're building a framework for the Stellar ecosy
    npm run typecheck
    npm run test
    npm run lint
+   npm run test:coverage
+   npm run build
    ```
 
 ## Development Workflow
 
 ### Before You Start
 
-- Check [existing issues](https://github.com/Just-Bamford/sorokit-core/issues) to see if the work is already in progress
+- Check [existing issues](https://github.com/Sorokit/core/issues) to see if the work is already in progress
 - For large changes, open a discussion or issue first to get feedback
 - Ensure you're working against the latest `main` branch
 
@@ -277,7 +279,7 @@ Bump the version in `package.json` for releases (maintainers handle this).
 
 ### Found a Bug?
 
-1. Check if it's already reported in [issues](https://github.com/Just-Bamford/sorokit-core/issues)
+1. Check if it's already reported in [issues](https://github.com/Sorokit/core/issues)
 2. If not, open a new issue with:
    - Clear title
    - Minimal reproduction code
@@ -286,7 +288,7 @@ Bump the version in `package.json` for releases (maintainers handle this).
 
 ### Feature Requests
 
-1. Open a discussion or issue describing the feature
+1. Open a [discussion or issue](https://github.com/Sorokit/core/issues/new/choose) describing the feature
 2. Explain the use case and why it's needed
 3. Propose an API design (or ask for suggestions)
 4. Wait for feedback before starting work
@@ -297,11 +299,11 @@ Bump the version in `package.json` for releases (maintainers handle this).
 - **Clean:** `npm run clean` — Removes `dist/`
 - **Dev:** `npm run dev` — Watch mode for development
 
-Releases are handled by maintainers and published to npm.
+Releases use [Release Please](https://github.com/googleapis/release-please). Conventional commits merged into `main` create or update a release PR. Merging that PR updates `package.json`, `CHANGELOG.md`, and the Git tag; the release workflow then verifies and publishes the tagged package to npm using the repository `NPM_TOKEN` secret.
 
 ## Asking for Help
 
-- Open a [discussion](https://github.com/Just-Bamford/sorokit-core/discussions) if you have questions
+- Open a [discussion](https://github.com/Sorokit/core/discussions) if you have questions
 - Tag maintainers in issues if you need clarification
 - Check existing docs and code before asking (good learning opportunity!)
 

release-please-config.json

@@ -0,0 +1,6 @@
+{
+  "release-type": "node",
+  "package-name": "sorokit-core",
+  "changelog-path": "CHANGELOG.md",
+  "include-component-in-tag": false
+}