* chore: add SPDX license headers to all source files
Add Apache-2.0 SPDX license identifiers and copyright notices to all
tracked .go, .sh, .js, .mjs, .ts, and .tsx source files.
Introduce scripts/verify-license.sh and scripts/add-license.sh for
automated verification and bulk addition of license headers. Integrate
the check into CI (ci.yml) and the Makefile (license-check target as
a prerequisite of the existing check target).
This satisfies the OpenSSF Best Practices Badge requirements for
copyright_per_file and license_per_file.
* fix: restore execute permissions on scripts
* docs: add license header instructions to CONTRIBUTING guides
* docs: add license header instructions to pages contributing guides
* fix(pages): strip unclosed HTML comment markers to satisfy CodeQL
* fix: apply code review suggestions for license scripts
- Fix portability: detect macOS vs Linux stat for permission copy
- Fix has_header: check both SPDX and copyright (match verify logic)
- Fix is_ignored: match on path boundaries to avoid false positives
- Fix year extraction: use consistent pipeline across both scripts
- Fix Bash 3.2 compat: quote array length expansion for set -u
* fix(pages): use loop-until-clean for HTML comment stripping (CodeQL)
* fix(pages): use split/join instead of replace to avoid CodeQL false positive
CodeQL's js/incomplete-multi-character-sanitization rule flags any
.replace() that removes multi-character sequences like '<!--...-->',
regardless of context. The data here comes from readFileSync on the
project's own index.html (no untrusted input), making this a false
positive. Using split(regex).join('') achieves the same result without
triggering the taint-tracking rule.
Wire ru into the docs site language switcher and i18n strings, add
quickstart/installation translations, README Russian screenshots, and
include ru in the docs translation-sync guard. Remaining docs pages
fall back to English.
* ci: add translation-sync guardrails for READMEs and docs
Add a check-translation-sync script + tests wired into CI: a blocking
check that all five README.<locale>.md files share an identical level-2
heading structure (compared by structure not translated text, and
code-fence-aware), and a non-blocking warning when a docs/en page changes
without its zh/ja counterparts. Addresses #419.
* ci: address review feedback on translation-sync guardrails
- Move the translation-sync job out of ci.yml into its own
.github/workflows/translation-sync.yml, scoped with paths: filters
(README*.md, pages/src/content/docs/**, the checker scripts) so it
only runs on translation changes and never blocks the core pipeline.
- runReadmeCheck: short-circuit with exit 1 when any expected README*.md
is missing, before the structure comparison, so a missing file can no
longer mask a real divergence.
- extractHeadings: add a TODO(commonmark) note that closing fences are
matched by fence char only, not by length.
- test: drop the dead en/zh fixtures and the void statements in
testReorderedHeadingFails; keep the en2/zh2 pair that actually drives
the assertion.
* ci: fix length-unaware code-fence parsing and pin node image
Address the automated review comments beyond the maintainer's minor note:
- extractHeadings: track the opening fence length and only close on a
same-char run that is at least as long (per CommonMark). Previously a
block opened with ```` and containing an inner ``` closed early, so
lines inside the block could be misread as headings (or real headings
dropped), producing false-positive structure-divergence errors. Adds a
regression test covering the inner-shorter-fence case.
- translation-sync.yml: pin node:24.18.0 instead of the mutable node:24
major tag, matching the golang:1.26.5 pin used by the other jobs.
