Removed heavy & vulnerable deps

.github/actions/setup-secret/action.yaml

@@ -0,0 +1,13 @@
+name: "Setup secrets file"
+description: "Creates a secrets file and removes it in post action"
+inputs:
+  file_path:
+    description: "Path to the file to create"
+    required: true
+  file_text:
+    description: "Text content to write to the file"
+    required: true
+runs:
+  using: "node24"
+  main: "main.ts"
+  post: "post.ts"

.github/actions/setup-secret/main.ts

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+import { writeFile } from "node:fs/promises";
+
+const filePath = process.env.INPUT_FILE_PATH!;
+const fileText = process.env.INPUT_FILE_TEXT!;
+
+await writeFile(filePath, fileText);

.github/actions/setup-secret/post.ts

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+import { rm } from "node:fs/promises";
+
+const filePath = process.env.INPUT_FILE_PATH!;
+
+await rm(filePath, { force: true });

.github/actions/setup/action.yaml

@@ -30,14 +30,24 @@ runs:
       with:
         path: ".cache/shared"
         key: "${{ inputs.cache-key }}-shared-${{ runner.os }}-${{ runner.arch }}"
-    - name: "Setup .env file"
+    - name: "Prepare .env content"
+      id: "env-content"
       shell: "bash"
       env:
         GITHUB_TOKEN: "${{ inputs.github-token }}"
         ENV: "${{ inputs.env }}"
       run: |
-        printf "GITHUB_TOKEN=%s\n" "$GITHUB_TOKEN" > .env
-        printf "%s" "$ENV" | jq -er "to_entries[] | \"\(.key)=\(.value)\"" >> .env
+        {
+          echo "text<<EOF"
+          printf "GITHUB_TOKEN=%s\n" "$GITHUB_TOKEN"
+          printf "%s" "$ENV" | jq -er 'to_entries[] | "\(.key)=\(.value)"'
+          echo "EOF"
+        } >> "$GITHUB_OUTPUT"
+    - name: "Setup .env file"
+      uses: "./.github/actions/setup-secret"
+      with:
+        file_path: ".env"
+        file_text: "${{ steps.env-content.outputs.text }}"
     - name: "Setup (Docker)"
       if: "runner.os == 'Linux'"
       uses: "./.github/actions/setup-docker"

mise.toml

@@ -426,33 +426,6 @@ description = "Scan filesystem with trivy (no auto-fix available)"
 hide = true
 run = [{ task = "check:trivy-fs" }]
 
-# --- pnpm-audit ---
-[tasks."check:pnpm-audit"]
-description = "Audit pnpm dependencies for security vulnerabilities"
-hide = true
-run = "pnpm audit --audit-level low"
-run_windows = "exit 0"
-sources = ["pnpm-lock.yaml", "package.json", "pnpm-workspace.yaml"]
-
-[tasks."fix:pnpm-audit"]
-description = "Audit pnpm dependencies (no auto-fix available)"
-hide = true
-run = [{ task = "check:pnpm-audit" }]
-
-# --- renovate ---
-[tasks."check:renovate"]
-description = "Validate Renovate configuration"
-hide = true
-env = { LOG_LEVEL = "warn" }
-depends = ["setup:pnpm"]
-run = "pnpm exec renovate-config-validator --strict .github/renovate.json"
-sources = [".github/renovate.json"]
-
-[tasks."fix:renovate"]
-description = "Validate Renovate configuration (no auto-fix available)"
-hide = true
-run = [{ task = "check:renovate" }]
-
 # --- Global check/fix tasks ---
 [tasks.check]
 description = "Verify code quality"
@@ -478,8 +451,6 @@ depends = [
     "check:actionlint",
     "check:semgrep",
     "check:trivy-fs",
-    "check:pnpm-audit",
-    "check:renovate",
 ]
 
 [tasks.fix]
@@ -506,8 +477,6 @@ depends = [
     "fix:actionlint",
     "fix:semgrep",
     "fix:trivy-fs",
-    "fix:pnpm-audit",
-    "fix:renovate",
     "fix:lock",
 ]
 

package.json

@@ -9,45 +9,19 @@
     "test": "pnpm --recursive --if-present run test"
   },
   "devDependencies": {
-    "@google/gemini-cli": "catalog:",
     "@playwright/test": "catalog:",
     "@taplo/cli": "catalog:",
     "@types/node": "catalog:",
     "fd-lock": "catalog:",
-    "hono": "catalog:",
     "husky": "catalog:",
     "markdownlint-cli2": "catalog:",
     "oxfmt": "catalog:",
     "oxlint": "catalog:",
-    "renovate": "catalog:",
     "vitest": "catalog:"
   },
   "engines": {
     "node": "^22.18.0 || ^24.11.0",
     "pnpm": "^10.26.0"
   },
-  "packageManager": "pnpm@10.28.1+sha512.7d7dbbca9e99447b7c3bf7a73286afaaf6be99251eb9498baefa7d406892f67b879adb3a1d7e687fc4ccc1a388c7175fbaae567a26ab44d1067b54fcb0d6a316",
-  "pnpm": {
-    "overrides": {
-      "tar": "7.5.4",
-      "hono": "4.11.4",
-      "@hono/node-server>hono": "4.11.4",
-      "@hono/node-server": "1.19.9",
-      "diff": "8.0.3",
-      "undici": "7.18.2",
-      "lodash@>=4.0.0 <=4.17.22": ">=4.17.23"
-    },
-    "onlyBuiltDependencies": [
-      "better-sqlite3",
-      "core-js-pure",
-      "dtrace-provider",
-      "electron",
-      "esbuild",
-      "keytar",
-      "node-pty",
-      "protobufjs",
-      "re2",
-      "tree-sitter-bash"
-    ]
-  }
+  "packageManager": "pnpm@10.28.1+sha512.7d7dbbca9e99447b7c3bf7a73286afaaf6be99251eb9498baefa7d406892f67b879adb3a1d7e687fc4ccc1a388c7175fbaae567a26ab44d1067b54fcb0d6a316"
 }