chore(infra): port quality scaffolding — CI, lint, test, coverage, static analysis

[BillyOutlast]

Summary

Ports the port/quality-assets scaffolding from the fork to upstream. Brings in CI hardening (SHA-pinned Actions, dep-review, secret scan, hadolint, shellcheck, CodeQL, OSV-scanner), static analysis configs (Codecov, SonarCloud, fallow, editorconfig), test infrastructure (Vitest + Playwright configs with smoke spec, postgres test container), pre-commit/pre-push gates (husky + lint-staged), security tooling (decompress 4.2.1 patch for GHSA-mp2f-45pm-3cg9, check-new-vulns.cjs, security/risk-register.yaml), and reusable Rust CI composite action.

48 files, +4602/-299. No source code changes — pure infrastructure scaffolding.

Notated issues (intentionally left as-is per author request)

These will surface after merge. Flagging here so reviewers/follow-up PRs can address them without re-litigating in the diff.

1. Fork-leaked identifiers (12 occurrences)

Files referencing BillyOutlast_* / @BillyOutlast that need scrubbing or repointing at Drop-OSS/*:

• sonar-project.properties → sonar.projectKey=BillyOutlast_drop, sonar.projectName=BillyOutlast / drop
• .github/dependabot.yml:31 → reviewers: ["BillyOutlast"]
• .github/CODEOWNERS → 8 lines require review by @BillyOutlast (auth, metadata, server/, workflows, root docs). Locks all upstream maintainers out of review on the most security-sensitive paths. Drop-OSS has its own maintainers; this file needs rewriting or removal.
• scripts/codecov-pr-comment.sh:15,24 → defaults hardcoded BillyOutlast/drop
• scripts/sonarcloud-pr-comment.sh:17,25,28 → defaults BillyOutlast_drop, BillyOutlast/drop
• scripts/sonarcloud-sync.sh:18,19,26,27,263 → same; line 263 strips the BillyOutlast_drop: prefix from components
• security/risk-register.yaml → 16 entries all accepted_by: "BillyOutlast"

2. .vscode/settings.json (untracked, not in PR but in working tree)

Contains personal SonarCloud connection (connectionId: "heretek-ai", projectKey: "BillyOutlast_drop"). Not added by this PR, but worth a .gitignore entry once merged so contributors don't accidentally commit similar config.

3. server/package.json trailing newline removed

Diff drops the final \n (now ends with }}). Prettier format:check will red. Trivial fix in follow-up.

4. .husky/pre-commit fallow base hardcoded to origin/develop

Line 5: FALLOW_AUDIT_BASE=origin/develop fallow audit ... — resolves correctly only when the contributor's origin points at Drop-OSS/drop. Forks whose origin is their own clone will diff against the wrong base. .husky/pre-push already does this correctly with REMOTE_BASE fallback; line 5 should follow the same pattern.

5. .husky/pre-commit runs full Nuxt typecheck on every commit

Multi-minute on a cold cache. Will frustrate fork contributors. Could be moved to pre-push (where test:changed already lives) without losing the gate.

6. SonarCloud analysis points at a BillyOutlast-owned project

sonar-project.properties → BillyOutlast_drop. Every PR Drop-OSS makes after merge will push coverage/findings to the fork author's SonarCloud org. Misconfig — needs migration to a Drop-OSS SonarCloud org before this workflow is enabled on develop.

7. fallow CLI not vendored

Both husky hooks and fallow.toml assume fallow is on PATH. Upstream contributors and CI runners won't have it. Pre-commit hook will silently fail or be bypassed with --no-verify. Acceptable if the fallow gate is intended to be fork-only, but should be documented or removed before treating the hooks as enforcement.

8. server/.nuxtrc untracked

Contains setups.@nuxt/test-utils="4.1.0" — required for the Vitest Nuxt environment to initialize. Will land in a follow-up commit or via the first PR that touches server/.

9. server/.prettierignore drops /torrential/ ignore

Previously the Rust torrential subdir was prettier-skipped; this diff removes that line. If torrential still has non-prettier-formattable files, expect initial CI red on format:check. Otherwise the diff is correct and the ignore was stale.

10. patches/decompress@4.2.1.patch

78-line vendor patch on a tar dependency. Stable as written, but pnpm-lock bumps can silently drop the patch if patchedDependencies ordering changes. Worth a CI assertion (e.g. pnpm why decompress shows patch applied) before relying on it for security compliance.

Test plan

• CI green on first push (validate, dep-review, secrets, typecheck, lint, test, sonar, hadolint, shellcheck)
• pnpm --filter drop test exits 0 (passes --passWithNoTests even with zero test files)
• pnpm --filter drop test:e2e runs smoke spec against pnpm dev + docker postgres
• pnpm --filter drop coverage emits lcov.info under server/coverage/
• SonarCloud sync finds the migrated project (item docs: access docs for clients #6 must be resolved first)
• Pre-commit hook passes locally (fallow installed; ignores accept the scaffolding files)

Follow-up work (separate PRs, blocked by this one)

1. Scrub fork identifiers (item Setup Guide #1) and migrate SonarCloud org (item docs: access docs for clients #6)
2. Rewrite or remove .github/CODEOWNERS (item Setup Guide #1 sub-bullet)
3. Add server/.nuxtrc and fix server/package.json trailing newline
4. Move typecheck from pre-commit to pre-push (item feat: mobile menus #5)
5. Drop fallow from pre-commit or document it as fork-only (item feat: libraries #7)
6. Phase 2: real E2E suite (auth flow + game library) — stubbed in server/test/e2e/smoke.spec.ts for now
7. Phase 3: coverage push past 40% on server business-logic modules (Codecov range is currently aspirational at 60–80%)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.