chore: modernise tooling

.fallowrc.jsonc

@@ -0,0 +1,25 @@
+{
+	"extends": ["npm:@block65/shared-config/lib/fallow/fallow.jsonc"],
+
+	"entry": [
+		"lib/index.ts",
+		"examples/example.ts",
+		"oxfmt.config.ts",
+		"oxlint.config.ts"
+	],
+
+	// Constructs are reached through node.children and a type guard, which
+	// fallow does not follow, so these members read as unused
+	"usedClassMembers": [
+		{
+			"extends": "Construct",
+			"members": ["synth", "contentType", "hasOperationId"]
+		}
+	],
+
+	"duplicates": {
+		// Header and Parameter synth() differ in how they emit explode and
+		// required, so sharing one body would change the output
+		"ignoredClones": ["dup:6f87acd9:2"]
+	}
+}

.git-blame-ignore-revs

@@ -0,0 +1,6 @@
+# Revisions listed here are skipped by `git blame`.
+# Enable locally with:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+
+# style: reformat with oxfmt, drop .editorconfig
+7a481d1e5f3b38916ea2f1a8e19e51ae13865c0b

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches: ["canary", "master"]
+  pull_request:
+    branches: ["canary", "master"]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    strategy:
+      matrix:
+        version: [24, 26]
+        os: [ubuntu-latest]
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.version }}
+          cache: "pnpm"
+
+      # The package scripts call just, so it is needed before install
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: just typecheck
+      - run: just lint-ci
+      - run: just fmt-check
+      - run: just test
+      - run: just dead-code

.github/workflows/deploy.yml

@@ -13,16 +13,24 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 26
           registry-url: https://registry.npmjs.org/
-          cache: 'pnpm'
+          cache: "pnpm"
 
-      - run: make
+      # The package scripts call just, so it is needed before install
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
 
-      - run: pnpm publish --access=public --no-git-checks --provenance
+      - run: pnpm install --frozen-lockfile
+
+      - run: just typecheck
+
+      # the trusted publisher grants "npm stage publish", so this uploads for
+      # review rather than going live. approve it with pnpm stage approve.
+      # provenance is attached automatically when publishing over oidc
+      - run: pnpm stage publish --access public --no-git-checks

.node-version

@@ -1 +1 @@
-20
+26