ci: align governance gates with local scripts and pin Node 24

.github/workflows/app-icons-gallery.yml

@@ -10,6 +10,12 @@ on:
 
 permissions: {}
 
+# Never run two deploys at once; a queued run is replaced by a newer one,
+# and an in-flight azion deploy is never cancelled mid-way.
+concurrency:
+  group: deploy-icons-gallery
+  cancel-in-progress: false
+
 jobs:
   deploy:
     name: Deploy
@@ -27,7 +33,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup pnpm

.github/workflows/app-storybook-generate-baseline.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies

.github/workflows/app-storybook.yml

@@ -9,6 +9,12 @@ on:
 
 permissions: {}
 
+# Never run two deploys at once; a queued run is replaced by a newer one,
+# and an in-flight azion deploy is never cancelled mid-way.
+concurrency:
+  group: deploy-storybook
+  cancel-in-progress: false
+
 jobs:
   deploy:
     name: Deploy
@@ -26,7 +32,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup pnpm

.github/workflows/governance.yml

@@ -2,14 +2,21 @@ name: Governance Pipeline
 
 on:
   pull_request:
-    branches: [main, dev]
+    branches: [main]
   push:
-    branches: [main, dev]
+    branches: [main]
 
 permissions:
   contents: read
   pull-requests: read
 
+# Cancel superseded runs on the same PR (a new push obsoletes the old run's
+# 8 Playwright-sharded jobs); pushes to main queue instead, so every
+# landed commit keeps its own complete status.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   changes:
     name: Detect Changes
@@ -71,15 +78,14 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Audit dependencies
-        run: pnpm audit
-        working-directory: packages/webkit
+        run: pnpm run security:audit
 
       - name: Run TruffleHog (secret detection)
         uses: trufflesecurity/trufflehog@38999f88bed87fce0861ac313cbca06267b439c7 # main
@@ -107,7 +113,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -130,20 +136,20 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Run ESLint (zero warnings policy)
-        run: pnpm eslint packages/webkit/src --ext .js,.ts,.vue --max-warnings 0
+        run: pnpm run webkit:lint
 
       - name: Run Stylelint
-        run: pnpm stylelint "packages/webkit/**/*.{css,scss,vue}"
+        run: pnpm run webkit:lint:style
 
       - name: Prettier check (fail on diff)
-        run: pnpm prettier --check "packages/webkit/**/*.{js,ts,vue,css,json,md}"
+        run: pnpm run webkit:format:check
 
   types:
     name: TypeScript & Type Coverage
@@ -159,19 +165,17 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: TypeScript check
-        run: pnpm type-check
-        working-directory: packages/webkit
+        run: pnpm run webkit:type-check
 
       - name: Type coverage (enforce 95% threshold)
-        run: npx type-coverage -p . --at-least 95 --detail
-        working-directory: packages/webkit
+        run: pnpm run webkit:type-coverage
 
   build:
     name: Build Verification
@@ -187,7 +191,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -215,7 +219,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -243,7 +247,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -279,7 +283,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -306,7 +310,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -346,7 +350,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies

.github/workflows/package-icons.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup pnpm

.github/workflows/package-theme.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup pnpm

.github/workflows/package-webkit.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 'lts/*'
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup pnpm

.nvmrc

@@ -0,0 +1 @@
+24

.stylelintrc.json

@@ -16,5 +16,13 @@
     "value-no-vendor-prefix": [true, { "severity": "warning" }],
     "selector-max-id": 0
   },
+  "overrides": [
+    {
+      "files": ["**/*.vue"],
+      "rules": {
+        "no-invalid-position-declaration": null
+      }
+    }
+  ],
   "ignoreFiles": ["**/dist/**", "**/node_modules/**", "**/coverage/**"]
 }

package.json

@@ -8,6 +8,9 @@
     "url": "https://github.com/aziontech/webkit.git"
   },
   "packageManager": "pnpm@11.9.0",
+  "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "prepare": "husky",
     "icons:gallery:build": "pnpm --filter icons-gallery run build",
@@ -31,8 +34,8 @@
     "theme:format": "pnpm --filter theme run format",
     "webkit:lint": "pnpm --filter webkit lint",
     "webkit:lint:fix": "pnpm --filter webkit lint:fix",
-    "webkit:lint:style": "pnpm --filter webkit lint:style",
-    "webkit:lint:style:fix": "pnpm --filter webkit lint:style:fix",
+    "webkit:lint:style": "stylelint \"packages/webkit/**/*.{css,scss,vue}\"",
+    "webkit:lint:style:fix": "stylelint \"packages/webkit/**/*.{css,scss,vue}\" --fix",
     "webkit:type-check": "pnpm --filter webkit type-check",
     "webkit:type-coverage": "pnpm --filter webkit type-coverage",
     "webkit:test": "pnpm --filter webkit test",
@@ -42,7 +45,7 @@
     "webkit:format": "pnpm --filter webkit format",
     "webkit:format:check": "pnpm --filter webkit format:check",
     "security:audit": "pnpm audit",
-    "governance": "pnpm run webkit:lint && pnpm run webkit:type-check && pnpm run webkit:format:check && pnpm run security:audit"
+    "governance": "pnpm run webkit:lint && pnpm run webkit:lint:style && pnpm run webkit:format:check && pnpm run webkit:type-check && pnpm run webkit:type-coverage && pnpm run security:audit"
   },
   "dependencies": {
     "@tailwindcss/typography": "^0.5.19",

packages/webkit/.prettierignore

@@ -5,3 +5,6 @@ node_modules
 *.d.ts.map
 coverage
 storybook-static
+# Generated by scripts/build-catalog.mjs — the generator is the single source of
+# formatting; reformatting it fails `catalog:check` (mirrors root .prettierignore).
+catalog.json

packages/webkit/package.json

@@ -15,10 +15,10 @@
   "scripts": {
     "clean": "rm -rf dist/",
     "pack:check": "! npm pack --dry-run 2>&1 | grep -E '\\.test\\.(ts|js)|src/test/'",
-    "format": "prettier --write src/",
-    "format:check": "prettier --check src/",
-    "lint": "eslint src --ext .js,.js,.vue --max-warnings 0",
-    "lint:fix": "eslint src --ext .js,.js,.vue --fix",
+    "format": "prettier --write \"**/*.{js,ts,vue,css,json,md}\"",
+    "format:check": "prettier --check \"**/*.{js,ts,vue,css,json,md}\"",
+    "lint": "eslint src --ext .js,.ts,.vue --max-warnings 0",
+    "lint:fix": "eslint src --ext .js,.ts,.vue --fix",
     "lint:style": "stylelint \"src/**/*.{css,scss,vue}\"",
     "lint:style:fix": "stylelint \"src/**/*.{css,scss,vue}\" --fix",
     "type-check": "vue-tsc --noEmit",