Configs and mise

.editorconfig

@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{html,tmpl,py,go}]
+indent_style = tab
+indent_size = 4
+
+[*.{yml,yaml,toml,json,css,less,js,vue,rb,nix}]
+indent_style = space
+indent_size = 2
+
+[*.sh]
+indent_style = space
+indent_size = 4

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,11 +1,11 @@
 name: Bug Report
-description: Report a bug in {{PROJECT_NAME}}
+description: Report a bug in condition-gitlab-ci
 labels: ["type: bug", "needs triage"]
 body:
   - type: markdown
     attributes:
       value: |
-        Thank you for reporting a bug. For security vulnerabilities, use private reporting via {{SECURITY_ADVISORY_URL}}.
+        Thank you for reporting a bug. For security vulnerabilities, use private reporting via https://github.com/SemRels/condition-gitlab-ci/security/advisories/new.
   - type: input
     id: version
     attributes:

.github/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "github>SemRels/.github//renovate/preset"
+  ]
+}

.github/settings.yml

@@ -0,0 +1,136 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+# yaml-language-server: $schema=http://json-schema.org/draft-07/schema#
+repository:
+  name: condition-gitlab-ci
+  description: Semrel condition plugin that allows releases only inside GitLab CI
+  topics: semrel, semrel-plugin, condition, gitlab, ci
+
+  private: false
+  has_issues: true
+  has_wiki: false
+  has_downloads: false
+
+  default_branch: main
+
+  allow_merge_commit: false
+  allow_squash_merge: true
+  allow_rebase_merge: true
+
+  allow_update_branch: true
+  allow_auto_merge: true
+  delete_branch_on_merge: true
+  enable_automated_security_fixes: true
+  enable_vulnerability_alerts: true
+
+rulesets:
+  - name: prevent destruction
+    target: branch
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - "~DEFAULT_BRANCH"
+        exclude: []
+    rules:
+      - type: deletion
+      - type: non_fast_forward
+
+  - name: check verification
+    target: branch
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - "~DEFAULT_BRANCH"
+        exclude: []
+    rules:
+      - type: required_status_checks
+        parameters:
+          strict_required_status_checks_policy: true
+          required_status_checks:
+            - context: "Build, test, lint, and scan"
+              integration_id: 15368
+            - context: "Build and Release Containers"
+              integration_id: 15368
+    bypass_actors:
+      - actor_id: 1
+        actor_type: OrganizationAdmin
+        bypass_mode: always
+
+  - name: require reviewing
+    target: branch
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - "~DEFAULT_BRANCH"
+        exclude: []
+    rules:
+      - type: pull_request
+        parameters:
+          allowed_merge_methods:
+            - squash
+            - rebase
+          dismiss_stale_reviews_on_push: false
+          require_code_owner_review: false
+          require_last_push_approval: false
+          required_approving_review_count: 1
+          required_review_thread_resolution: false
+    bypass_actors:
+      - actor_id: 1
+        actor_type: OrganizationAdmin
+        bypass_mode: always
+
+labels:
+  - name: bug
+    color: "fc2929"
+    description: Something isn't working
+  - name: dependencies
+    color: "0366d6"
+    description: Pull requests that update a dependency file
+  - name: documentation
+    color: "0075ca"
+    description: Improvements or additions to documentation
+  - name: duplicate
+    color: "cfd3d7"
+    description: This issue or pull request already exists
+  - name: enhancement
+    color: "a2eeef"
+    description: New feature or request
+  - name: github_actions
+    color: "000000"
+    description: Pull requests that update GitHub Actions code
+  - name: go
+    color: "16e2e2"
+    description: Pull requests that update go code
+  - name: good first issue
+    color: "7057ff"
+    description: Good for newcomers
+  - name: help wanted
+    color: "008672"
+    description: Extra attention is needed
+  - name: implementation
+    color: "5319e7"
+    description: Implementation task
+  - name: invalid
+    color: "e4e669"
+    description: This doesn't seem right
+  - name: mvp
+    color: "fbca04"
+    description: Minimum viable plugin delivery
+  - name: plugin
+    color: "0e8a16"
+    description: Plugin-related work
+  - name: question
+    color: "d876e3"
+    description: Further information is requested
+  - name: wontfix
+    color: "ffffff"
+    description: This will not be worked on
+  - name: renovate
+    color: "1d76db"
+    description: Automated action from Renovate
+
+...

.github/workflows/auto-label.yml

@@ -1,26 +1,28 @@
-# This code has been fully generated by an AI.
+---
 # SPDX-License-Identifier: Apache-2.0
 # SPDX-FileCopyrightText: 2026 The semrel Authors
+# This code has been fully generated by an AI.
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: Automatically label pull requests
 
 on:
   pull_request_target:
-    types: [opened, reopened, synchronize, edited]
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - edited
 
 permissions:
   issues: write
   pull-requests: write
 
-concurrency:
-  group: auto-label-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
 jobs:
   label:
     runs-on: ubuntu-latest
     steps:
       - name: Apply labels based on the title and changed files
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const pullRequest = context.payload.pull_request;
@@ -56,4 +58,6 @@ jobs:
                 issue_number: pullRequest.number,
                 labels: missing,
               });
-            }
+            }
+
+...

.github/workflows/binaries.yml

@@ -0,0 +1,55 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+name: Binaries
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: write
+  packages: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  binaries:
+    name: Build and Release Binaries
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install tools with Mise
+        uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5
+
+      - name: Build release binary
+        run: task build:all
+
+      - name: Generate checksum manifest
+        run: task checksums
+
+      - name: Upload GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
+        with:
+          name: ${{ github.ref_name }}
+          files: dist/*
+          generate_release_notes: false
+
+      - name: Trigger registry sync
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          REGISTRY_SYNC_TOKEN: ${{ secrets.REGISTRY_SYNC_TOKEN }}
+          REGISTRY_SYNC_WEBHOOK: ${{ secrets.REGISTRY_SYNC_WEBHOOK }}
+          PLUGIN_TAG: ${{ github.ref_name }}
+        run: task sync:registry
+
+...

.github/workflows/ci.yml

@@ -1,14 +1,16 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The semrel Authors
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: CI
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
   pull_request:
-    branches: [main]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -17,47 +19,38 @@ jobs:
   ci:
     name: Build, test, lint, and scan
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        go: ["1.25", "1.26", "1.27"]
 
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: ${{ matrix.go == '1.27rc1' && '1.27.0-rc.1' || format('{0}.x', matrix.go) }}
-          allow-prereleases: true
-          cache: true
+      - name: Install tools with Mise
+        uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5
 
       - name: Download dependencies
         run: go mod download
 
       - name: Run golangci-lint
-        continue-on-error: ${{ matrix.go == '1.27' }}
-        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
-        with:
-          version: v2.12.2
+        run: task lint
 
       - name: Run tests
-        run: go test -v -coverprofile=coverage.txt ./...
+        run: task test
 
       - name: Show coverage summary
-        run: go tool cover -func=coverage.txt | tail -1
+        run: go tool cover -func=coverage.out | tail -1
 
       - name: Upload coverage report
-        if: matrix.go == '1.26'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-report
-          path: coverage.txt
+          path: coverage.out
           retention-days: 30
 
       - name: Build plugin binary
-        run: go build -v ./cmd/plugin
+        run: task build
+
+      - name: Run end-to-end tests
+        run: task e2e
 
       - name: Run Trivy filesystem scan
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -68,3 +61,5 @@ jobs:
           exit-code: '1'
           ignore-unfixed: true
           severity: CRITICAL,HIGH
+
+...