Open-source release readiness

.changeset/README.md

@@ -0,0 +1,7 @@
+# Changesets
+
+> **Language / 语言：** [English](./README.md) | [简体中文](./README.zh-CN.md)
+
+Run `npm run changeset` for every user-visible package change. Commit the generated
+markdown file with the implementation so release versioning and changelog updates
+remain reviewable.

.changeset/README.zh-CN.md

@@ -0,0 +1,5 @@
+# Changesets
+
+> **Language / 语言：** [English](./README.md) | [简体中文](./README.zh-CN.md)
+
+每次用户可见的包变更请运行 `npm run changeset`。将生成的 markdown 文件与实现一并提交，以便 release 版本与 changelog 更新可审查。

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.github/ISSUE_TEMPLATE/bug_report.md

@@ -4,6 +4,8 @@ about: Report a problem in LeRobot Studio
 labels: bug
 ---
 
+> **Language / 语言：** [English](./bug_report.md) | [简体中文](./bug_report.zh-CN.md)
+
 ## Description
 
 ## Steps to reproduce

.github/ISSUE_TEMPLATE/bug_report.zh-CN.md

@@ -0,0 +1,22 @@
+---
+name: 缺陷报告
+about: 报告 LeRobot Studio 中的问题
+labels: bug
+---
+
+> **Language / 语言：** [English](./bug_report.md) | [简体中文](./bug_report.zh-CN.md)
+
+## 描述
+
+## 复现步骤
+
+## 预期行为
+
+## 实际行为
+
+## 环境
+
+- 操作系统：
+- 浏览器：
+- Node 版本：
+- 包 / 提交：

.github/ISSUE_TEMPLATE/feature_request.md

@@ -4,6 +4,8 @@ about: Propose an improvement to LeRobot Studio
 labels: enhancement
 ---
 
+> **Language / 语言：** [English](./feature_request.md) | [简体中文](./feature_request.zh-CN.md)
+
 ## Problem to solve
 
 Describe the user need or workflow this would improve.

.github/ISSUE_TEMPLATE/feature_request.zh-CN.md

@@ -0,0 +1,23 @@
+---
+name: 功能建议
+about: 为 LeRobot Studio 提出改进建议
+labels: enhancement
+---
+
+> **Language / 语言：** [English](./feature_request.md) | [简体中文](./feature_request.zh-CN.md)
+
+## 要解决的问题
+
+描述该改进将帮助的用户需求或工作流。
+
+## 建议方案
+
+描述你希望的行为或界面。
+
+## 已考虑的替代方案
+
+你尝试过哪些变通办法或其他方案？
+
+## 补充说明
+
+如有需要，请附上截图、数据集格式/版本细节或链接。

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,7 +3,13 @@
 ## Checklist
 
 - [ ] `npm run lint` passes
+- [ ] `npm run typecheck` passes
 - [ ] `npm run test:unit` passes
-- [ ] Relevant builds (`build:web` / `build:lib`) pass
+- [ ] Relevant builds (`build` / `build:lib`) pass
+- [ ] `npm run check:package` passes after `npm run build:lib`
 - [ ] Added a changeset when publishing API changes
-- [ ] Updated docs when behavior or public API changed
+- [ ] Updated the API report when the stable public API changed
+- [ ] Updated docs (including `.zh-CN.md` pairs) when behavior or public API changed
+- [ ] `npm run check:docs-i18n` passes
+
+> **Language / 语言：** [English](./PULL_REQUEST_TEMPLATE.md) | [简体中文](./PULL_REQUEST_TEMPLATE.zh-CN.md)

.github/PULL_REQUEST_TEMPLATE.zh-CN.md

@@ -0,0 +1,15 @@
+## 摘要
+
+## 检查清单
+
+- [ ] `npm run lint` 通过
+- [ ] `npm run typecheck` 通过
+- [ ] `npm run test:unit` 通过
+- [ ] 相关构建（`build` / `build:lib`）通过
+- [ ] 在 `npm run build:lib` 后 `npm run check:package` 通过
+- [ ] 发布 API 变更时已添加 changeset
+- [ ] 稳定公开 API 变更时已更新 API 报告
+- [ ] 行为或公开 API 变更时已更新文档（含对应 `.zh-CN.md`）
+- [ ] `npm run check:docs-i18n` 通过
+
+> **Language / 语言：** [English](./PULL_REQUEST_TEMPLATE.md) | [简体中文](./PULL_REQUEST_TEMPLATE.zh-CN.md)

.github/dependabot.yml

@@ -9,3 +9,18 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /tests/npm-consumer
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -1,21 +1,27 @@
 name: CI
 
 on:
+  workflow_call:
   push:
     branches: [main, master]
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
   quality:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -25,6 +31,8 @@ jobs:
         run: npm run fixtures:generate
       - name: Format check
         run: npm run format:check
+      - name: Check documentation i18n pairs
+        run: npm run check:docs-i18n
       - name: Lint
         run: npm run lint
       - name: Typecheck
@@ -33,41 +41,70 @@ jobs:
         run: npm run test:coverage
       - name: Build library
         run: npm run build:lib
-      - name: Verify npm consumer typecheck
-        run: npm run verify:npm-consumer
+      - name: Install Chromium for npm consumer verification
+        run: npx playwright install --with-deps chromium
+      - name: Verify publishable package and API report
+        run: npm run check:package
+      - name: Validate CycloneDX SBOM generation
+        run: npm run sbom
       - name: Build web app
         run: npm run build
+      - name: Build documentation
+        run: npm run docs:build
+      - name: Check npm and web bundle sizes
+        run: npm run check:bundle-size
 
   browser-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
       - run: npm ci
-      - run: npx playwright install --with-deps chromium
+      - name: Install browser engines
+        run: npx playwright install --with-deps chromium firefox webkit
       - name: Generate test fixtures
         run: npm run fixtures:generate
-      - run: npm run test:browser
+      - name: Chromium full browser suite
+        run: npm run test:browser
+      - name: Cross-browser compatibility smoke
+        run: npm run test:browser:smoke
+
+  npm-consumer-docker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Verify npm tarball in isolated Docker consumers
+        run: npm run test:npm-consumer:docker
 
   official-compat:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: huggingface/lerobot
-          ref: adccdea1cfbec83ed98263feb7e59f7d047c5692
+          ref: 7e241bd630a3719a56157a497ce5d08f244784f1 # v0.6.1
           path: official-lerobot
-      - uses: actions/setup-node@v4
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
           cache: npm
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
       - run: npm ci
       - name: Generate test fixtures
         run: npm run fixtures:generate

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  schedule:
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        with:
+          languages: ${{ matrix.language }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        with:
+          category: /language:${{ matrix.language }}
+          # Private repos without GitHub Advanced Security cannot upload SARIF results.
+          upload: ${{ github.event.repository.visibility == 'public' }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,28 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    # Dependency Review requires GitHub Advanced Security on private repositories.
+    if: github.event.repository.visibility == 'public'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+          comment-summary-in-pr: never

.github/workflows/docs-pages.yml

@@ -0,0 +1,57 @@
+name: Documentation Pages
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'etc/lerobot-studio.api.md'
+      - 'package.json'
+      - 'package-lock.json'
+      - '.github/workflows/docs-pages.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: npm
+      - run: npm ci
+      - name: Build documentation for project Pages
+        env:
+          DOCS_BASE: /${{ github.event.repository.name }}/
+        run: npm run docs:build
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: docs/.vitepress/dist
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    steps:
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - name: Deploy documentation
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0