ci: CI gates, typecheck scaffold, dependabot (audit bucket 2 — M2, M3)

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  # Runtime + dev npm dependencies. Security updates land regardless of schedule;
+  # version updates are batched weekly and reviewed as code.
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        dependency-type: development
+
+  # Keep GitHub Actions pins current (paired with SHA-pinning — audit L2).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,58 @@
+name: CI
+
+# Runs on every PR and on pushes to main. The build is the blocking gate.
+# typecheck and audit are informational for now (the codebase isn't strict-clean
+# and the dependency tree carries known advisories) — promote them to required
+# checks once the typing/dependency buckets land. See tsconfig.json ratchet note.
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+          cache: npm
+      - name: Install dependencies (reproducible)
+        run: npm ci
+      - name: Build (blocking)
+        run: npm run build
+
+  typecheck:
+    runs-on: ubuntu-latest
+    # Non-blocking until index.ts is typed (audit H2/M3). Surfaces the tsc error
+    # count on each PR without blocking merges.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: Type-check (informational)
+        run: npm run typecheck
+
+  audit:
+    runs-on: ubuntu-latest
+    # Non-blocking until the dependency-cleanup buckets land (drop axios, etc.).
+    # Dependabot (see .github/dependabot.yml) drives the deps down over time.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+      - name: npm audit (informational, high+)
+        run: npm audit --audit-level=high

.github/workflows/publish.yml

@@ -17,9 +17,9 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: '22.x'
       - name: Install dependencies
-        run: npm install
+        run: npm ci
       - name: Build
         id: build
         run: |

CHANGELOG.md

@@ -1,13 +1,36 @@
 # Changelog
 
-Last updated: 2026-07-20 12:15 PM CDT
+Last updated: 2026-07-20 12:31 PM CDT
 
 All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Added
+
+- **CI workflow** (`.github/workflows/ci.yml`) on every PR and push to `main`:
+  a blocking `build` gate plus informational `typecheck` and `npm audit` jobs
+  (non-blocking until the typing and dependency buckets land). (audit finding **M2**)
+- **`tsconfig.json`** and a `typecheck` npm script (`tsc --noEmit`, strict target).
+  Enforced non-blocking for now — flip to a required check once `index.ts` is typed.
+  (audit finding **M3**)
+- **`.github/dependabot.yml`** — weekly npm + github-actions update PRs, so the
+  dependency tree and action pins stop rotting. (audit finding **M2**)
+- README status-badge row (CI, latest release, license) and a `Last updated` stamp.
+
+### Changed
+
+- Release workflow (`publish.yml`) now installs with `npm ci` (was `npm install`)
+  for reproducible, lockfile-pinned builds. (audit finding **M2**)
+- Bumped the build toolchain to **Node 22** (both workflows) and **`re2` to
+  `^1.26.0`**. The old `re2@1.17.7` had no Node-20 prebuilt binary and only
+  built because a compiled binary was committed inside `node_modules`; once that
+  was untracked (finding H1), a clean `npm ci` had to compile re2 from source and
+  failed on Node 20. `re2@1.26` ships a prebuilt but requires Node ≥22. The Node
+  version affects only the build toolchain, not the browser-bundled plugin.
+
 ### Removed
 
 - **Stop tracking `node_modules/` in git.** The entire dependency tree (~20k files)

README.md

@@ -1,5 +1,11 @@
 # Logseq iCal Sync
 
+Last updated: 2026-07-20 12:31 PM CDT
+
+[![CI](https://github.com/CR0CKER/logseq-calendars-plugin/actions/workflows/ci.yml/badge.svg)](https://github.com/CR0CKER/logseq-calendars-plugin/actions/workflows/ci.yml)
+[![Latest release](https://img.shields.io/github/v/release/CR0CKER/logseq-calendars-plugin)](https://github.com/CR0CKER/logseq-calendars-plugin/releases)
+[![License: ISC](https://img.shields.io/github/license/CR0CKER/logseq-calendars-plugin)](./LICENSE.md)
+
 > **This is a community-maintained fork** of the original
 > [logseq-calendars-plugin](https://github.com/sawhney17/logseq-calendars-plugin)
 > by [Aryan Sawhney](https://github.com/sawhney17). The original plugin is a