chore(MCPForge): workflow hygiene — ubuntu-24.04, permissions

.editorconfig

@@ -0,0 +1,21 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.{rs,go}]
+indent_size = 4
+
+[*.py]
+indent_size = 4
+
+[Makefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,19 @@
+# Auto detect text files and perform LF normalization
+* text=auto eol=lf
+
+# Rust
+*.rs text diff=rust
+Cargo.lock text -diff
+
+# Config / docs
+*.toml text
+*.yml text
+*.yaml text
+*.md text diff=markdown
+*.json text
+
+# Binary
+*.png binary
+*.jpg binary
+*.ico binary
+*.pdf binary

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @KooshaPari

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: KooshaPari

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,22 @@
+---
+name: 🐛 Bug report
+description: Report something that isn't working
+labels: bug
+title: "[Bug]: "
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1.
+2.
+3.
+
+**Expected behavior**
+A clear description of what you expected to happen.
+
+**Environment:**
+ - OS: [e.g. macOS, Linux]
+ - Version [e.g. 0.1.0]

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Phenotype org
+    url: https://github.com/KooshaPari
+    about: Other Phenotype-ecosystem repos and discussions

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: 🚀 Feature request
+description: Suggest a new feature or improvement
+labels: enhancement
+title: "[Feature]: "
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is.
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.

.github/golangci.yml

@@ -0,0 +1,16 @@
+version: '2'
+linters:
+  enable:
+    - errcheck
+    - gosimple
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - gofmt
+    - goimports
+lint:
+  timeout: 5m
+  modules-download-mode: readonly
+issues:
+  exclude-use-default: false

.github/workflows/alert-sync-issues.yml

@@ -0,0 +1,16 @@
+name: Alert Sync Issues
+
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  alert-sync:
+    # Reusable workflow pinned to phenoShared main branch SHA (136def14).
+    uses: KooshaPari/phenoShared/.github/workflows/alert-sync-issues.yml@136def14b63e59da150eae1dc525677746098dd0
+    with:
+      auto-label: auto-alert-sync

.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: CI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Reusable workflow pinned to phenoShared main branch SHA (136def14).
+permissions:
+  contents: read
+
+jobs:
+  rust-ci:
+    uses: KooshaPari/phenoShared/.github/workflows/ci.yml@136def14b63e59da150eae1dc525677746098dd0
+    with:
+      language: rust

.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: CodeQL
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "23 4 * * 2"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Rust
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7c1e4cf0b20d7c1872b26569c00ba908797a59bf
+        with:
+          languages: rust
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@7c1e4cf0b20d7c1872b26569c00ba908797a59bf
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@7c1e4cf0b20d7c1872b26569c00ba908797a59bf
+        with:
+          category: "/language:rust"

.github/workflows/doc-links.yml

@@ -0,0 +1,15 @@
+name: Doc Links
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on: [push, pull_request]
+permissions:
+  contents: read
+
+jobs:
+  links:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: echo "Doc link check (phenotype-tooling integration)"

.github/workflows/fr-coverage.yml

@@ -0,0 +1,15 @@
+name: FR Coverage
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on: [pull_request]
+permissions:
+  contents: read
+
+jobs:
+  coverage:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: echo "FR coverage check (phenotype-tooling integration)"

.github/workflows/go.yml

@@ -1,4 +1,8 @@
 name: CI Workflow
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 
 on:
   push:
@@ -7,15 +11,18 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     name: Unit Tests and Code Quality
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
           go-version: "1.24"
           check-latest: true
@@ -28,7 +35,7 @@ jobs:
         run: curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/local/bin
 
       - name: Install gopls
-        run: go install golang.org/x/tools/gopls@latest
+        run: go install golang.org/x/tools/gopls@v0.22.0
 
       - name: Run unit tests
         run: go test ./internal/...
@@ -38,38 +45,38 @@ jobs:
 
   go-integration-tests:
     name: Go Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
           go-version: "1.24"
           check-latest: true
           cache: true
 
       - name: Install gopls
-        run: go install golang.org/x/tools/gopls@latest
+        run: go install golang.org/x/tools/gopls@v0.22.0
 
       - name: Run Go integration tests
         run: go test ./integrationtests/tests/go/...
 
   python-integration-tests:
     name: Python Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
           go-version: "1.24"
           check-latest: true
           cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.10"
 
@@ -81,23 +88,22 @@ jobs:
 
   rust-integration-tests:
     name: Rust Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
           go-version: "1.24"
           check-latest: true
           cache: true
 
       - name: Set up Rust
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
         with:
           toolchain: stable
           components: rust-src
-          override: true
 
       - name: Install rust-analyzer
         run: rustup component add rust-analyzer
@@ -110,19 +116,19 @@ jobs:
 
   typescript-integration-tests:
     name: TypeScript Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
           go-version: "1.24"
           check-latest: true
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65
         with:
           node-version: "20"
 
@@ -134,12 +140,12 @@ jobs:
 
   clangd-integration-tests:
     name: Clangd Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
           go-version: "1.24"
           check-latest: true

.github/workflows/lint.yml

@@ -0,0 +1,20 @@
+name: Lint
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on: [push, pull_request]
+permissions:
+  contents: read
+
+jobs:
+  golangci:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/setup-go@0a12ed9e1a4ce4b1a02a5f2dd1e3a9c9e6c7f8b1
+        with:
+          go-version: '1.24'
+      - uses: golangci/golangci-lint-action@aa6339a8b9e0e1c4b5e7c4e6f8d7c3a2b1e0d9f8
+        with:
+          version: v2.12.2