chore(platform): update configuration

.github/workflows/conventional-commit.yml

@@ -0,0 +1,14 @@
+name: Conventional commit
+
+on:
+  pull_request:
+    branches: ["main", "master"]
+
+jobs:
+  commits:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actionplatform/ci-github/conventional-commit@v1

.github/workflows/gitflow.yml

@@ -0,0 +1,12 @@
+name: Git-flow
+
+on:
+  pull_request:
+    branches: ["main", "master", "develop"]
+
+jobs:
+  gitflow:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actionplatform/ci-github/gitflow@v1

.github/workflows/trivy.yml

@@ -0,0 +1,43 @@
+name: Trivy
+
+on:
+  pull_request:
+    branches: ["main", "master"]
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Scan
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          format: table
+          exit-code: "1"
+      - name: SARIF
+        if: ${{ !cancelled() && !github.event.repository.private }}
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          format: sarif
+          output: trivy.sarif
+          skip-setup-trivy: true
+      - name: Upload to code scanning
+        if: ${{ !cancelled() && !github.event.repository.private }}
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: trivy.sarif

AGENTS.md

@@ -0,0 +1,9 @@
+# AGENTS.md
+
+Rules an AI agent (or a new contributor) follows in this repo. Added by `action-platform install`; keep it current.
+
+[Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/): `type(scope)!: description` — `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`, `revert`. One commit per concern; stage files explicitly — never `git add .`. Enforced by git hooks (`action-platform install`) and CI.
+
+Git-flow: work on `<kind>/<code>[-slug]` started with `action-platform branch <kind> <code>`. Kinds: `feature bugfix hotfix release support chore docs refactor test ci perf`. Never commit on `main`, `master` or `develop`; `feature`/`bugfix` merge into `develop`, `release`/`hotfix` into `main` and `develop`.
+
+`platform.toml` declares the project; `action-platform release` cuts versions from `LAST_VERSION`; `action-platform gitflow` audits a branch before a pull request.

platform.toml

@@ -0,0 +1,13 @@
+[project]
+name = "dotflow"
+type = "library"
+ci = "github"
+language = "python"
+
+[source_host]
+kind = "github"
+repo = "dotflow-io/dotflow"
+
+[release]
+strategy = "semver"
+changelog = "conventional"