chore: modernize desktoppet (rebirth one-pass)

.github/workflows/ci.yml

@@ -5,55 +5,37 @@ on:
     branches: ["**"]
   pull_request:
 
-jobs:
-  frontend:
-    name: Frontend Checks
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup Node
-        uses: actions/setup-node@v7
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run canonical frontend verification
-        run: npm run verify:required:frontend
-
-      - name: Upload frontend QA artifacts
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: frontend-qa-artifacts
-          path: artifacts/*.*
-          if-no-files-found: ignore
+permissions:
+  contents: read
 
-  tauri-backend:
-    name: Tauri Backend + Bundle
+jobs:
+  checks:
+    name: Checks and app bundle
     runs-on: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: npm
 
+      - name: Setup pinned npm
+        run: npm install --global npm@12.2.0
+
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # rust 1.98.1
+        with:
+          toolchain: 1.98.1
+          components: rustfmt, clippy
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Run smoke tests
-        run: DESKTOP_PET_STRICT_RUST=1 npm run test:smoke
+      - name: Run checks
+        run: make check
 
-      - name: Run canonical Tauri verification
-        run: DESKTOP_PET_STRICT_RUST=1 npm run verify:required:tauri
+      - name: Build macOS app bundle
+        run: npm run tauri -- build --bundles app

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
     branches: [main]
   workflow_dispatch:
   schedule:
-    - cron: '37 8 * * 1'
+    - cron: "37 8 * * 1"
 
 permissions:
   contents: read
@@ -25,12 +25,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: ${{ matrix.language }}
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4

.github/workflows/git-hygiene.yml

@@ -12,17 +12,17 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
 
   pr-title:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
     steps:
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -37,17 +37,17 @@ jobs:
       # guard accepts <type>/<slug> and <agent>/<task-slug>, this copy accepted
       # neither, so a branch the local hook blessed failed here. One rule, one
       # place, pinned by the guard's own test suite.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - run: bash scripts/git/guard-branch.sh
 
   secrets:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/lockfile-rationale.yml

@@ -12,10 +12,10 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-      - uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46
         id: changed
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         if: contains(steps.changed.outputs.all_changed_files, 'pnpm-lock.yaml') || contains(steps.changed.outputs.all_changed_files, 'package-lock.json') || contains(steps.changed.outputs.all_changed_files, 'yarn.lock')
         with:
           script: |

.github/workflows/perf-enforced.yml

@@ -14,11 +14,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: npm
+
+      - name: Setup pinned npm
+        run: npm install --global npm@12.2.0
       - run: npm ci
       - run: npm run build
       - run: npm run perf:bundle:gate
@@ -32,11 +35,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: npm
+
+      - name: Setup pinned npm
+        run: npm install --global npm@12.2.0
       - run: npm ci
       - run: npm run perf:build:gate
 
@@ -46,59 +52,23 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - run: ASSET_MAX_BYTES=250000 bash scripts/perf/check-assets.sh
 
-  perf-memory:
-    if: ${{ vars.PERF_PROFILE == 'production' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: MEMORY_MAX_DELTA_MB=5 npm run perf:memory
-
   perf-lighthouse:
     if: ${{ vars.PERF_PROFILE == 'production' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: npm
+
+      - name: Setup pinned npm
+        run: npm install --global npm@12.2.0
       - run: npm ci
       - run: npm run build
       - run: npm run perf:lhci:prod
-
-  perf-api:
-    if: ${{ vars.PERF_PROFILE == 'production' && vars.PERF_BASE_URL != '' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7
-      - uses: grafana/setup-k6-action@v1
-      - run: k6 run tests/perf/api.k6.js --summary-export=.perf-results/api-summary.json
-        env:
-          BASE_URL: ${{ vars.PERF_BASE_URL }}
-          API_P95_MS: "250"
-          API_P99_MS: "700"
-
-  perf-db:
-    if: ${{ vars.PERF_PROFILE == 'production' && vars.PERF_DATABASE_URL != '' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7
-      - name: Install PostgreSQL client
-        run: sudo apt-get update && sudo apt-get install -y postgresql-client
-      - run: psql "${{ vars.PERF_DATABASE_URL }}" -f scripts/perf/db/check-pg-stat.sql

.github/workflows/perf-foundation.yml

@@ -11,11 +11,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: npm
+
+      - name: Setup pinned npm
+        run: npm install --global npm@12.2.0
       - run: npm ci
       - run: npm run build
       - run: npm run perf:bundle
@@ -25,11 +28,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: npm
+
+      - name: Setup pinned npm
+        run: npm install --global npm@12.2.0
       - run: npm ci
       - run: npm run perf:build
 
@@ -38,11 +44,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: npm
+
+      - name: Setup pinned npm
+        run: npm install --global npm@12.2.0
       - run: npm ci
       - run: npm run build
       - run: npm run perf:lhci
@@ -52,41 +61,5 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - run: bash scripts/perf/check-assets.sh
-
-  perf-memory:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run perf:memory
-
-  perf-api:
-    if: ${{ vars.PERF_BASE_URL != '' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7
-      - uses: grafana/setup-k6-action@v1
-      - run: k6 run tests/perf/api.k6.js --summary-export=.perf-results/api-summary.json
-        env:
-          BASE_URL: ${{ vars.PERF_BASE_URL }}
-
-  perf-db:
-    if: ${{ vars.PERF_DATABASE_URL != '' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7
-      - name: Install PostgreSQL client
-        run: sudo apt-get update && sudo apt-get install -y postgresql-client
-      - run: psql "${{ vars.PERF_DATABASE_URL }}" -f scripts/perf/db/check-pg-stat.sql