chore: add EditorConfig, Prettier, and ESLint across all three projects

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{json,yml,yaml}]
+indent_size = 2

.github/actions/report/.prettierignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+coverage/
+package-lock.json

.github/actions/report/.prettierrc.json

@@ -0,0 +1,7 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "tabWidth": 2
+}

.github/actions/report/README.md

@@ -13,40 +13,40 @@ configured threshold is breached.
 
 ```yaml
 permissions:
-  id-token: write   # mint OIDC token for Worker auth
-  checks: write     # post Check Run on PRs
+  id-token: write # mint OIDC token for Worker auth
+  checks: write # post Check Run on PRs
 
 steps:
   - uses: actions/checkout@v4
-  - run: npm test -- --coverage        # your tests write coverage/lcov.info
+  - run: npm test -- --coverage # your tests write coverage/lcov.info
   - uses: CoverageTracker/coverage-tracker/.github/actions/report@v0.4.0
     with:
       worker-url: https://coverage-tracker.yourdomain.com
 ```
 
 ## Inputs
 
-| Input | Required | Default | Description |
-|---|---|---|---|
-| `worker-url` | **yes** | — | Base URL of your coverage-tracker Worker. |
-| `coverage-path` | no | *(probed)* | Path to the coverage report. When unset, the documented per-language default paths are probed in a fixed order; the first hit wins. **Missing coverage is always a hard failure** (the error lists every probed path). An explicit path always wins. |
-| `coverage-tool` | no | `''` | Only relevant for Cobertura, whose branch semantics vary by producer (`gocover-cobertura`, `kcov`, `covertool`, `phpunit`, `gcovr`). Naming it silences the "trusting the data" warning. Ignored for LCOV / JaCoCo / Go. |
-| `complexity-path` | no | *(probed)* | Radon JSON, gocyclo text, or Lizard XML. When unset, probes `radon.json` → `gocyclo.txt` → `lizard-report.xml`. |
-| `duplication-path` | no | *(probed)* | jscpd JSON. When unset, probes `jscpd-report/jscpd-report.json`. The Action no longer runs jscpd — run it yourself. |
-| `min-coverage` | no | `''` | Absolute coverage floor (%). |
-| `max-coverage-drop` | no | `''` | Max allowed drop (pp) from the default-branch baseline (PR checks only). |
-| `max-complexity` | no | `''` | Max allowed average cyclomatic complexity. |
-| `max-duplication` | no | `''` | Max allowed duplication (%). |
-| `github-token` | no | `${{ github.token }}` | Token used to post the PR Check Run. |
+| Input               | Required | Default               | Description                                                                                                                                                                                                                                          |
+| ------------------- | -------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `worker-url`        | **yes**  | —                     | Base URL of your coverage-tracker Worker.                                                                                                                                                                                                            |
+| `coverage-path`     | no       | _(probed)_            | Path to the coverage report. When unset, the documented per-language default paths are probed in a fixed order; the first hit wins. **Missing coverage is always a hard failure** (the error lists every probed path). An explicit path always wins. |
+| `coverage-tool`     | no       | `''`                  | Only relevant for Cobertura, whose branch semantics vary by producer (`gocover-cobertura`, `kcov`, `covertool`, `phpunit`, `gcovr`). Naming it silences the "trusting the data" warning. Ignored for LCOV / JaCoCo / Go.                             |
+| `complexity-path`   | no       | _(probed)_            | Radon JSON, gocyclo text, or Lizard XML. When unset, probes `radon.json` → `gocyclo.txt` → `lizard-report.xml`.                                                                                                                                      |
+| `duplication-path`  | no       | _(probed)_            | jscpd JSON. When unset, probes `jscpd-report/jscpd-report.json`. The Action no longer runs jscpd — run it yourself.                                                                                                                                  |
+| `min-coverage`      | no       | `''`                  | Absolute coverage floor (%).                                                                                                                                                                                                                         |
+| `max-coverage-drop` | no       | `''`                  | Max allowed drop (pp) from the default-branch baseline (PR checks only).                                                                                                                                                                             |
+| `max-complexity`    | no       | `''`                  | Max allowed average cyclomatic complexity.                                                                                                                                                                                                           |
+| `max-duplication`   | no       | `''`                  | Max allowed duplication (%).                                                                                                                                                                                                                         |
+| `github-token`      | no       | `${{ github.token }}` | Token used to post the PR Check Run.                                                                                                                                                                                                                 |
 
 ## Coverage formats (auto-detected by content)
 
-| Signal | Format | Parsed as |
-|---|---|---|
-| First line `mode: set\|count\|atomic` | Go coverage profile | statement coverage |
-| Starts with `TN:` / `SF:` | LCOV | line + branch (if present) |
-| XML root `<coverage>` | Cobertura | line + branch (per quirks) |
-| XML root `<report>` | JaCoCo | line + branch + cyclomatic (free) |
+| Signal                                | Format              | Parsed as                         |
+| ------------------------------------- | ------------------- | --------------------------------- |
+| First line `mode: set\|count\|atomic` | Go coverage profile | statement coverage                |
+| Starts with `TN:` / `SF:`             | LCOV                | line + branch (if present)        |
+| XML root `<coverage>`                 | Cobertura           | line + branch (per quirks)        |
+| XML root `<report>`                   | JaCoCo              | line + branch + cyclomatic (free) |
 
 For per-language commands and the full default-path table, see
 [docs/generating-coverage-reports.md](../../../docs/generating-coverage-reports.md).
@@ -58,7 +58,7 @@ configured for them**:
 
 - **Coverage** is always required. If no report is found (explicit path or
   probe), the Action fails and lists every path it probed.
-- **Complexity / duplication** are skipped silently when the metric is *both*
+- **Complexity / duplication** are skipped silently when the metric is _both_
   unconfigured and absent. But if `max-complexity` / `max-duplication` is set
   and no matching report is found, the Action **fails** with an actionable
   error — a configured threshold with no data is treated as a mistake, not a

.github/actions/report/dist/index.js

@@ -24779,7 +24779,9 @@ async function runPRCheck(workerUrl, oidcToken, metrics, owner, repo, category =
         const data = await res.json();
         baselines[m.name] = data.value;
       } catch {
-        warning(`Baseline fetch for "${m.name}" returned non-JSON body (HTTP ${res.status}) \u2014 skipping baseline.`);
+        warning(
+          `Baseline fetch for "${m.name}" returned non-JSON body (HTTP ${res.status}) \u2014 skipping baseline.`
+        );
       }
     } else if (res.status !== 404) {
       warning(`Baseline fetch for "${m.name}" returned HTTP ${res.status}.`);
@@ -24811,7 +24813,13 @@ async function runPRCheck(workerUrl, oidcToken, metrics, owner, repo, category =
     }
     const failed = reasons.length > 0;
     if (failed) anyFailed = true;
-    const hasThreshold = thresholdConfigured(m.name, minCoverage, maxCoverageDrop, maxComplexity, maxDuplication);
+    const hasThreshold = thresholdConfigured(
+      m.name,
+      minCoverage,
+      maxCoverageDrop,
+      maxComplexity,
+      maxDuplication
+    );
     results.push({
       metric: m.name,
       current: m.value,
@@ -30200,7 +30208,7 @@ function parseLizard(content) {
 
 // src/complexity/detect.ts
 function detectComplexityShape(content) {
-  const trimmed = content.replace(/^/, "").trimStart();
+  const trimmed = content.replace(/^\uFEFF/, "").trimStart();
   if (trimmed.startsWith("{") || trimmed.startsWith("[")) return "radon";
   if (trimmed.startsWith("<")) return "lizard";
   return "gocyclo";

.github/actions/report/eslint.config.mjs

@@ -0,0 +1,12 @@
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import eslintConfigPrettier from 'eslint-config-prettier';
+import globals from 'globals';
+
+export default tseslint.config(
+  { ignores: ['dist/**', 'coverage/**', 'node_modules/**'] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  { languageOptions: { globals: { ...globals.node } } },
+  eslintConfigPrettier,
+);