ci: adopt org Node baseline (lint+typecheck+test+build) + secret-scan

.github/workflows/ci.yml

@@ -1,19 +1,17 @@
 name: CI
-
 on:
-  push:
-    branches: [main]
   pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+  merge_group:
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
-
 jobs:
+  secret-scan:
+    uses: agiletec-inc/.github/.github/workflows/secret-scan.yml@main
   ci:
     uses: agiletec-inc/.github/.github/workflows/node-pnpm-ci.yml@main
     with:
-      node-version: '22'
+      # Fork-in-progress (Qwen Code): keep the deliberate turbo-scoped gate.
+      # Full baseline (typecheck/audit/whole-repo lint) deferred until the
+      # dormant Layer 2 packages are removed.
       run-command: pnpm turbo run build lint test

.gitleaks.toml

@@ -0,0 +1,15 @@
+# gitleaks config for the org secret-scan reusable (gitleaks reads .gitleaks.toml
+# from the repo root automatically). Extends the default ruleset, then allowlists
+# known non-secrets inherited from the upstream Qwen Code / Gemini CLI fork.
+title = "airis-code gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Upstream Gemini/Qwen public OAuth client secret (installed-app credential, not confidential) + a sanitizer test fixture"
+paths = [
+  '''packages/gemini-cli-core/src/code_assist/oauth2\.ts''',
+  '''packages/gemini-core/src/code_assist/oauth2\.ts''',
+  '''packages/gemini-cli-core/src/telemetry/sanitize\.test\.ts''',
+]

apps/airiscode-cli/__tests__/utils.spec.ts

@@ -1,13 +1,13 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("node:os", () => ({
-  homedir: () => "/mock/home"
+  homedir: () => "/mock/home",
 }));
 
 import { loadConfig, saveConfig } from "../src/utils/config.js";
-import { saveSession, listSessions, loadSession } from "../src/utils/session.js";
+import { listSessions, loadSession, saveSession } from "../src/utils/session.js";
 
 vi.mock("node:fs/promises");
 
@@ -26,7 +26,7 @@ describe("CLI Utilities", () => {
     it("should save and merge config", async () => {
       vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify({ plannerModel: "new-model" }));
       const updated = await saveConfig({ coderModel: "coder-9b" });
-      
+
       expect(updated.plannerModel).toBe("new-model");
       expect(updated.coderModel).toBe("coder-9b");
       expect(fs.writeFile).toHaveBeenCalled();
@@ -35,7 +35,11 @@ describe("CLI Utilities", () => {
 
   describe("Session Utility", () => {
     it("should list sessions", async () => {
-      vi.mocked(fs.readdir).mockResolvedValue(["session-1.json", "session-2.json", "other.txt"] as any);
+      vi.mocked(fs.readdir).mockResolvedValue([
+        "session-1.json",
+        "session-2.json",
+        "other.txt",
+      ] as any);
       const sessions = await listSessions();
       expect(sessions).toHaveLength(2);
       expect(sessions[0]).toBe("session-2.json"); // Sorted reverse

apps/airiscode-cli/package.json

@@ -15,7 +15,7 @@
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
     "start": "node dist/index.js",
-    "lint": "eslint . --ext .ts,.tsx",
+    "lint": "biome check .",
     "format": "prettier --write .",
     "test": "vitest run"
   },

apps/airiscode-cli/src/commands/auth.ts

@@ -4,58 +4,52 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import type { CommandModule, Argv } from 'yargs';
-import {
-  handleQwenAuth,
-  runInteractiveAuth,
-  showAuthStatus,
-} from './auth/handler.js';
-import { t } from '../i18n/index.js';
+import type { Argv, CommandModule } from "yargs";
+import { t } from "../i18n/index.js";
+import { handleQwenAuth, runInteractiveAuth, showAuthStatus } from "./auth/handler.js";
 
 // Qwen OAuth subcommand removed - use coding-plan or interactive auth instead.
 
 const codePlanCommand = {
-  command: 'coding-plan',
-  describe: t('Authenticate using Alibaba Cloud Coding Plan'),
+  command: "coding-plan",
+  describe: t("Authenticate using Alibaba Cloud Coding Plan"),
   builder: (yargs: Argv) =>
     yargs
-      .option('region', {
-        alias: 'r',
-        describe: t('Region for Coding Plan (china/global)'),
-        type: 'string',
+      .option("region", {
+        alias: "r",
+        describe: t("Region for Coding Plan (china/global)"),
+        type: "string",
       })
-      .option('key', {
-        alias: 'k',
-        describe: t('API key for Coding Plan'),
-        type: 'string',
+      .option("key", {
+        alias: "k",
+        describe: t("API key for Coding Plan"),
+        type: "string",
       }),
   handler: async (argv: { region?: string; key?: string }) => {
-    const region = argv['region'] as string | undefined;
-    const key = argv['key'] as string | undefined;
+    const region = argv["region"] as string | undefined;
+    const key = argv["key"] as string | undefined;
 
     // If region and key are provided, use them directly
     if (region && key) {
-      await handleQwenAuth('coding-plan', { region, key });
+      await handleQwenAuth("coding-plan", { region, key });
     } else {
       // Otherwise, prompt interactively
-      await handleQwenAuth('coding-plan', {});
+      await handleQwenAuth("coding-plan", {});
     }
   },
 };
 
 const statusCommand = {
-  command: 'status',
-  describe: t('Show current authentication status'),
+  command: "status",
+  describe: t("Show current authentication status"),
   handler: async () => {
     await showAuthStatus();
   },
 };
 
 export const authCommand: CommandModule = {
-  command: 'auth',
-  describe: t(
-    'Configure authentication information with Alibaba Cloud Coding Plan',
-  ),
+  command: "auth",
+  describe: t("Configure authentication information with Alibaba Cloud Coding Plan"),
   builder: (yargs: Argv) =>
     yargs
       .command(codePlanCommand)