docs(decisions): Add ADRs for JS/TS npm and GitHub release asset profiles

.github/workflows/AGENTS.md

@@ -0,0 +1,50 @@
+# CI/Workflow Knowledge Base
+
+## OVERVIEW
+
+GitHub Actions workflows for lint, autoformat, dependency review, OSV scanning, and OpenSSF
+Scorecard. All workflows are hardened by default; the authoritative security policy lives in
+`windlasstech/.github`.
+
+## STRUCTURE
+
+```text
+.github/workflows/
+├── autofix.yml           # autoformat PRs/pushes with Prettier, golangci-lint fmt, shfmt
+├── dependency-review.yml # PR/merge-group dependency review gate
+├── lint.yml              # markdownlint, actionlint, golangci-lint
+├── osv-scanner.yml       # scheduled + PR/push vulnerability scanning
+└── scorecard.yml         # OpenSSF Scorecard on branch-protection/main/schedule events
+```
+
+## WHERE TO LOOK
+
+| Task                       | File                    | Notes                                                  |
+| -------------------------- | ----------------------- | ------------------------------------------------------ |
+| Required code-quality gate | `lint.yml`              | Runs on PR and push to `main`.                         |
+| Autoformat a PR            | `autofix.yml`           | Pushes formatter fixes via `autofix.ci`.               |
+| Dependency review          | `dependency-review.yml` | Ignores docs/markdown-only changes.                    |
+| Vulnerability scanning     | `osv-scanner.yml`       | Reusable org workflow; runs on schedule too.           |
+| Supply-chain scorecard     | `scorecard.yml`         | Reusable org workflow.                                 |
+| Local hook equivalents     | `lefthook.yml`          | Pre-commit formatters → linters; commit-msg DCO check. |
+
+## CONVENTIONS
+
+- **SHA-pinning**: every third-party action is pinned to a full SHA with a comment tag.
+- **Hardened runner**: every job starts with `step-security/harden-runner` in
+  `egress-policy: audit`.
+- **Minimal permissions**: top-level `permissions: {}` with job-level elevation only where required.
+- **Reusable org workflows**: security workflows (`dependency-review.yml`, `osv-scanner.yml`,
+  `scorecard.yml`) call `windlasstech/.github` workflows on the main branch.
+- **No secrets**: initial workflows avoid publishing credentials; see ADRs for trusted publishing
+  plans.
+- **Go formatting**: use `golangci-lint fmt`/`golangci-lint run`; there is no standalone `gofmt` CI
+  step.
+
+## ANTI-PATTERNS
+
+- Do not use floating tags for third-party actions (e.g., `@v3`). Always pin a SHA.
+- Do not add `contents: write` to a job that does not need it.
+- Do not add a workflow that bypasses `windlasstech/.github` dependency-review or OSV scanner gates.
+- Do not reference reusable workflows by mutable branch or tag; use the org’s main branch refs.
+- Do not add long-lived cloud credentials; prefer OIDC where elevation is required.

AGENTS.md

@@ -1,8 +1,8 @@
 # PROJECT KNOWLEDGE BASE
 
-- **Generated:** 12026-06-28
-- **Commit:** 7c6fcbe
-- **Branch:** setup/initial-tooling
+- **Generated:** 12026-07-07
+- **Commit:** e40a91e
+- **Branch:** docs/adr-npm-and-release-asset-profiles
 
 ## OVERVIEW
 
@@ -16,6 +16,7 @@ the Go implementation tree has not been added yet.
 ├── AGENTS.md              # this file
 ├── README.md / README.ko.md
 ├── docs/decisions/        # architecture ADRs (see docs/decisions/AGENTS.md)
+├── .github/workflows/     # CI/CD workflows (see .github/workflows/AGENTS.md)
 ├── .golangci.yml          # Go format/lint policy
 ├── lefthook.yml           # git hooks
 ├── mise.toml / mise.lock  # pinned runtimes and tools
@@ -27,8 +28,9 @@ the Go implementation tree has not been added yet.
 
 | Task                    | Location                                                   | Notes                                    |
 | ----------------------- | ---------------------------------------------------------- | ---------------------------------------- |
-| Why a decision was made | `docs/decisions/`                                          | MADR 4.0.0 ADRs, numbered `0000`–`0012`. |
+| Why a decision was made | `docs/decisions/`                                          | MADR 4.0.0 ADRs, numbered `0000`–`0053`. |
 | Bootstrap / dev setup   | `README.md`, `mise.toml`                                   | `mise install` + `pnpm install`.         |
+| CI / workflow security  | `.github/workflows/`                                       | See `.github/workflows/AGENTS.md`.       |
 | Lint/format policy      | `.golangci.yml`, `.prettierrc`, `.markdownlint-cli2.jsonc` | Go, Markdown, shell.                     |
 | Git hooks / DCO         | `lefthook.yml`                                             | Commit-msg `Signed-off-by:` check.       |
 | Dependency security     | `pnpm-workspace.yaml`                                      | Cooldown, trust policy, frozen lockfile. |

docs/decisions/0021-use-profile-specific-buildtype-uris.md

@@ -1,7 +1,7 @@
 ---
 parent: Decisions
 nav_order: 21
-status: accepted
+status: superseded by ADR-0042
 date: 12026-06-29
 decision-makers: Yunseo Kim
 ---