ci: sync fork hardening and workflow fixes

[seonghobae]

Summary

Sync ContextualWisdomLab/free-router main into upstream with CI, dependency, workflow security, and test hardening changes.

Linked issue

Closes #51

Scope

• frouter CLI
• site
• both

SemVer impact

• patch
• minor
• major (breaking change)

Branch flow check

• This PR targets dev from a feature/fix/chore/docs/refactor/test/ci branch.
• This PR targets main from release/* or hotfix/*.

Verification

• npm run lint
• npm run typecheck
• npm run build
• npm --prefix site run build (if site changed)

Breaking change notes (required for major)

N/A - patch-level CI and workflow hardening only.

[gemini-code-assist]

Code Review

This pull request introduces test coverage reporting using c8, adds comprehensive test suites for utilities, ping logic, and workflow security, and enables source maps in tsconfig.json. It also adds a SECURITY.md policy, updates the build pipeline with a new script to copy data files to the dist directory, and modifies the Dependabot configuration. Review feedback points out that Dependabot does not support 'bun' as a package-ecosystem value, which will cause parsing errors. Additionally, it is recommended to resolve file paths in the copy-dist-data script relative to the script's directory rather than process.cwd() to prevent failures when executed from different working directories.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Dependabot does not currently support bun as a valid package-ecosystem value. Specifying bun will cause a Dependabot configuration parsing error, preventing it from running. To update dependencies in a Bun project, you should continue using npm as the ecosystem, as it correctly parses package.json and updates the dependencies.

  - package-ecosystem: npm

[gemini-code-assist]

Resolving paths relative to process.cwd() makes the script fragile if executed from a different working directory (e.g., during monorepo builds, nested tool execution, or different CI setups). It is more robust to resolve paths relative to the script's own directory using import.meta.url and fileURLToPath from node:url.

import { copyFile, mkdir } from "node:fs/promises";
import { fileURLToPath } from "node:url";
import { dirname, join } from "node:path";

const __dirname = dirname(fileURLToPath(import.meta.url));
const rootDir = join(__dirname, "..");

const distDataFiles = ["model-rankings.json", "model-support.json"];

await mkdir(join(rootDir, "dist"), { recursive: true });
await Promise.all(
  distDataFiles.map((dataFileName) =>
    copyFile(
      join(rootDir, "data", dataFileName),
      join(rootDir, "dist", dataFileName)
    )
  )
);