Publish governance baseline to main

.github/workflows/security.yml

@@ -91,21 +91,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          node-version: "22"
-          cache: npm
-          cache-dependency-path: web/package-lock.json
+          bun-version: 1.3.11
 
       - name: Install web dependencies
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Audit web dependencies
-        run: npm audit --omit=dev
+        run: bun audit
 
       - name: Typecheck web app
-        run: npm run typecheck
+        run: bun run typecheck
 
       - name: Build web app
-        run: npm run build
+        run: bun run build

.infisical.json

@@ -0,0 +1,10 @@
+{
+  "workspaceId": "debd69c9-3bec-4c66-a91d-50dd3a2e1b5c",
+  "defaultEnvironment": "dev",
+  "gitBranchToEnvironmentMapping": {
+    "main": "prod",
+    "master": "prod",
+    "develop": "dev",
+    "staging": "staging"
+  }
+}

SECURITY.md

@@ -0,0 +1,10 @@
+# Security
+
+Report security issues privately to the repository owner.
+
+Do not open public issues for vulnerabilities, credentials, tokens, or customer data.
+
+## Secrets
+
+Secrets are managed in Infisical. Real `.env` files should not be committed or kept on development devices after migration.
+

package.json

@@ -0,0 +1,9 @@
+{
+  "name": "docpull",
+  "private": true,
+  "packageManager": "bun@1.3.11",
+  "workspaces": [
+    "mcp",
+    "web"
+  ]
+}

renovate.json

@@ -0,0 +1,3 @@
+{
+  "extends": ["github>raintree-technology/engineering-standards//configs/renovate/default.json5"]
+}