Initial Coworker app scaffold

.gitea/workflows/build.yml

@@ -0,0 +1,47 @@
+name: Build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Test
+        run: npm run test
+
+      - name: Build
+        run: npm run build
+
+      - name: Build Windows installer
+        run: |
+          docker run --rm \
+            -v "$PWD":/project \
+            -w /project \
+            electronuserland/builder:wine \
+            /bin/bash -lc "npm run package:win"
+
+      - name: Checksums
+        run: |
+          cd release
+          sha256sum Coworker-Setup-*.exe > SHA256SUMS.txt
+
+      - name: Upload installer artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: coworker-windows-installer
+          path: |
+            release/Coworker-Setup-*.exe
+            release/SHA256SUMS.txt

.gitea/workflows/dependency-check.yml

@@ -0,0 +1,22 @@
+name: Scheduled Dependency Check
+
+on:
+  schedule:
+    - cron: "29 3 * * 2"
+  workflow_dispatch:
+
+jobs:
+  dependency-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Audit
+        run: npm run audit
+
+      - name: Outdated report
+        run: npm outdated || true

.gitea/workflows/release-dry-run.yml

@@ -0,0 +1,31 @@
+name: Release Dry Run
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  release-dry-run:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate release metadata
+        run: |
+          test -f README.md
+          test -f CHANGELOG.md
+          test -f docs/release-checklist.md
+          test -f docs/release-notes.md
+          grep -q "Coworker-Setup" README.md
+          if rg "PROJECT_NAME|PROJECT_DESCRIPTION|REPOSITORY_OWNER|REPOSITORY_NAME|BUILD_COMMAND|TEST_COMMAND|LINT_COMMAND|AUDIT_COMMAND" .; then
+            echo "Unresolved template placeholder found"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Release check
+        run: npm run release:check

.gitea/workflows/release.yml

@@ -0,0 +1,72 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Validate
+        run: npm run release:check
+
+      - name: Build Windows installer
+        run: |
+          docker run --rm \
+            -v "$PWD":/project \
+            -w /project \
+            electronuserland/builder:wine \
+            /bin/bash -lc "npm run package:win"
+
+      - name: Checksums
+        run: |
+          cd release
+          sha256sum Coworker-Setup-*.exe > SHA256SUMS.txt
+
+      - name: Create Gitea release and upload assets
+        run: |
+          test -n "$GITEA_TOKEN"
+          server="${GITHUB_SERVER_URL:-https://git.wilkensxl.de}"
+          repo="${GITHUB_REPOSITORY:-Code-Inc/Coworker}"
+          tag="${GITHUB_REF_NAME:-manual}"
+          body="$(python3 - <<'PY'
+from pathlib import Path
+print(Path("docs/release-notes.md").read_text(encoding="utf-8"))
+PY
+)"
+          release_json="$(python3 - <<PY
+import json, os
+print(json.dumps({
+  "tag_name": os.environ.get("tag", "$tag"),
+  "target_commitish": "main",
+  "name": "$tag",
+  "body": """$body""",
+  "draft": False,
+  "prerelease": False
+}))
+PY
+)"
+          response="$(curl --fail-with-body -sS \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "$release_json" \
+            "$server/api/v1/repos/$repo/releases")"
+          release_id="$(printf '%s' "$response" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')"
+          for file in release/Coworker-Setup-*.exe release/SHA256SUMS.txt; do
+            name="$(basename "$file")"
+            curl --fail-with-body -sS \
+              -H "Authorization: token $GITEA_TOKEN" \
+              -F "attachment=@$file" \
+              "$server/api/v1/repos/$repo/releases/$release_id/assets?name=$name"
+          done

.gitea/workflows/repo-cleanup.yml

@@ -0,0 +1,27 @@
+name: Scheduled Repository Cleanup Check
+
+on:
+  schedule:
+    - cron: "43 3 * * 1"
+  workflow_dispatch:
+
+jobs:
+  cleanup-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Report generated files
+        run: |
+          find . -path ./.git -prune -o \( -name node_modules -o -name dist -o -name dist-electron -o -name release -o -name coverage \) -print
+
+      - name: Report large tracked files
+        run: |
+          git ls-files -z | xargs -0 du -h | awk '$1 ~ /[0-9]+M/ { print }' || true
+
+      - name: Verify ignored local outputs
+        run: |
+          grep -q "node_modules/" .gitignore
+          grep -q "release/" .gitignore
+          grep -q ".env" .gitignore

.gitea/workflows/security-scan.yml

@@ -0,0 +1,30 @@
+name: Scheduled Security Scan
+
+on:
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+jobs:
+  security-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Scan suspicious patterns
+        run: |
+          rg -n "eval\\(|new Function|innerHTML\\s*=|shell:\\s*true|LOCALHOST_BYPASS|coworker_token" apps packages docs || true
+
+      - name: Scan secret-prone files
+        run: |
+          if find . -type f \( -name ".env" -o -name "*.pem" -o -name "*.pfx" -o -name "*.p12" -o -name "*.key" \) | rg .; then
+            echo "Secret-prone file is tracked or present in workspace"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Audit
+        run: npm run audit

.gitea/workflows/template-compliance.yml

@@ -0,0 +1,35 @@
+name: Codex Template Compliance
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  compliance:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Required files
+        run: |
+          test -f AGENTS.md
+          test -f .codex/project.md
+          test -f README.md
+          test -f SECURITY.md
+          test -f CHANGELOG.md
+          test -f docs/release-checklist.md
+          test -f docs/security-review.md
+          test -f docs/agent-handoff.md
+
+      - name: Placeholder scan
+        run: |
+          if rg "PROJECT_NAME|PROJECT_DESCRIPTION|REPOSITORY_OWNER|REPOSITORY_NAME|PACKAGE_NAME|ARTIFACT_NAME|ARTIFACT_OUTPUT_DIRECTORY|AUTHOR_NAME|PROJECT_STACK|DOWNLOAD_URL|CI_URL|RELEASES_URL|BUILD_COMMAND|TEST_COMMAND|LINT_COMMAND|AUDIT_COMMAND|README_COMMAND|INSTALL_COMMAND|DEV_COMMAND|PACKAGE_MANAGER|PROJECT_VERSION|COMMIT_OR_VERSION" .; then
+            echo "Unresolved Codex kit placeholder found"
+            exit 1
+          fi
+
+      - name: Lightweight diff hygiene
+        run: git diff --check