security: complete governance hardening

.github/CODEOWNERS

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+.github/workflows/** @vitormattos
+.github/dependabot.yml @vitormattos
+governance.config.json @vitormattos
+action.yml @vitormattos
+discover/action.yml @vitormattos
+SECURITY.md @vitormattos
+docs/** @vitormattos

.github/workflows/typescript.yml

@@ -29,6 +29,23 @@ jobs:
           node-version: 24
           package-manager-cache: false
 
+      - name: Verify native TypeScript action runtime
+        shell: bash
+        run: |
+          set +e
+          output="$(node src/cli.ts 2>&1)"
+          status=$?
+          set -e
+          test "$status" -eq 2
+          grep -F "Specify exactly one of --org OWNER or --repo OWNER/REPO" <<< "$output"
+
+          set +e
+          output="$(node src/discover-repositories.ts 2>&1)"
+          status=$?
+          set -e
+          test "$status" -eq 2
+          grep -F "Usage: discover-repositories ORGANIZATION" <<< "$output"
+
       - name: Install dependencies
         run: npm install --ignore-scripts
 

action.yml

@@ -28,15 +28,6 @@ runs:
         node-version: 24
         package-manager-cache: false
 
-    - name: Install governance dependencies
-      shell: bash
-      working-directory: ${{ github.action_path }}
-      run: npm install --ignore-scripts
-
-    - name: Build governance CLI
-      shell: bash
-      working-directory: ${{ github.action_path }}
-      run: npm run build
 
     - name: Reconcile rulesets
       shell: bash
@@ -56,4 +47,4 @@ runs:
           args+=(--apply)
         fi
 
-        node dist/cli.js "${args[@]}"
+        node src/cli.ts "${args[@]}"

discover/action.yml

@@ -26,15 +26,6 @@ runs:
         node-version: 24
         package-manager-cache: false
 
-    - name: Install governance dependencies
-      shell: bash
-      working-directory: ${{ github.action_path }}/..
-      run: npm install --ignore-scripts
-
-    - name: Build governance CLI
-      shell: bash
-      working-directory: ${{ github.action_path }}/..
-      run: npm run build
 
     - name: Discover repositories
       id: discover
@@ -44,5 +35,5 @@ runs:
         ORGANIZATION: ${{ inputs.organization }}
       working-directory: ${{ github.action_path }}/..
       run: |
-        repositories="$(node dist/discover-repositories.js "$ORGANIZATION")"
+        repositories="$(node src/discover-repositories.ts "$ORGANIZATION")"
         echo "repositories=$repositories" >> "$GITHUB_OUTPUT"

src/cli-runner.ts

@@ -5,14 +5,14 @@ import {
   loadGovernanceConfig,
   resolveRepositoryRulesets,
   type GovernanceConfig,
-} from './config.js';
-import type { GovernanceClient } from './governance.js';
+} from './config.ts';
+import type { GovernanceClient } from './governance.ts';
 import {
   planOrganization,
   planRepository,
   syncOrganization,
   syncRepository,
-} from './governance.js';
+} from './governance.ts';
 
 export type CliEnvironment = {
   GITHUB_TOKEN?: string | undefined;

src/cli.ts

@@ -3,8 +3,8 @@
 // SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import { runCli } from './cli-runner.js';
-import { GitHubClient } from './github-client.js';
+import { runCli } from './cli-runner.ts';
+import { GitHubClient } from './github-client.ts';
 
 const code = await runCli(
   process.argv.slice(2),

src/config-validation.ts

@@ -5,12 +5,12 @@ import type {
   BypassActor,
   RepositoryRuleset,
   RulesetRule,
-} from './types.js';
+} from './types.ts';
 import type {
   ConditionalGovernanceConfig,
   GovernanceConfig,
   RepositoryGovernanceConfig,
-} from './config.js';
+} from './config.ts';
 
 export function validateGovernanceConfig(value: unknown): GovernanceConfig {
   const root = expectRecord(value, '$');

src/config.ts

@@ -5,12 +5,12 @@ import { readFile } from 'node:fs/promises';
 import type {
   BypassActor,
   RepositoryRuleset,
-} from './types.js';
+} from './types.ts';
 import type {
   GitHubContentProbe,
   RepositoryMetadata,
-} from './repository-classifier.js';
-import { validateGovernanceConfig } from './config-validation.js';
+} from './repository-classifier.ts';
+import { validateGovernanceConfig } from './config-validation.ts';
 
 export type RepositoryGovernanceConfig = {
   policies?: string[];

src/discover-repositories.ts

@@ -3,7 +3,7 @@
 // SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import { discoverPublicRepositories } from './repository-discovery.js';
+import { discoverPublicRepositories } from './repository-discovery.ts';
 
 const organization = process.argv[2];
 

src/github-client.ts

@@ -4,16 +4,16 @@
 import type {
   RepositoryMetadata,
   GitHubContentProbe,
-} from './repository-classifier.js';
+} from './repository-classifier.ts';
 import type {
   ExistingRepositoryRuleset,
   RepositoryRulesetClient,
-} from './ruleset-reconciler.js';
+} from './ruleset-reconciler.ts';
 import type {
   BypassActor,
   RepositoryRuleset,
   RulesetRule,
-} from './types.js';
+} from './types.ts';
 
 type FetchLike = typeof fetch;
 
@@ -34,11 +34,19 @@ type RulesetSummary = {
 export class GitHubClient
   implements GitHubContentProbe, RepositoryRulesetClient
 {
+  private readonly token: string;
+  private readonly fetchImpl: FetchLike;
+  private readonly apiUrl: string;
+
   constructor(
-    private readonly token: string,
-    private readonly fetchImpl: FetchLike = fetch,
-    private readonly apiUrl = 'https://api.github.com',
-  ) {}
+    token: string,
+    fetchImpl: FetchLike = fetch,
+    apiUrl = 'https://api.github.com',
+  ) {
+    this.token = token;
+    this.fetchImpl = fetchImpl;
+    this.apiUrl = apiUrl;
+  }
 
   async getRepository(
     owner: string,

src/governance.ts

@@ -6,12 +6,12 @@ import {
   reconcileRepositoryRulesets,
   type RepositoryRulesetClient,
   type RulesetChange,
-} from './ruleset-reconciler.js';
+} from './ruleset-reconciler.ts';
 import type {
   GitHubContentProbe,
   RepositoryMetadata,
-} from './repository-classifier.js';
-import type { RepositoryRuleset } from './types.js';
+} from './repository-classifier.ts';
+import type { RepositoryRuleset } from './types.ts';
 
 export interface GovernanceClient
   extends GitHubContentProbe,

src/ruleset-normalizer.ts

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import type { RepositoryRuleset, RulesetRule } from './types.js';
+import type { RepositoryRuleset, RulesetRule } from './types.ts';
 
 function normalizeRule(rule: RulesetRule): RulesetRule {
   if (rule.type === 'pull_request') {

src/ruleset-reconciler.ts

@@ -1,8 +1,8 @@
 // SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import type { RepositoryRuleset } from './types.js';
-import { rulesetsEqual } from './ruleset-normalizer.js';
+import type { RepositoryRuleset } from './types.ts';
+import { rulesetsEqual } from './ruleset-normalizer.ts';
 
 export type ExistingRepositoryRuleset = RepositoryRuleset & {
   id: number;

src/validate-release.ts

@@ -5,7 +5,7 @@
 
 import { execFileSync } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
-import { validateRelease } from './release-validator.js';
+import { validateRelease } from './release-validator.ts';
 
 const requestedVersion = process.argv[2];
 

tsconfig.json

@@ -12,7 +12,8 @@
     "skipLibCheck": true,
     "types": [
       "node"
-    ]
+    ],
+    "rewriteRelativeImportExtensions": true
   },
   "include": [
     "src/**/*.ts",