feat: prepare hSQLite Editor for open-source release

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,8 @@
+* text=auto eol=lf
+
+*.db binary
+*.db3 binary
+*.s3db binary
+*.sqlite binary
+*.sqlite3 binary
+*.wasm binary

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+* @helbertm
+
+/.github/ @helbertm
+/scripts/ @helbertm
+/src/core/ @helbertm
+/src/ports/ @helbertm
+/vendor/ @helbertm

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,60 @@
+name: Bug report
+description: Report a reproducible product defect
+title: "[Bug]: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include confidential database contents. Report vulnerabilities through the private security process.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened, and what did you expect?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      description: Provide the smallest reliable sequence.
+      placeholder: "1. Open ...\n2. Run ...\n3. Observe ..."
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: hSQLite Editor version
+      placeholder: 0.3.143
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Browser and operating system
+      placeholder: Safari 19 on macOS 16
+    validations:
+      required: true
+  - type: dropdown
+    id: launch
+    attributes:
+      label: Launch mode
+      options:
+        - file:// standalone artifact
+        - GitHub Pages
+        - Local loopback server
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Additional evidence
+      description: Sanitized screenshots, console output, or a synthetic database.
+  - type: checkboxes
+    id: confirmations
+    attributes:
+      label: Confirmation
+      options:
+        - label: I reproduced this on the latest release and removed confidential data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/helbertm/hSQLite-Editor/security/advisories/new
+    about: Report security vulnerabilities privately.
+  - name: Usage question or design discussion
+    url: https://github.com/helbertm/hSQLite-Editor/discussions
+    about: Ask for help or discuss broader ideas.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,32 @@
+name: Feature request
+description: Propose a scoped product improvement
+title: "[Feature]: "
+labels: ["enhancement", "triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the user need, not only a preferred implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed outcome
+      description: What should become possible or easier?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: checkboxes
+    id: constraints
+    attributes:
+      label: Project constraints
+      options:
+        - label: The proposal can preserve local-first operation and the standalone offline artifact.
+          required: true
+        - label: I considered keyboard, accessibility, and all supported locales.
+          required: true

.github/codeql/codeql-config.yml

@@ -0,0 +1,11 @@
+name: hSQLite Editor CodeQL config
+
+paths:
+  - src
+  - scripts
+
+paths-ignore:
+  - index.html
+  - dist
+  - vendor
+  - node_modules

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - ci

.github/pull_request_template.md

@@ -0,0 +1,24 @@
+## Problem
+
+<!-- What user or maintainer problem does this solve? -->
+
+## Approach
+
+<!-- Explain the implementation and important tradeoffs. -->
+
+## Verification
+
+- [ ] `npm run validate:full`
+- [ ] Changed behavior tested in a real browser
+- [ ] Standalone `file://` contract preserved
+
+## Quality impact
+
+- Accessibility:
+- Localization (`pt-BR`, `es-ES`, `en-US`):
+- Security/privacy:
+- Performance/data integrity:
+
+## Residual risk
+
+<!-- State remaining limitations or write "None known". -->

.github/workflows/browser-quality.yml

@@ -0,0 +1,49 @@
+name: Browser Quality
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: browser-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  locale-accessibility:
+    name: Browser Quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies and Chromium
+        run: |
+          npm ci
+          npx playwright install --with-deps chromium
+
+      - name: Build and run browser quality matrix
+        run: |
+          npm run build:release
+          npm run serve:artifact &
+          SERVER_PID=$!
+          trap 'kill "$SERVER_PID"' EXIT
+          for attempt in {1..30}; do
+            if curl --fail --silent http://127.0.0.1:4173/ > /dev/null; then
+              break
+            fi
+            sleep 1
+          done
+          RELEASE_VERSION="$(node -p 'require("./package.json").version')"
+          HSQLITE_BASE_URL="http://127.0.0.1:4173/dist/hSQLite-Editor-v${RELEASE_VERSION}.html" npm run validate:browser:quality

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: "17 4 * * 2"
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          languages: javascript-typescript
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1

.github/workflows/commit-convention.yml

@@ -8,12 +8,21 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
+concurrency:
+  group: commit-convention-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   conventional-commits:
+    name: Commit Convention
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
@@ -55,21 +64,19 @@ jobs:
             fi
 
             if [[ ! "$SUBJECT" =~ $CONVENTIONAL_REGEX ]]; then
-              echo "❌ Commit inválido: $COMMIT"
-              echo "   Mensagem: $SUBJECT"
+              echo "Invalid commit: $COMMIT"
+              echo "Subject: $SUBJECT"
               FAIL=1
             fi
           done <<< "$COMMITS"
 
           if [[ "$FAIL" -ne 0 ]]; then
             echo ""
-            echo "Use o padrão Conventional Commits:"
-            echo "  feat: descrição"
-            echo "  fix: descrição"
-            echo "  chore: descrição"
-            echo "Exemplo amigável:"
-            echo "  fix: Correção do texto das novidades no release de versão"
+            echo "Use Conventional Commits:"
+            echo "  feat: description"
+            echo "  fix: description"
+            echo "  chore: description"
             exit 1
           fi
 
-          echo "✅ Todas as mensagens de commit estão válidas."
+          echo "All commit messages are valid."

.github/workflows/dependency-review.yml

@@ -0,0 +1,37 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Validate locked dependencies
+        run: |
+          npm ci
+          npm run validate:dependencies
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        with:
+          fail-on-severity: high