Replace the hand-rolled .githooks/ directory and core.hooksPath prepare
script with husky, matching ts-apt. The pre-push hook moves to
.husky/pre-push and still runs npm run check:deps-pin.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Replace scripts/ops/check_tsapt_pin.sh with scripts/ops/check_deps_pin.mts,
which takes dependency names as arguments and checks each one for a
local symlink, a full commit SHA pin in package.json, and a matching,
non-link package-lock.json entry.
Rename the npm script to check:deps-pin (run with ts-apt) and use it from
the pre-push hook, the CI action-deps-pinned job and AGENTS.md.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Add scripts/ops/check_tsapt_pin.sh, which fails when node_modules/ts-apt
is a symlink, package.json does not pin ts-apt to a full commit SHA, or
package-lock.json resolves ts-apt to a link or a different SHA.
Run it from a .githooks/pre-push hook (installed by the npm prepare
script via core.hooksPath) and from the CI action-deps-pinned job, and
document the rule in AGENTS.md.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Add an .actrc, runner Dockerfile, push event payload, and
scripts/dev/act_ci.sh to run ci.yml jobs locally with nektos/act.
The script refuses --bind/--reuse in .actrc, since a bound checkout
runs as root and rewrites ownership and modes in the working tree.
Document the @latest-v2 version label in the README.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
