chore: align release tooling, CI, and project standards

[sobeaa]

Summary

This pull request introduces several improvements focused on project documentation, code quality workflows, and developer tooling. Key updates include the addition of a Code of Conduct and Security Policy, enhancements to the contributing guide, separation of code quality and coverage workflows, and minor code and documentation corrections.

Documentation and Community Guidelines

• Added a comprehensive CODE-OF-CONDUCT.md based on Contributor Covenant 3.0 to define community standards and enforcement procedures.
• Introduced a SECURITY.md file outlining the process for reporting vulnerabilities and the project's security support policy.
• Updated CONTRIBUTING.md to reference the new Code of Conduct, clarify the contribution process, add a security reporting section, and refine expectations for PR focus and review. [1] [2] [3] [4]
• Improved README.md for clarity, updated usage examples to use src/bin.ts instead of src/entrypoint.ts, and reformatted for readability. [1] [2] [3] [4] [5] [6] [7]

CI/CD and Code Quality Workflows

• Split code quality and coverage into separate GitHub Actions workflows: code-quality.yml now only runs lint/build, while a new coverage.yml handles test coverage and Codecov uploads. [1] [2] [3]

Developer Tooling and Configuration

• Enabled the eslint-plugin-unicorn with recommended rules, and disabled specific unicorn rules for project compatibility. Also, updated ignored paths for ESLint.
• Added proseWrap: "always" to .prettierrc.json for improved markdown formatting.
• Updated dependencies in package.json, switched CLI entrypoint references from entrypoint.js to bin.js, and updated related scripts. [1] [2]

Codebase Corrections and Minor Refactoring

• Improved type safety and readability in output formatting and import extraction logic. [1] [2]
• Renamed a function in the markdown renderer for clarity and improved internal implementation. [1] [2]

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Test improvement

Validation

• npm run format:check
• npm run lint
• npm run typecheck
• npm run knip
• npm test
• npm run build

Checklist

• PR targets main.
• The change is linked to an issue, or an issue is not required.
• The solution is minimal and intentional.
• Tests were added or updated for behavior changes.
• Documentation was updated where relevant.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.59.0 ⏵ 8.59.1
	eslint-plugin-unicorn@​64.0.0
	knip@​6.6.3 ⏵ 6.9.0	+1		+1	+1

View full report

[Copilot]

Pull request overview

This PR updates project tooling/configuration and small internal behaviors to align with new linting and documentation expectations, while keeping the CLI’s runtime behavior consistent.

Changes:

• Switch internal “not resolved” sentinel from null to undefined in the import resolver and update tests accordingly.
• Add eslint-plugin-unicorn to ESLint config and adjust ignores (include coverage), plus dependency bumps.
• Add repository governance/security docs (SECURITY policy, Code of Conduct) and add a dedicated coverage workflow.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/resolver.test.ts	Updates expectations from null to undefined for unresolved imports.
test/output/plain.format.test.ts	Adjusts test callsite for optional format parameter.
src/domains/pipeline/resolver.ts	Returns undefined instead of null; minor refactor to candidate path set creation.
src/domains/parsers/parser-type.ts	Adds block scoping for switch cases (formatting/structure).
src/domains/parsers/extractor.ts	Adds block scoping for switch cases (formatting/structure).
src/domains/output/markdown.format.ts	Renames fence helper and rewrites longest-run computation with a loop.
src/domains/output/formatter.ts	Makes format parameter optional in the public function signature and helper.
package.json	Adds eslint-plugin-unicorn and bumps dev tooling versions.
package-lock.json	Lockfile updates corresponding to dependency changes.
eslint.config.ts	Enables unicorn recommended config, disables a couple rules, and ignores coverage.
SECURITY.md	Adds security policy and reporting instructions.
README.md	Wraps prose to match new Prettier prose settings.
CONTRIBUTING.md	Updates contributing guidance and references Code of Conduct + Security Policy.
CODE-OF-CONDUCT.md	Adds Contributor Covenant 3.0 Code of Conduct.
.prettierrc.json	Sets proseWrap: "always" for consistent markdown wrapping.
.github/workflows/coverage.yml	Adds a dedicated workflow to run tests with coverage and upload to Codecov.
.github/workflows/code-quality.yml	Removes embedded coverage upload step (coverage handled by new workflow).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.