@forgespace/branding-mcp 0.6.2 → 0.7.0

package/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @LucasSantana-Dev

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Forge Space Discussions
+    url: https://github.com/orgs/Forge-Space/discussions
+    about: Ask questions and share ideas
+  - name: Security Policy
+    url: https://github.com/Forge-Space/.github/security/policy
+    about: Report security vulnerabilities

package/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,22 @@
+---
+name: Feature Request
+about: Suggest a new feature or improvement
+title: '[FEATURE] '
+labels: ['enhancement', 'needs-triage']
+---
+
+## Problem
+
+<!-- What problem does this solve? -->
+
+## Proposed Solution
+
+<!-- How should it work? -->
+
+## Alternatives Considered
+
+<!-- Other approaches you thought of -->
+
+## Additional Context
+
+<!-- Screenshots, examples, references -->

package/.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+    groups:
+      forge-ecosystem:
+        patterns: ['@forgespace/*']
+      minor-and-patch:
+        update-types: ['minor', 'patch']
+    open-pull-requests-limit: 10
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'

package/.github/workflows/ci.yml

@@ -15,12 +15,7 @@ jobs:
     name: Lint & Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
+      - uses: Forge-Space/.github/.github/actions/setup-node@main
       - run: npm run lint:check
       - run: npm run format:check
 
@@ -28,12 +23,7 @@ jobs:
     name: Type Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
+      - uses: Forge-Space/.github/.github/actions/setup-node@main
       - run: npm run typecheck
 
   test:
@@ -43,12 +33,9 @@ jobs:
       matrix:
         node-version: [22, 24]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: Forge-Space/.github/.github/actions/setup-node@main
         with:
           node-version: ${{ matrix.node-version }}
-          cache: npm
-      - run: npm ci
       - run: npm run test:coverage
       - name: Upload coverage
         if: matrix.node-version == 22
@@ -62,12 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint, typecheck, test]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
+      - uses: Forge-Space/.github/.github/actions/setup-node@main
       - run: npm run build
       - name: Verify dist output
         run: test -f dist/index.js

package/.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 2 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          queries: +security-and-quality
+
+      - name: Build project
+        run: npm run build
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:javascript-typescript'

package/.github/workflows/release-automation.yml

@@ -14,8 +14,8 @@ jobs:
     name: Validate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
@@ -43,8 +43,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm

package/.github/workflows/secret-scan.yml

@@ -0,0 +1,13 @@
+name: Secret Scanning
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+    branches: [main]
+
+jobs:
+  secrets:
+    uses: Forge-Space/.github/.github/workflows/reusable-secret-scan.yml@main
+    permissions:
+      contents: read

package/.github/workflows/security-scan.yml

@@ -13,8 +13,8 @@ jobs:
     name: Dependency Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
@@ -29,9 +29,9 @@ jobs:
     name: Secret Scanning
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: trufflesecurity/trufflehog@v3.93.4
+      - uses: trufflesecurity/trufflehog@v3.93.7
         with:
           extra_args: --only-verified

package/.github/workflows/semgrep.yml

@@ -0,0 +1,12 @@
+name: Semgrep CE
+
+on:
+  pull_request: {}
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/semgrep.yml
+
+jobs:
+  semgrep:
+    uses: Forge-Space/.github/.github/workflows/reusable-semgrep.yml@main

package/.github/workflows/trivy.yml

@@ -0,0 +1,17 @@
+name: Trivy Security Scan
+
+on:
+  pull_request: {}
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: Forge-Space/.github/.github/workflows/reusable-trivy.yml@main
+    permissions:
+      contents: read
+      security-events: write

package/.husky/commit-msg

@@ -0,0 +1 @@
+npx --no -- commitlint --edit "$1"

package/.nvmrc

@@ -0,0 +1 @@
+22

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [Unreleased]
+
+## [0.7.0] - 2026-03-07
+
+### Added
+
+- **Import cycle detection** — `madge --circular` via `npm run check:cycles`
+- **Dead code detection** — knip config with library export exclusions
+- **Security scanning** — Semgrep CE and Trivy integration in CI
+- **Issue templates** — Bug report and feature request templates
+- **Service catalog** — catalog-info.yaml for IDP service discovery
+- **Ecosystem health** — Dependabot config, .nvmrc, CODEOWNERS
+
+### Changed
+
+- **CI workflows** — Migrated to org-wide reusable workflows for security scans and Node.js setup
+- **Dependency updates** — Bumped lint-staged (15.5.2→16.3.2), actions/setup-node (4→6), actions/checkout (4→6), trufflesecurity/trufflehog (3.93.3→3.93.7), and minor/patch group updates
+
+### Removed
+
+- Unused dependencies: `culori`, `pdfkit`, `satori`, `sharp`, `@types/pdfkit`
+
 ## [0.6.2] - 2026-03-07
 
 ### Fixed

package/catalog-info.yaml

@@ -0,0 +1,16 @@
+apiVersion: backstage.io/v1alpha1
+kind: Service
+metadata:
+  name: branding-mcp
+  description: MCP server for brand-aware design generation and WCAG validation
+  tags:
+    - typescript
+    - mcp
+    - design
+    - npm
+spec:
+  owner: forge-space
+  system: siza
+  lifecycle: production
+  dependsOn:
+    - brand-guide

package/commitlint.config.cjs

@@ -0,0 +1,24 @@
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'type-enum': [
+      2,
+      'always',
+      [
+        'feat',
+        'fix',
+        'docs',
+        'style',
+        'refactor',
+        'perf',
+        'test',
+        'chore',
+        'ci',
+        'build',
+        'revert',
+      ],
+    ],
+    'header-max-length': [2, 'always', 100],
+    'subject-case': [0],
+  },
+};

package/knip.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://unpkg.com/knip@5/schema.json",
+  "ignoreDependencies": ["lint-staged"],
+  "ignore": [
+    "src/lib/branding-core/documents/html-generator.ts",
+    "src/lib/branding-core/documents/pdf-generator.ts"
+  ],
+  "ignoreExportsUsedInFile": true,
+  "exclude": ["exports", "types"]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgespace/branding-mcp",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "MCP server for AI-powered brand identity generation — color palettes, typography systems, design tokens, and brand guidelines with multi-format export",
   "type": "module",
   "main": "dist/index.js",
@@ -24,6 +24,8 @@
     "test:coverage": "NODE_OPTIONS=--experimental-vm-modules jest --coverage",
     "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch",
     "typecheck": "tsc --noEmit",
+    "check:cycles": "madge --circular --extensions ts src/",
+    "knip": "knip",
     "pre-commit": "npm run lint && npm run format && npm run test",
     "prepare": "husky"
   },
@@ -49,22 +51,21 @@
   "homepage": "https://github.com/Forge-Space/branding-mcp#readme",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "culori": "^4.0.1",
-    "pdfkit": "^0.16.0",
     "pino": "^10.3.1",
-    "satori": "^0.12.1",
-    "sharp": "^0.34.5",
     "zod": "^3.24.0"
   },
   "devDependencies": {
+    "@commitlint/cli": "^20.4.3",
+    "@commitlint/config-conventional": "^20.4.3",
     "@types/node": "^22.15.0",
-    "@types/pdfkit": "^0.13.8",
     "@typescript-eslint/eslint-plugin": "^8.32.0",
     "@typescript-eslint/parser": "^8.32.0",
     "eslint": "^9.0.0",
     "husky": "^9.0.0",
     "jest": "^29.7.0",
-    "lint-staged": "^15.0.0",
+    "knip": "^5.86.0",
+    "lint-staged": "^16.3.2",
+    "madge": "^8.0.0",
     "prettier": "^3.0.0",
     "ts-jest": "^29.4.6",
     "typescript": "^5.1.6"