chore: enhance project configuration and CI pipeline

- Added TypeScript build cache to .gitignore.
- Introduced SECURITY.md for vulnerability reporting and security policy.
- Updated CI workflow to include explicit permissions and type-checking step.
- Enhanced .vscode/settings.json for improved development experience.
- Updated changelog to reflect recent changes and improvements.

Author: KevOneRedOne

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -27,13 +30,23 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Audit dependencies
-        run: pnpm audit
+        run: pnpm audit --audit-level=high
+
+      - name: Type check
+        run: pnpm exec tsc --noEmit
 
       - name: Run linter
         run: pnpm lint
 
-      - name: Run tests
-        run: pnpm test -- --run
+      - name: Run tests with coverage
+        run: pnpm test:coverage -- --run
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 7
 
       - name: Build
         run: pnpm build

.gitignore

@@ -13,9 +13,13 @@ dist-ssr
 *.local
 coverage
 
+# TypeScript build cache
+*.tsbuildinfo
+
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json
+!.vscode/settings.json
 .idea
 .DS_Store
 *.suo

.vscode/settings.json

@@ -0,0 +1,38 @@
+{
+  "editor.formatOnSave": true,
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.tabSize": 2,
+  "editor.insertSpaces": true,
+  "editor.trimAutoWhitespace": true,
+  "editor.rulers": [100],
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+
+  "js/ts.tsdk": "node_modules/typescript/lib",
+  "js/ts.tsdk.promptToUseWorkspaceVersion": true,
+  "js/ts.preferences.importModuleSpecifier": "shortest",
+
+  "eslint.useFlatConfig": true,
+
+  "files.exclude": {
+    "**/.git": true,
+    "**/node_modules": true,
+    "**/dist": true,
+    "**/.pnpm-store": true
+  },
+  "search.exclude": {
+    "**/node_modules": true,
+    "**/dist": true,
+    "**/coverage": true,
+    "pnpm-lock.yaml": true
+  },
+
+  "[scss]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  },
+
+  "[markdown]": {
+    "editor.wordWrap": "on"
+  }
+}

CHANGELOG.md

@@ -9,17 +9,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
-- SHA pinning de toutes les GitHub Actions (checkout v5.1.0, setup-node v4.4.0, pnpm/action-setup v6.0.10, softprops/action-gh-release v2.3.2)
+- SHA pinning de toutes les GitHub Actions (checkout v5.1.0, setup-node v4.4.0, pnpm/action-setup v6.0.10, softprops/action-gh-release v2.3.2, upload-artifact v4.6.2)
+- `permissions: contents: read` explicite sur le workflow CI (principe du moindre privilège)
+- `pnpm audit --audit-level=high` dans la CI pour bloquer uniquement les vulnérabilités critiques
+- Ajout de `SECURITY.md` avec politique de divulgation responsable
 
 ### Added
 
 - Hook `pre-push` Husky : type-check TypeScript (`tsc --noEmit`) + suite de tests complète avant chaque push
-- `.vscode/extensions.json` : recommandations d'extensions VS Code pour le projet
+- `.vscode/extensions.json` : recommandations d'extensions VS Code ciblées pour ce projet
+- `.vscode/settings.json` : formatOnSave, TS SDK workspace, ESLint fix on save, rulers à 100 chars
 - Bundle analyzer via `rollup-plugin-visualizer` (script `build:analyze`)
+- Étape `tsc --noEmit` explicite dans la CI pour un feedback d'erreur de type clair
+- Upload du rapport de coverage en artifact CI (retention 7 jours)
 
 ### Changed
 
-- `verbatimModuleSyntax` activé dans `tsconfig.json` pour forcer `import type` explicite
+- `verbatimModuleSyntax` activé dans `tsconfig.json` et `tsconfig.node.json` pour forcer `import type` explicite
 
 ## [3.3.0] - 2026-08-13
 

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release of Simplistic Tetris receives security updates.
+
+| Version | Supported |
+| ------- | --------- |
+| Latest  | ✅        |
+| Older   | ❌        |
+
+## Reporting a Vulnerability
+
+**Please do not open a public issue for security vulnerabilities.**
+
+Use GitHub's private vulnerability reporting:
+👉 [Report a vulnerability](https://github.com/KevOneRedOne/Simplistic-Tetris/security/advisories/new)
+
+### What to include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (optional)
+
+### Response timeline
+
+| Step | Timeframe |
+|------|-----------|
+| Acknowledgement | Within 48 hours |
+| Assessment | Within 7 days |
+| Fix & release | Depends on severity |
+
+Security fixes are released as patch versions and disclosed in the [CHANGELOG](./CHANGELOG.md).

tsconfig.node.json

@@ -4,7 +4,8 @@
     "skipLibCheck": true,
     "module": "ESNext",
     "moduleResolution": "bundler",
-    "allowSyntheticDefaultImports": true
+    "allowSyntheticDefaultImports": true,
+    "verbatimModuleSyntax": true
   },
   "include": ["vite.config.ts"]
 }