Prepare the repository and the 0.2.0 release for a public listing

.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{png,svg,vsix}]
+insert_final_newline = false
+trim_trailing_whitespace = false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/krotname/VsCodeMarkdownTableEditor/security/advisories/new
+    about: Report privately through GitHub security advisories instead of a public issue.
+  - name: Question or usage help
+    url: https://github.com/krotname/VsCodeMarkdownTableEditor/discussions
+    about: Ask about behavior, shortcuts, or settings.
+  - name: Other editions
+    url: https://markdowntableeditor.ru/
+    about: The same table engine for JetBrains IDEs and Notepad++.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Suggest a table editing capability or a change to an existing command
+title: '[Feature]: '
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What does editing a table cost you today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Include a before and after table if the change affects table output.
+      render: markdown
+    validations:
+      required: true
+  - type: dropdown
+    id: parity
+    attributes:
+      label: Should the JetBrains and Notepad++ editions behave the same way?
+      options:
+        - Yes, this belongs in the shared table engine
+        - No, this is specific to VS Code
+        - Not sure
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## User impact
+
+<!-- What changes for someone editing a Markdown table? Link the issue if there is one. -->
+
+## Validation
+
+<!-- Commands you ran and what they proved. -->
+
+- [ ] `npm run check`
+- [ ] `npm run test:coverage`
+- [ ] `npm run test:e2e`
+- [ ] `npm run package` (only when packaging or manifest metadata changed)
+
+## Core parity
+
+- [ ] No change to `src/core.ts` behavior, or the shared golden fixture and the JetBrains and
+      Notepad++ repositories were updated together with this change.

.github/workflows/actionlint.yml

@@ -0,0 +1,23 @@
+name: Actionlint
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0

.github/workflows/ci.yml

@@ -18,8 +18,10 @@ jobs:
     name: Unit, contract, coverage, build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
@@ -28,7 +30,7 @@ jobs:
       - run: npm run typecheck
       - run: npm run test:coverage
       - run: npm run build
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage
           path: coverage/lcov.info
@@ -41,8 +43,10 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
@@ -59,16 +63,18 @@ jobs:
     needs: [quality, e2e]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
       - run: npm ci
       - run: npm run package
       - run: npm run test:vsix
       - run: sha256sum build/markdown-table-editor.vsix > build/SHA256SUMS.txt
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: markdown-table-editor-vsix
           path: |

.github/workflows/codeql.yml

@@ -20,24 +20,26 @@ jobs:
     name: JavaScript/TypeScript
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4.37.4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: javascript-typescript
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
       - run: npm ci
       - run: npm run build
-      - uses: github/codeql-action/analyze@v4.37.4
+      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           upload: never
           upload-database: false
           output: codeql-results
       - name: Fail on CodeQL findings
         run: node scripts/check-sarif.mjs codeql-results
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: codeql-sarif

.github/workflows/dependency-review.yml

@@ -0,0 +1,20 @@
+name: Dependency Review
+
+# Pull request only: the action compares the base and head of a pull request, and a
+# workflow_dispatch run has no such refs to compare.
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  dependency-review:
+    name: Review dependency changes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/publish-marketplace.yml

@@ -0,0 +1,142 @@
+name: Publish to VS Code Marketplace
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Extension version without leading v; must match package.json.
+        required: true
+        type: string
+      mode:
+        description: Dry-run builds and verifies the VSIX; publish uploads it to the Marketplace.
+        required: true
+        default: dry-run
+        type: choice
+        options:
+          - dry-run
+          - publish
+      confirmation:
+        description: For publish, type markdown-table-editor:<version>.
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: markdown-table-editor-marketplace
+  cancel-in-progress: false
+
+jobs:
+  # Runs for both modes and never sees the Marketplace token: workflow_dispatch takes the workflow
+  # file and the build scripts from the dispatched ref, so anything reachable here is untrusted.
+  verify:
+    name: Verify ${{ inputs.version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      RELEASE_VERSION: ${{ inputs.version }}
+      RELEASE_MODE: ${{ inputs.mode }}
+      RELEASE_CONFIRMATION: ${{ inputs.confirmation }}
+      RELEASE_REF: ${{ github.ref }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Validate release request
+        run: |
+          set -euo pipefail
+          if ! [[ "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid version: '$RELEASE_VERSION'." >&2
+            exit 1
+          fi
+          manifest_version="$(node -p "require('./package.json').version")"
+          if [ "$RELEASE_VERSION" != "$manifest_version" ]; then
+            echo "Requested version '$RELEASE_VERSION' does not match package.json '$manifest_version'." >&2
+            exit 1
+          fi
+          if [ "$RELEASE_MODE" = publish ]; then
+            if [ "$RELEASE_REF" != refs/heads/main ]; then
+              echo "Publishing is allowed only from refs/heads/main; got '$RELEASE_REF'." >&2
+              exit 1
+            fi
+            if [ "$RELEASE_CONFIRMATION" != "markdown-table-editor:$RELEASE_VERSION" ]; then
+              echo "Publish confirmation must exactly match 'markdown-table-editor:$RELEASE_VERSION'." >&2
+              exit 1
+            fi
+          fi
+          echo "Validated $RELEASE_MODE request for markdown-table-editor:$RELEASE_VERSION."
+
+      - run: npm ci
+      # npm run package runs typecheck, unit tests, and the bundle build before vsce package.
+      - run: npm run package
+      - run: npm run test:vsix
+
+      - name: Record the artifact checksum
+        run: sha256sum build/markdown-table-editor.vsix > build/SHA256SUMS.txt
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: marketplace-${{ inputs.version }}-${{ inputs.mode }}
+          path: |
+            build/markdown-table-editor.vsix
+            build/SHA256SUMS.txt
+          if-no-files-found: error
+          retention-days: 14
+
+  # The token lives in the "marketplace" environment, which requires reviewer approval and is
+  # limited to protected branches. Dropping the environment from this job would also drop access
+  # to the secret, so the gate cannot be removed by pushing a modified workflow to a side branch.
+  publish:
+    name: Publish ${{ inputs.version }}
+    needs: verify
+    if: ${{ inputs.mode == 'publish' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: marketplace
+    env:
+      RELEASE_VERSION: ${{ inputs.version }}
+      RELEASE_REF: ${{ github.ref }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: marketplace-${{ inputs.version }}-publish
+          path: build
+
+      - name: Confirm the publish ref, artifact, and secret
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: |
+          set -euo pipefail
+          if [ "$RELEASE_REF" != refs/heads/main ]; then
+            echo "Publishing is allowed only from refs/heads/main; got '$RELEASE_REF'." >&2
+            exit 1
+          fi
+          if [ -z "${VSCE_PAT:-}" ]; then
+            echo "Required environment secret 'VSCE_PAT' is missing." >&2
+            exit 1
+          fi
+          sha256sum --check build/SHA256SUMS.txt
+          echo "Publishing markdown-table-editor:$RELEASE_VERSION from main."
+
+      - run: npm ci
+
+      - name: Publish the verified VSIX
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: npx --no-install vsce publish --packagePath build/markdown-table-editor.vsix

.github/workflows/release.yml

@@ -13,16 +13,18 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
       - run: npm ci
       - run: npm run test:coverage
       - run: npm run package
       - run: sha256sum build/markdown-table-editor.vsix > build/SHA256SUMS.txt
-      - uses: actions/attest-build-provenance@v4
+      - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: build/markdown-table-editor.vsix
       - name: Create GitHub release