ci: replace Super-Linter with reusable quality and security workflows, group Dependabot updates, and refresh scaffolded linter and Gitleaks configs.

.github/dependabot.yml

@@ -6,10 +6,20 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
 
   # Maintain dependencies for Composer
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
+    groups:
+      composer:
+        patterns: ["*"]
     versioning-strategy: increase-if-necessary

.github/linters/.codespellrc

@@ -1,2 +1,2 @@
 [codespell]
-skip = */tests/*,tests/**,*/composer.lock,*/composer.json
+skip = ./.git,.claude/*,.codex/*,.vscode/*,code_coverage/*,composer.lock,runtime/*,scaffold-lock.json,vendor/*,*/tests/*,tests/**,*/composer.lock,*/composer.json,*/package-lock.json,*/dist/*,*/node_modules/*

.github/linters/.editorconfig-checker.json

@@ -1,5 +1,10 @@
 {
     "Exclude": [
+        "^\\.claude/",
+        "^\\.codex/",
+        "^\\.vscode/",
+        "^code_coverage/",
+        "^composer\\.lock$",
         "phpstan-baseline\\.neon$",
         "^tests/runtime/",
         "\\.min\\.css$",

.github/linters/.gitleaks.toml

@@ -2,9 +2,3 @@ title = "gitleaks config"
 
 [extend]
 useDefault = true
-
-[allowlist]
-description = "Allow test fixture data with dummy credentials"
-paths = [
-    '''tests/support/data/.*\.php''',
-]

.github/workflows/quality.yml

@@ -0,0 +1,24 @@
+---
+on:
+  - pull_request
+  - push
+
+name: quality
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    uses: yii2-framework/actions/.github/workflows/quality.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1
+    permissions:
+      contents: read
+    with:
+      codespell-config: .github/linters/.codespellrc
+      editorconfig-checker-config: .github/linters/.editorconfig-checker.json
+      markdownlint-config: .github/linters/.markdown-lint.yml
+      prettier-config: .prettierrc.json
+      prettier-ignore-path: .prettierignore
+      yamllint-targets: |-
+        .github
+        metadata/.github

.github/workflows/security.yml

@@ -0,0 +1,19 @@
+---
+on:
+  - pull_request
+  - push
+
+name: security
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    uses: yii2-framework/actions/.github/workflows/security.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1
+    permissions:
+      contents: read
+    with:
+      gitleaks-config: .github/linters/.gitleaks.toml
+    secrets:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

.gitignore

@@ -1,3 +1,7 @@
+# AI agents (if present)
+.codex
+.claude
+
 # codecoverage (if present)
 code_coverage
 

.prettierignore

@@ -0,0 +1,32 @@
+# Local agent, editor, coverage output, runtime state, caches, and dependencies.
+.claude/**
+.codex/**
+.vscode/**
+code_coverage/**
+runtime/**
+vendor/**
+
+# Dependency lockfile ignored by git.
+composer.lock
+
+**/*.min.css
+**/*.min.js
+
+# Vite-built bundles (committed dist/) and lockfiles.
+**/dist/**
+**/node_modules/**
+**/package-lock.json
+
+# Yii AssetManager publishes a hashed copy of src/assets/ under tests/runtime/
+# whenever phpunit runs; the tree is regenerated on every test run, never
+# authored, and ignored by git already.
+tests/runtime/**
+
+# License texts ship verbatim — never auto-formatted.
+**/LICENSE*
+
+# Tool configs maintained by hand to keep their array order meaningful.
+composer-require-checker.json
+
+# Auto-generated by yii2-extensions/scaffold; never hand-edited.
+scaffold-lock.json

.prettierrc.json

@@ -0,0 +1,22 @@
+{
+    "tabWidth": 4,
+    "useTabs": false,
+    "singleQuote": false,
+    "trailingComma": "all",
+    "printWidth": 80,
+    "overrides": [
+        {
+            "files": ["**/*.{yml,yaml}"],
+            "options": {
+                "tabWidth": 2
+            }
+        },
+        {
+            "files": "**/*.md",
+            "options": {
+                "embeddedLanguageFormatting": "off",
+                "tabWidth": 2
+            }
+        }
+    ]
+}

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## 0.1.3 Under development
 
+- ci: replace Super-Linter with reusable quality and security workflows, group Dependabot updates, and refresh scaffolded linter and Gitleaks configs.
+
 ## 0.1.2 May 19, 2026
 
 - fix: remove `phpunit.xml` from `.gitignore` and update `composer-require-checker.json` structure.

README.md

@@ -39,7 +39,7 @@ Then run `composer update`.
 ## Scaffolded distribution
 
 This package is a [`yii2-extensions/scaffold`](https://github.com/yii2-extensions/scaffold) provider for **dev
-environment metadata** (editor, gitignore, prettier, stylelint, super-linter configs, and more). Templates live under
+environment metadata** (editor, gitignore, prettier, stylelint, quality linter configs, and more). Templates live under
 `metadata/` and are mapped to consumer roots via the `{from, to}` form in `scaffold.json`.
 
 Opt in by allowing the plugin and listing this package as an authorised provider:
@@ -87,10 +87,9 @@ vendor/bin/scaffold status
 └── .github
     └── linters
         ├── .codespellrc               # replace: codespell config
-        ├── .editorconfig-checker.json # replace: editor-config-checker config for Super-Linter
+        ├── .editorconfig-checker.json # replace: editorconfig-checker config
         ├── .gitleaks.toml             # replace: gitleaks config
-        ├── .markdown-lint.yml         # replace: markdownlint config
-        └── actionlint.yml             # replace: actionlint config for Super-Linter
+        └── .markdown-lint.yml         # replace: markdownlint config
 ```
 
 Mode semantics:
@@ -111,9 +110,10 @@ either, both, or neither.
 [![Latest Stable Version](https://img.shields.io/packagist/v/php-forge/baseline.svg?style=for-the-badge&logo=packagist&logoColor=white&label=Stable)](https://packagist.org/packages/php-forge/baseline)
 [![Total Downloads](https://img.shields.io/packagist/dt/php-forge/baseline.svg?style=for-the-badge&logo=composer&logoColor=white&label=Downloads)](https://packagist.org/packages/php-forge/baseline)
 
-## Quality code
+## Project status
 
-[![Super-Linter](https://img.shields.io/github/actions/workflow/status/php-forge/baseline/linter.yml?style=for-the-badge&label=Super-Linter&logo=github)](https://github.com/php-forge/baseline/actions/workflows/linter.yml)
+[![Quality](https://img.shields.io/github/actions/workflow/status/php-forge/baseline/quality.yml?style=for-the-badge&label=Quality&logo=github)](https://github.com/php-forge/baseline/actions/workflows/quality.yml)
+[![Security](https://img.shields.io/github/actions/workflow/status/php-forge/baseline/security.yml?style=for-the-badge&label=Security&logo=github)](https://github.com/php-forge/baseline/actions/workflows/security.yml)
 [![StyleCI](https://img.shields.io/badge/StyleCI-Passed-44CC11.svg?style=for-the-badge&logo=github&logoColor=white)](https://github.styleci.io/repos/php-forge/baseline?branch=main)
 
 ## Our social networks

composer.json

@@ -12,9 +12,9 @@
         "php",
         "php-forge",
         "prettier",
+        "quality",
         "rector",
-        "scaffold-provider",
-        "super-linter"
+        "scaffold-provider"
     ],
     "license": "BSD-3-Clause",
     "minimum-stability": "dev",

metadata/.github/linters/.codespellrc

@@ -1,2 +1,2 @@
 [codespell]
-skip = */tests/*,tests/**,*/composer.lock,*/composer.json,*/package-lock.json,*/dist/*,*/node_modules/*
+skip = ./.git,.claude/*,.codex/*,.vscode/*,code_coverage/*,composer.lock,runtime/*,scaffold-lock.json,vendor/*,*/tests/*,tests/**,*/composer.lock,*/composer.json,*/package-lock.json,*/dist/*,*/node_modules/*

metadata/.github/linters/.editorconfig-checker.json

@@ -1,5 +1,10 @@
 {
     "Exclude": [
+        "^\\.claude/",
+        "^\\.codex/",
+        "^\\.vscode/",
+        "^code_coverage/",
+        "^composer\\.lock$",
         "phpstan-baseline\\.neon$",
         "^tests/runtime/",
         "\\.min\\.css$",

metadata/.github/linters/.gitleaks.toml

@@ -2,9 +2,3 @@ title = "gitleaks config"
 
 [extend]
 useDefault = true
-
-[allowlist]
-description = "Allow test fixture data with dummy credentials"
-paths = [
-    '''tests/support/data/.*\.php''',
-]

metadata/.prettierignore

@@ -1,21 +1,21 @@
-**/*.min.css
-**/*.min.js
+# Local agent, editor, coverage, and generated runtime state.
+.claude/**
+.codex/**
+.vscode/**
+code_coverage/**
+runtime/**
 
-# Vite-built bundles (committed dist/) and lockfiles.
-**/dist/**
-**/node_modules/**
-**/package-lock.json
+# Dependencies.
+vendor/**
 
-# Yii AssetManager publishes a hashed copy of src/assets/ under tests/runtime/
-# whenever phpunit runs; the tree is regenerated on every test run, never
-# authored, and ignored by git already.
-tests/runtime/**
+# Dependency lockfile ignored by git.
+composer.lock
 
-# License texts ship verbatim — never auto-formatted.
+# License texts ship verbatim.
 **/LICENSE*
 
-# Tool configs maintained by hand to keep their array order meaningful.
+# Tool config maintained by hand to keep array order meaningful.
 composer-require-checker.json
 
-# Auto-generated by yii2-extensions/scaffold; never hand-edited.
+# Auto-generated by yii2-extensions/scaffold.
 scaffold-lock.json