[DONE] 정리 마지막 기록(포크 #93)이 원래 레포 dev 위에 커밋 하나로 다시 얹혀, hub 가 거기서 다시 멈추지 않는다

CODE_OF_CONDUCT.md → .github/CODE_OF_CONDUCT.md

@@ -4,7 +4,7 @@ This applies everywhere Patternflow people meet: this repository (issues, pull r
 
 ## How we treat each other
 
-The rule was written before there was anything to build, as a short poem, and it is the sixth section of the [manifesto](docs/manifesto.md#6-how-we-treat-each-other). In full:
+The rule was written before there was anything to build, as a short poem, and it is the sixth section of the [manifesto](../docs/manifesto.md#6-how-we-treat-each-other). In full:
 
 > 아무것도 몰라도, 하고자 한다면 만들 수 있습니다.
 > 도와주는 게 당연합니다. 고마운 게 당연합니다.

.github/ISSUE_TEMPLATE/config.yml

@@ -13,7 +13,7 @@ contact_links:
     url: https://discord.gg/Vr9QtsxeTk
     about: New here? Join the server, then jump into the channels above.
   - name: Getting help — every venue in one table
-    url: https://github.com/engmung/Patternflow/blob/main/SUPPORT.md
+    url: https://github.com/engmung/Patternflow/blob/main/.github/SUPPORT.md
     about: Where to ask what, including the venue that works where Discord is blocked.
   - name: Contributing guide
     url: https://github.com/engmung/Patternflow/blob/main/CONTRIBUTING.md

SECURITY.md → .github/SECURITY.md

@@ -13,7 +13,7 @@ Please report privately through [GitHub's report form](https://github.com/engmun
 
 ## What is a documented trust model, not a vulnerability
 
-The device's HTTP server on the LAN has **no authentication**: anyone on the same network can call any `/api/*` route, including `POST /update`. The same holds on the panel's own hotspot (`patternflow-xxxx`, raised when it finds no network it knows), whose password is the documented default `patternflow` until it is changed on the Wi-Fi page. This is deliberate and documented in [docs/rest-api.md](docs/rest-api.md#transport) — the panel is an instrument on a home or venue network, with the same posture as ArduinoOTA's default. `PF_WEBUPDATE_ALWAYS_ARMED 0` is the one lever that narrows `/update`; the hotspot takes its own password, or is switched off, on the Wi-Fi page. Reports that amount to "the LAN API is open" will be closed with a pointer here; reports of a way to reach that API from *outside* the LAN, or from a web page on another origin, are in scope.
+The device's HTTP server on the LAN has **no authentication**: anyone on the same network can call any `/api/*` route, including `POST /update`. The same holds on the panel's own hotspot (`patternflow-xxxx`, raised when it finds no network it knows), whose password is the documented default `patternflow` until it is changed on the Wi-Fi page. This is deliberate and documented in [docs/rest-api.md](../docs/rest-api.md#transport) — the panel is an instrument on a home or venue network, with the same posture as ArduinoOTA's default. `PF_WEBUPDATE_ALWAYS_ARMED 0` is the one lever that narrows `/update`; the hotspot takes its own password, or is switched off, on the Wi-Fi page. Reports that amount to "the LAN API is open" will be closed with a pointer here; reports of a way to reach that API from *outside* the LAN, or from a web page on another origin, are in scope.
 
 ## Supported versions
 

SUPPORT.md → .github/SUPPORT.md

@@ -6,13 +6,13 @@ One table for "where do I ask". Issues are for things that change this repositor
 | :--- | :--- |
 | Learn to build, play, make patterns for one or give it sound and MIDI | [The guide](https://patternflow.work/guide) — each step on a 3D Patternflow in the browser. A step that didn't get you through has a **Stuck here?** link, which opens an issue with that step filled in |
 | Get unstuck building, soldering or flashing | [Discord → hardware-help](https://discord.com/channels/1497757947827327067/1499907910707187833) — photos and quick back-and-forth |
-| Flash the DevKit for the first time, or get the panel onto Wi-Fi | [The Play guide's Flash chapter](https://patternflow.work/guide/play#flash), or [`BUILD_GUIDE.md` §8](BUILD_GUIDE.md#8-firmware) in writing. The short version is below the table |
+| Flash the DevKit for the first time, or get the panel onto Wi-Fi | [The Play guide's Flash chapter](https://patternflow.work/guide/play#flash), or [`BUILD_GUIDE.md` §8](../BUILD_GUIDE.md#8-firmware) in writing. The short version is below the table |
 | Show a pattern I made, or get feedback on one | Publish it from the [Pattern Lab](https://patternflow.work/pattern-lab) to the [Community](https://community.patternflow.work/community), then [Discord → patterns](https://discord.com/channels/1497757947827327067/1499908302962819236) |
 | Put my finished build on the [build map](https://patternflow.work/inside) | [Share your build](https://github.com/engmung/Patternflow/issues/new?template=share_build.yml) — or post it in Discord |
 | Talk about where the project should go, or find people working on the same direction | [Discord](https://discord.gg/Vr9QtsxeTk) — the dev-log and the project channels |
 | Report a bug, a wrong or missing doc, or propose a feature | [New issue](https://github.com/engmung/Patternflow/issues/new/choose) — pick the template |
 | Report a security problem | [SECURITY.md](SECURITY.md) — privately, not as an issue |
-| Contribute code, hardware files or docs | [CONTRIBUTING.md](CONTRIBUTING.md) |
+| Contribute code, hardware files or docs | [CONTRIBUTING.md](../CONTRIBUTING.md) |
 
 **The first flash, in short.**
 

.github/workflows/drift.yml

@@ -0,0 +1,70 @@
+name: Drift checks
+
+# The tree keeps some facts in two places by hand: the BOM and the build
+# guide's parts table, a card on /editions and a folder under
+# firmware/bundles/. Each check in web/scripts/drift/ compares one such pair
+# and prints both sides when they part (docs/rfc-cleanup.md §2.4). check:ci
+# runs them too, but Web CI starts only on web/ and hardware/case/. A pull
+# request that edits only the BOM, a bundle or the changelog runs no web job,
+# and that is the pull request a drift check is for. So this one runs on every
+# pull request.
+#
+# PF_DRIFT_STRICT=1 turns a skip into a failure. At a desk a check skips a side
+# it cannot read: a tag the clone lacks, no pdftotext, no gh login. Here every
+# side can be read, so a skip means this file is missing something.
+# fetch-depth: 0 brings the tags the absolute links point at, and the base
+# commit check:human-lock compares with.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: drift-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  issues: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    env:
+      PF_DRIFT_STRICT: "1"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install dependencies
+        id: deps
+        run: npm ci
+
+      # check:bom-schematic reads the schematic's text layer with pdftotext,
+      # which the runner image does not carry.
+      - name: Install pdftotext
+        run: command -v pdftotext || { sudo apt-get update -q && sudo apt-get install -y -q poppler-utils; }
+
+      # check:roadmap asks gh for the state of each issue a roadmap node names.
+      - name: Drift checks
+        run: npm run check:drift
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      # Not a word of the maintainer's own writing changes (§2.9). It runs
+      # after a red drift step too, so one push shows both.
+      - name: Locked text
+        if: ${{ !cancelled() && steps.deps.outcome == 'success' && github.event_name == 'pull_request' && hashFiles('web/scripts/human-lock.ts') != '' }}
+        run: npm run check:human-lock
+        env:
+          PF_LOCK_BASE: ${{ github.event.pull_request.base.sha }}

.github/workflows/web-ci.yml

@@ -40,9 +40,10 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      # Lint is a hard gate: lint errors can't reach main (warnings still pass).
+      # Lint is a hard gate, and a warning fails it like an error. The cleanup's
+      # step 3 took the site from twelve warnings to none; one more fails here.
       - name: Lint
-        run: npm run lint
+        run: npm run lint -- --max-warnings=0
 
       # `next build` type-checks only what it bundles; scripts/ and the smoke
       # suites are outside that, and a type error there used to surface as a