feat: enhance ps args scheme to extend compat range

.github/workflows/ci.yaml

@@ -25,7 +25,7 @@ jobs:
           cache: 'npm'
       - run: npm ci
       - run: npm run build
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: build
           path: |
@@ -55,7 +55,7 @@ jobs:
         run: npm ci
       - name: Run tests
         run: npm run test
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: coverage
           path: |
@@ -91,8 +91,7 @@ jobs:
           merge-multiple: true
       - name: Run release
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_PROVENANCE: true
+          NPM_OIDC: true
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_USER: 'x-access-token'
           GIT_BRANCH: 'main'
@@ -106,49 +105,95 @@ jobs:
         env:
           GIT_COMMITTER_NAME: ${{ vars.GIT_COMMITTER_NAME }}
           GIT_COMMITTER_EMAIL: ${{ vars.GIT_COMMITTER_EMAIL }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npx ggcp target/docs https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git/gh-pages --message='chore: update docs'
-          npx ggcp target/coverage/lcov.info https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git/coverage/${{ github.sha }}.lcov.info --message='chore: add coverage for ${{ github.sha }}'
+          npx ggcp target/docs https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git/gh-pages --message='chore: update docs'
+          npx ggcp target/coverage/lcov.info https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git/coverage/${{ github.sha }}.lcov.info --message='chore: add coverage for ${{ github.sha }}'
 
-  pr:
+  test-node:
     needs: build
     if: github.event_name == 'pull_request'
-    name: pr-os-${{ matrix.os }}-nodejs${{ matrix.node-version }}
+    name: test-node-${{ matrix.node-version }}
     strategy:
       matrix:
-        os: [ ubuntu-24.04, windows-2022, windows-2025 ]
-        node-version: [ 20 ]
-
-    runs-on: ${{ matrix.os }}
+        node-version: [ 20, 24 ]
+    runs-on: ubuntu-24.04
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
-
       - uses: actions/download-artifact@v5
         with:
           name: build
+      - run: npm ci
+      - run: npm run test
 
-      - name: Fetch deps
-        run: npm ci
-
-      - name: Run all tests
-        if: matrix.os == 'ubuntu-24.04'
-        run: npm run test
+  smoke-node-14:
+    needs: build
+    if: github.event_name == 'pull_request'
+    name: smoke-node-14
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 14
+      - uses: actions/download-artifact@v5
+        with:
+          name: build
+      - run: npm install --no-package-lock
+      - run: npm run test:legacy
 
-      - name: Run legacy tests only
-        if: matrix.os != 'ubuntu-24.04'
+  smoke-os:
+    needs: build
+    if: github.event_name == 'pull_request'
+    name: smoke-${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ macos-latest, windows-2022, windows-2025 ]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: 'npm'
+      - uses: actions/download-artifact@v5
+        with:
+          name: build
+      - run: npm ci
+      - name: Run smoke tests
+        if: "!contains(matrix.os, 'windows')"
+        run: npm run test:unit
+      - name: Run smoke tests (windows)
+        if: contains(matrix.os, 'windows')
         timeout-minutes: 2
-        run: npm run x:test:legacy
-#        run: |
-#          wmic process get ProcessId,ParentProcessId,CommandLine
+        run: npm run test:legacy
 
-#      - name: wmic via node
-#        if: matrix.os == 'windows-latest'
-#        run: |
-#          node -e "const { execSync } = require('child_process'); console.log(execSync('wmic process get ProcessId,ParentProcessId,CommandLine').toString())"
+  smoke-alpine:
+    needs: build
+    if: github.event_name == 'pull_request'
+    name: smoke-alpine-busybox
+    runs-on: ubuntu-24.04
+    container: node:20-alpine
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v5
+        with:
+          name: build
+      - name: Verify BusyBox ps
+        run: |
+          which busybox && busybox --list | grep -w ps
+          ps -eo pid,ppid,args | head -5
+      - run: npm ci
+      - run: npm run test:unit

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: Zizmor
+
+on:
+  push:
+    branches: ['master']
+  pull_request:
+    branches: ['**']
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+        with:
+          enable-cache: false
+
+      - name: Run zizmor
+        run: uvx zizmor@1.23.1 .github/workflows -v -p --min-severity=medium

oxlintrc.json

@@ -0,0 +1,102 @@
+{
+  "$schema": "https://raw.githubusercontent.com/nicolo-ribaudo/oxlint-config-json-schema/refs/heads/main/generated/schema.json",
+  "plugins": ["typescript", "unicorn"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn",
+    "pedantic": "off",
+    "style": "off",
+    "nursery": "off"
+  },
+  "rules": {
+    "no-empty-function": "off",
+    "no-case-declarations": "error",
+    "no-async-promise-executor": "error",
+    "no-prototype-builtins": "error",
+    "no-self-assign": "error",
+    "no-shadow-restricted-names": "error",
+    "no-unsafe-optional-chaining": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": "error",
+    "no-fallthrough": "error",
+    "no-var": "error",
+    "prefer-const": "error",
+    "prefer-rest-params": "error",
+    "prefer-spread": "error",
+    "require-yield": "error",
+
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-explicit-any": "warn",
+    "typescript/no-non-null-assertion": "warn",
+    "typescript/no-unused-vars": "warn",
+    "typescript/no-empty-interface": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-inferrable-types": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-var-requires": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/triple-slash-reference": "error",
+
+    "unicorn/consistent-function-scoping": "error",
+    "unicorn/error-message": "error",
+    "unicorn/escape-case": "error",
+    "unicorn/explicit-length-check": "error",
+    "unicorn/new-for-builtins": "error",
+    "unicorn/no-await-expression-member": "warn",
+    "unicorn/no-console-spaces": "error",
+    "unicorn/no-empty-file": "error",
+    "unicorn/no-hex-escape": "error",
+    "unicorn/no-instanceof-array": "error",
+    "unicorn/no-lonely-if": "error",
+    "unicorn/no-negated-condition": "error",
+    "unicorn/no-new-array": "error",
+    "unicorn/no-new-buffer": "error",
+    "unicorn/no-object-as-default-parameter": "error",
+    "unicorn/no-process-exit": "error",
+    "unicorn/no-static-only-class": "error",
+    "unicorn/no-thenable": "error",
+    "unicorn/no-this-assignment": "error",
+    "unicorn/no-typeof-undefined": "error",
+    "unicorn/no-unnecessary-await": "error",
+    "unicorn/no-unreadable-array-destructuring": "error",
+    "unicorn/no-unreadable-iife": "error",
+    "unicorn/no-useless-fallback-in-spread": "error",
+    "unicorn/no-useless-length-check": "error",
+    "unicorn/no-useless-promise-resolve-reject": "error",
+    "unicorn/no-useless-spread": "error",
+    "unicorn/no-useless-switch-case": "error",
+    "unicorn/no-zero-fractions": "error",
+    "unicorn/numeric-separators-style": "error",
+    "unicorn/prefer-array-find": "error",
+    "unicorn/prefer-array-flat": "error",
+    "unicorn/prefer-array-flat-map": "error",
+    "unicorn/prefer-array-some": "error",
+    "unicorn/prefer-code-point": "error",
+    "unicorn/prefer-date-now": "error",
+    "unicorn/prefer-default-parameters": "error",
+    "unicorn/prefer-includes": "error",
+    "unicorn/prefer-logical-operator-over-ternary": "error",
+    "unicorn/prefer-modern-math-apis": "error",
+    "unicorn/prefer-native-coercion-functions": "error",
+    "unicorn/prefer-negative-index": "error",
+    "unicorn/prefer-node-protocol": "error",
+    "unicorn/prefer-number-properties": "error",
+    "unicorn/prefer-optional-catch-binding": "error",
+    "unicorn/prefer-prototype-methods": "error",
+    "unicorn/prefer-regexp-test": "error",
+    "unicorn/prefer-set-has": "error",
+    "unicorn/prefer-spread": "error",
+    "unicorn/prefer-string-slice": "error",
+    "unicorn/prefer-string-starts-ends-with": "error",
+    "unicorn/prefer-string-trim-start-end": "error",
+    "unicorn/prefer-ternary": "error",
+    "unicorn/prefer-type-error": "error",
+    "unicorn/require-array-join-separator": "error",
+    "unicorn/require-number-to-fixed-digits-argument": "error",
+    "unicorn/throw-new-error": "error"
+  }
+}