chore: CI/CD improvements

[basmasking]

Closes #523
Closes #524
Fixes #526

Changes proposed in this pull request:

• pm2 added for easier demos
• dependency updates

@MaskingTechnology/comify

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5fbdeee4-3197-40bd-9ac0-6a20d7552da5

📥 Commits

Reviewing files that changed from the base of the PR and between f6121e6 and df07e47.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• .github/workflows/codeql.yml
• development/common/package.json
• development/insights/package.json
• development/moderation/package.json
• development/social/app/index.html
• development/social/package.json
• ecosystem.config.cjs
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Summary by CodeRabbit

• Bug Fixes
  • Updated app icon paths so the favicon and Apple touch icon can load from the site root.
• Chores
  • Added production process management for the application’s services, including commands to start, stop, and monitor them.
  • Updated automated code analysis tooling.
  • Standardized compilation and packaging workflows across the project.

Walkthrough

The pull request updates CodeQL action versions, renames workspace build scripts, changes the root build and bundling flow, adds PM2 configuration and lifecycle scripts for production services, updates two dependency version ranges, and changes social app icon paths.

Changes

CodeQL Action Updates

Layer / File(s)	Summary
Update CodeQL action versions .github/workflows/codeql.yml	The CodeQL initialization and analysis steps now use version 4.38.2.

Build and Production Commands

Layer / File(s)	Summary
Rename workspace compilation scripts development/common/package.json, development/insights/package.json, development/moderation/package.json, development/social/package.json	The packages use compile, compile-app, and compile-logic script names in place of the corresponding build names. The command sequences remain unchanged.
Update root build flow package.json	The root build flow now compiles workspaces, then bundles outputs. The test, lint, and review commands remain unchanged. The dayjs and @eslint/js version ranges are updated.
Configure PM2 production services ecosystem.config.cjs, package.json	The PM2 configuration defines seven production services. The root package adds PM2 lifecycle scripts and the pm2 development dependency.

Social App Icon Paths

Layer / File(s)	Summary
Update social app icon paths development/social/app/index.html	The favicon and Apple touch icon links now use root-relative paths.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to df07e

The Apple touch icon issue predates this change. No actionable regression is established in the reviewed changes; the PR is ready for normal checks.

🚥 Pre-merge checks | ✅ 3 | ❌ 1 | ❓ 1

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The change to the favicon and Apple touch icon URLs in development/social/app/index.html does not implement either CodeQL upgrade (#523, #524) or a CI/CD update (#526). The current PR description do…	Remove the favicon URL changes from this PR, or identify an active linked issue that requires them.
Linked Issues check	❓ Inconclusive	The workflow now uses github/codeql-action v4.38.2 for initialization and analysis, which meets the version requirements in #523 and #524. The build-script changes and CodeQL workflow updates relate…	Provide the coding requirements or acceptance criteria for #526 so its implementation can be assessed.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and relates to the changes, including PM2 and build workflow updates, but it describes them broadly as CI/CD improvements.
Description check	✅ Passed	The description includes issue references, proposed changes, and the required organization mention. It identifies PM2 and dependency updates but does not summarize the build strategy changes or app ic…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Linked Issues check

Explanation

The workflow now uses github/codeql-action v4.38.2 for initialization and analysis, which meets the version requirements in #523 and #524. The build-script changes and CodeQL workflow updates relate to #526’s CI/CD objective. The supplied text for #526 gives only its title and no coding acceptance criteria, so full compliance with #526 cannot be established.

Full details: Out of Scope Changes check

Explanation

The change to the favicon and Apple touch icon URLs in development/social/app/index.html does not implement either CodeQL upgrade (#523, #524) or a CI/CD update (#526). The current PR description does not identify an icon change as an objective. The other summarized changes relate to the stated PM2/dependency work or to CI/CD and build scripts.

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the scripts at dawn
The compile names hop neatly on
Seven services start their run
Root-bound icons greet the sun
CodeQL steps use versions new
And bundles follow through##}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud