规范项目标准，更改为MIT协议

.github/dependabot.yml

@@ -0,0 +1,50 @@
+version: 2
+updates:
+  # 核心包依赖
+  - package-ecosystem: "npm"
+    directory: "/packages/core"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "core"
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+
+  # 编辑器应用依赖
+  - package-ecosystem: "npm"
+    directory: "/packages/editor-app"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "editor"
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+
+  # 根目录依赖
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(deps)"

.github/workflows/codecov.yml

@@ -0,0 +1,45 @@
+name: Code Coverage
+
+on:
+  push:
+    branches: [ master, main ]
+  pull_request:
+    branches: [ master, main ]
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests with coverage
+        run: |
+          cd packages/core
+          npm run test:coverage
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./packages/core/coverage/coverage-final.json
+          flags: core
+          name: core-coverage
+          fail_ci_if_error: true
+          verbose: true
+
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: packages/core/coverage/

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master", "main" ]
+  pull_request:
+    branches: [ "master", "main" ]
+  schedule:
+    - cron: '0 0 * * 1' # 每周一运行
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-and-quality
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/release-core.yml

@@ -1,245 +0,0 @@
-name: Release Core Package
-
-on:
-  workflow_dispatch:
-    inputs:
-      version_type:
-        description: 'Version bump type'
-        required: true
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-        default: 'patch'
-      custom_version:
-        description: 'Custom version (optional, overrides version_type)'
-        required: false
-        type: string
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'npm'
-
-      - name: Configure Git
-        run: |
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: |
-          cd packages/core
-          npm run test:ci
-
-      - name: Determine version
-        id: version
-        run: |
-          cd packages/core
-          CURRENT_VERSION=$(node -p "require('./package.json').version")
-          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-
-          if [ -n "${{ github.event.inputs.custom_version }}" ]; then
-            NEW_VERSION="${{ github.event.inputs.custom_version }}"
-            echo "Using custom version: $NEW_VERSION"
-          else
-            # 使用 npm version 命令计算新版本（但不实际提交）
-            npm version ${{ github.event.inputs.version_type }} --no-git-tag-version
-            NEW_VERSION=$(node -p "require('./package.json').version")
-            echo "Bumping ${{ github.event.inputs.version_type }} version: $CURRENT_VERSION → $NEW_VERSION"
-            # 恢复 package.json 以便后续步骤重新修改
-            git checkout package.json
-          fi
-
-          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update package version
-        run: |
-          cd packages/core
-          npm version ${{ steps.version.outputs.new_version }} --no-git-tag-version
-
-      - name: Build package
-        run: |
-          cd packages/core
-          npm run build:npm
-
-      - name: Publish to npm
-        run: |
-          cd packages/core/dist
-          npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Create Git tag
-        run: |
-          git tag -a "core-v${{ steps.version.outputs.new_version }}" -m "Release @esengine/ecs-framework v${{ steps.version.outputs.new_version }}"
-          git push origin "core-v${{ steps.version.outputs.new_version }}"
-
-  # 发布成功后，创建 PR 更新版本号
-  update-version-pr:
-    needs: release
-    if: success()
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.x'
-          cache: 'npm'
-
-      - name: Configure Git
-        run: |
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Generate changelog
-        id: changelog
-        run: |
-          # 获取上一个core版本的tag
-          PREVIOUS_TAG=$(git tag -l "core-v*" --sort=-v:refname | head -n 1)
-
-          if [ -z "$PREVIOUS_TAG" ]; then
-            echo "No previous tag found, using initial commit"
-            PREVIOUS_TAG=$(git rev-list --max-parents=0 HEAD)
-          fi
-
-          echo "Generating changelog from $PREVIOUS_TAG to HEAD"
-
-          # 生成变更日志（只包含core相关的提交）
-          CHANGELOG=$(git log $PREVIOUS_TAG..HEAD --pretty=format:"- %s (%h)" --no-merges -- packages/core/)
-
-          if [ -z "$CHANGELOG" ]; then
-            CHANGELOG="No changes to core package since last release"
-          fi
-
-          # 保存到文件以便在PR中使用
-          echo "$CHANGELOG" > /tmp/changelog.txt
-
-          # 输出用于调试
-          echo "Changelog:"
-          cat /tmp/changelog.txt
-
-      - name: Update version in package.json
-        run: |
-          cd packages/core
-
-          if [ -n "${{ github.event.inputs.custom_version }}" ]; then
-            NEW_VERSION="${{ github.event.inputs.custom_version }}"
-            npm version $NEW_VERSION --no-git-tag-version --allow-same-version
-          else
-            npm version ${{ github.event.inputs.version_type }} --no-git-tag-version
-            NEW_VERSION=$(node -p "require('./package.json').version")
-          fi
-
-          echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
-
-          # 验证文件已修改
-          git diff --exit-code package.json && echo "::error::No version change detected" && exit 1 || true
-
-          echo "Updated package.json to version: $NEW_VERSION"
-          cat package.json | grep version
-
-      - name: Prepare PR body
-        id: pr_body
-        run: |
-          CHANGELOG_CONTENT=$(cat /tmp/changelog.txt)
-
-          # 创建PR描述
-          cat > /tmp/pr_body.md <<EOF
-          ## 🚀 发布 @esengine/ecs-framework v${{ env.NEW_VERSION }} / Release @esengine/ecs-framework v${{ env.NEW_VERSION }}
-
-          **中文说明**
-
-          此 PR 在成功发布到 npm 后更新核心包的版本号。
-
-          ### 📝 更新日志
-          \`\`\`
-          ${CHANGELOG_CONTENT}
-          \`\`\`
-
-          ### 变更内容
-          - ✅ 更新 \`packages/core/package.json\` → \`${{ env.NEW_VERSION }}\`
-
-          ### 发布信息
-          - 📦 **版本类型**: \`${{ github.event.inputs.version_type }}\`
-          - 🏷️ **Git 标签**: \`core-v${{ env.NEW_VERSION }}\`
-          - 📦 **npm 包**: https://www.npmjs.com/package/@esengine/ecs-framework/v/${{ env.NEW_VERSION }}
-
-          ### 下一步
-          - [ ] 审查变更内容
-          - [ ] 合并此 PR 以更新仓库中的版本号
-
-          ---
-
-          **English Description**
-
-          This PR updates the core package version after successful npm release.
-
-          ### 📝 Changelog
-          \`\`\`
-          ${CHANGELOG_CONTENT}
-          \`\`\`
-
-          ### Changes
-          - ✅ Updated \`packages/core/package.json\` → \`${{ env.NEW_VERSION }}\`
-
-          ### Release Information
-          - 📦 **Version Type**: \`${{ github.event.inputs.version_type }}\`
-          - 🏷️ **Git Tag**: \`core-v${{ env.NEW_VERSION }}\`
-          - 📦 **npm Package**: https://www.npmjs.com/package/@esengine/ecs-framework/v/${{ env.NEW_VERSION }}
-
-          ### Next Steps
-          - [ ] Review the changes
-          - [ ] Merge this PR to update the version in the repository
-
-          ---
-          *此 PR 由发布工作流自动创建 / This PR was automatically created by the release workflow.*
-          EOF
-
-      - name: Create Pull Request
-        id: cpr
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore(core): bump version to ${{ env.NEW_VERSION }}"
-          committer: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
-          author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
-          branch: release/core-v${{ env.NEW_VERSION }}
-          delete-branch: true
-          title: "chore(core): Release v${{ env.NEW_VERSION }}"
-          body-path: /tmp/pr_body.md
-          labels: |
-            release
-            core
-            automated pr
-          add-paths: |
-            packages/core/package.json
-
-      - name: Check PR creation
-        run: |
-          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
-          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+      - main
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  release-core:
+    name: Release Core Package
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: |
+          cd packages/core
+          npm run test:ci
+
+      - name: Build package
+        run: |
+          cd packages/core
+          npm run build:npm
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          cd packages/core
+          npx semantic-release