Develop

[Zaiidmo]

Summary

• What does this PR change?

Why

• Why is this change needed?

Checklist

• Added/updated tests (if behavior changed)
• npm run lint passes
• npm run typecheck passes
• npm test passes
• npm run build passes
• Added a changeset (npx changeset) if this affects consumers

Notes

• Anything reviewers should pay attention to?

[Copilot]

Pull request overview

This PR updates project configuration and DTO validation schemas, and adjusts CI/release metadata to support the current toolchain (TypeScript/Zod/ESLint) and publishing flow.

Changes:

• Updates Zod DTO schemas (record key typing, IP validation helpers, enum error configuration).
• Adjusts tooling/config: TypeScript deprecation settings, ESLint import plugin swap, and CI workflow changes (Sonar + action versions).
• Adds a CHANGELOG.md, bumps package version, adds CODEOWNERS, and removes an old changeset file.

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tsconfig.json	Updates TypeScript deprecation-ignore target version.
src/core/dtos/query-audit-logs.dto.ts	Refines Zod query DTO validation (IP + record typing + enum error config).
src/core/dtos/create-audit-log.dto.ts	Refines Zod create DTO validation (IP + record typing + enum error config).
src/core/dtos/audit-log-response.dto.ts	Tightens Zod response DTO record typing.
package.json	Version bump, ESLint plugin swap, and dependency/script adjustments.
eslint.config.js	Switches to eslint-plugin-import-x as the import plugin source.
CHANGELOG.md	Introduces changelog with initial release notes.
.github/workflows/release-check.yml	Changes triggers/steps for release checks and makes Sonar run by default.
.github/workflows/publish.yml	Updates actions/setup-node to v4.
.github/CODEOWNERS	Adds repo-wide code owners.
.changeset/thick-maps-raise.md	Removes an outdated changeset file.

[Copilot]

package.json contains duplicated keys in scripts (e.g., mutation/bench appear twice). JSON parsers will keep only the last occurrence, which can hide mistakes and makes future edits error-prone. Remove the duplicates so each script name is defined exactly once.

[Copilot]

peerDependencies repeats date-fns and nanoid. Duplicate keys are effectively overwritten and can mask version mismatches. Deduplicate these entries so each peer dep is declared once.

Suggested change

	"date-fns": "^4",
	"nanoid": "^5",

[Copilot]

The changelog version header (0.1.0) doesn’t match package.json (0.0.1). This will confuse consumers and can break the publish workflow/tag expectations. Align the changelog entry version with the package version (or bump the package version accordingly).

[Copilot]

SonarCloud steps now run on every pull_request to master but rely on secrets.SONAR_TOKEN. For PRs coming from forks, GitHub does not provide repository secrets, so this workflow will fail consistently. Add a guard (e.g., skip Sonar steps when the PR is from a fork / token is unavailable) or move Sonar to a workflow that can safely access secrets.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 4 comments.

[Copilot]

Package version and changelog version are inconsistent: package.json is 0.0.1 while CHANGELOG.md starts at 0.1.0. This will confuse consumers and automated release tooling; align the changelog entry with the actual package version (or bump the package version accordingly).

Suggested change

	"version": "0.0.1",
	"version": "0.1.0",

[Copilot]

Changelog version header (0.1.0) doesn’t match the package version (0.0.1 in package.json). Please update the changelog to reflect the version that will actually be published, otherwise release notes will be misleading.

Suggested change

	## 0.1.0
	## 0.0.1

[Copilot]

The sonar job always runs on pull_request events but relies on secrets.SONAR_TOKEN. For PRs from forks, secrets are not available, so this job will fail and block CI. Add a guard (e.g., only run when secrets.SONAR_TOKEN is present / when github.event.pull_request.head.repo.fork == false) or move Sonar to push/workflow_dispatch only.

[Copilot]

The report job requests statuses: write and calls repos.createCommitStatus. On pull_request events (especially from forks), the workflow token may not have permission to write commit statuses, causing additional CI failures. Consider dropping this job (GitHub already reports job status) or gating it to trusted events (e.g., push to protected branches / non-fork PRs).

[Copilot]

Pull request overview

Copilot reviewed 11 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

package.json version is 0.0.1, but the new CHANGELOG.md section is titled 0.1.0. Align these (and/or generate the changelog via Changesets) so the published package version matches the changelog entry.

[Copilot]

The sonar job runs on every pull_request and requires secrets.SONAR_TOKEN. For PRs from forks, secrets are not provided and this job will fail, blocking CI. Add a guard (e.g., only run when github.event.pull_request.head.repo.full_name == github.repository) or otherwise make Sonar optional for forked PRs.

[Copilot]

ipAddress validation logic was changed to z.union([z.ipv4(), z.ipv6()]), but the DTO test suite doesn’t currently cover query parsing for valid/invalid ipAddress values. Add a couple of assertions in dtos.spec.ts to lock in the expected behavior (at least one valid IPv4/IPv6 and one invalid string).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud