chore: import upstream snapshot with attribution

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["*.x"]
+  pull_request:
+    branches: ["*.x"]
+  schedule:
+    - cron: '0 6 * * 1'
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript']
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v4
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4

.github/workflows/deploy-editor.yml

@@ -0,0 +1,51 @@
+name: Deploy Editor
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    uses: dicebear/dicebear/.github/workflows/test.yml@10.x
+  deploy:
+    needs: test
+    environment: editor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Remove all languages except English due GDPR reasons, because we can't translate the legal pages.
+      - name: Cleanup languages
+        run: find apps/editor/src/messages -type f ! -name 'en.json' -exec rm -f {} +
+
+      - name: Build editor
+        env:
+          VITE_PRIVACY_POLICY_URL: ${{ vars.VITE_PRIVACY_POLICY_URL }}
+          VITE_COOKIE_POLICY_URL: ${{ vars.VITE_COOKIE_POLICY_URL }}
+          VITE_LEGAL_NOTICE_URL: ${{ vars.VITE_LEGAL_NOTICE_URL }}
+        run: npx turbo run build --filter='@dicebear/editor...'
+
+      - name: Deploy to Bunny.net
+        uses: ayeressian/bunnycdn-storage-deploy@251c77f4b9e7e683ad00086de2bef5770c3386b2 # v2.4.5
+        with:
+          source: 'apps/editor/dist'
+          destination: ''
+          storageZoneName: '${{ secrets.EDITOR_STORAGE_NAME }}'
+          storagePassword: '${{ secrets.EDITOR_STORAGE_PASSWORD }}'
+          accessKey: '${{ secrets.CDN_ACCESS_KEY }}'
+          pullZoneId: '${{ secrets.EDITOR_PULL_ZONE_ID }}'
+          upload: 'true'
+          remove: 'true'
+          purgePullZone: 'true'

.github/workflows/deploy-website.yml

@@ -0,0 +1,52 @@
+name: Deploy Website
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    uses: dicebear/dicebear/.github/workflows/test.yml@10.x
+  deploy:
+    needs: test
+    environment: ${{ github.ref_name == '9.x' && 'website-v9' || 'website-latest' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Download legal pages
+        env:
+          PAT: ${{ secrets.PAT }}
+        run: ./apps/docs/scripts/download-legal-pages.sh
+
+      - name: Build with VitePress
+        env:
+          VITE_PRIVACY_POLICY_URL: ${{ vars.VITE_PRIVACY_POLICY_URL }}
+          VITE_COOKIE_POLICY_URL: ${{ vars.VITE_COOKIE_POLICY_URL }}
+          VITE_LEGAL_NOTICE_URL: ${{ vars.VITE_LEGAL_NOTICE_URL }}
+        run: npx turbo run build --filter='@dicebear/docs...'
+
+      - name: Deploy to Bunny.net
+        uses: ayeressian/bunnycdn-storage-deploy@251c77f4b9e7e683ad00086de2bef5770c3386b2 # v2.4.5
+        with:
+          source: 'apps/docs/.vitepress/dist'
+          destination: ''
+          storageZoneName: '${{ secrets.WEBSITE_STORAGE_NAME }}'
+          storagePassword: '${{ secrets.WEBSITE_STORAGE_PASSWORD }}'
+          accessKey: '${{ secrets.CDN_ACCESS_KEY }}'
+          pullZoneId: '${{ secrets.WEBSITE_PULL_ZONE_ID }}'
+          upload: 'true'
+          remove: 'true'
+          purgePullZone: 'true'

.github/workflows/publish.yml

@@ -0,0 +1,141 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
+jobs:
+  test:
+    uses: dicebear/dicebear/.github/workflows/test.yml@10.x
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+      - run: npx turbo run build --filter='!@dicebear/docs' --filter='!@dicebear/editor'
+
+      - name: Determine dist tag
+        shell: bash
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          TAG=${GITHUB_REF#refs/tags/}
+          if [[ "$TAG" =~ -(alpha|beta|rc)\. ]]; then
+            echo "DIST_TAG=next" >> $GITHUB_ENV
+          else
+            git fetch origin "$DEFAULT_BRANCH" --depth=1
+            if git merge-base --is-ancestor "$GITHUB_SHA" "origin/$DEFAULT_BRANCH"; then
+              echo "DIST_TAG=latest" >> $GITHUB_ENV
+            else
+              MAJOR=$(echo "$TAG" | sed 's/^v//' | cut -d. -f1)
+              echo "DIST_TAG=v${MAJOR}-lts" >> $GITHUB_ENV
+            fi
+          fi
+
+      - run: node scripts/publish.mjs "$DIST_TAG"
+
+  publish-python:
+    needs: test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Build dicebear-core
+        working-directory: src/python/core
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+
+      # Trusted Publishing (OIDC) — no token. Configure the publisher on PyPI:
+      # project dicebear-core, repo dicebear/dicebear, workflow publish.yml.
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: src/python/core/dist/
+
+  publish-rust:
+    needs: test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Verify the crate compiles
+        working-directory: src/rust/core
+        run: cargo check --all-features
+
+      # Trusted Publishing (OIDC) — no token. Configure the publisher on
+      # crates.io: crate dicebear-core, repo dicebear/dicebear, workflow
+      # publish.yml.
+      - name: Authenticate to crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1.0.4
+
+      - name: Publish to crates.io
+        working-directory: src/rust/core
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+
+  publish-pub:
+    needs: test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dart-lang/setup-dart@v1
+
+      # Automated publishing (OIDC via setup-dart, no stored token). Configure
+      # on pub.dev: package dicebear_core, repository dicebear/dicebear, tag
+      # pattern v{{version}}. Unlike the Go and PHP ports, pub.dev publishes
+      # straight from the monorepo subdirectory — no split repository.
+      - name: Copy the project changelog into the package
+        # CHANGELOG.md inside the package is a git-ignored build artifact:
+        # pub.dev expects it in the package directory, while the repository
+        # maintains a single changelog at the root.
+        run: cp CHANGELOG.md src/dart/core/CHANGELOG.md
+      # The first release is published manually (pub.dev's automated-publishing
+      # settings only exist once the package does), so skip cleanly when the
+      # pubspec version is already live. This also makes re-runs of the
+      # workflow safe.
+      - name: Check whether this version is already on pub.dev
+        id: pub-version
+        working-directory: src/dart/core
+        run: |
+          VERSION=$(sed -n 's/^version: //p' pubspec.yaml)
+          if curl -fsSL https://pub.dev/api/packages/dicebear_core \
+            | jq -e --arg v "$VERSION" '.versions[] | select(.version == $v)' \
+            > /dev/null; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish to pub.dev
+        if: steps.pub-version.outputs.exists == 'false'
+        working-directory: src/dart/core
+        run: dart pub publish --force

.github/workflows/split-go-core.yml

@@ -0,0 +1,41 @@
+name: Split Go Core
+
+on:
+  push:
+    branches:
+      - '*.x'
+    tags:
+      - 'v*'
+
+jobs:
+  split:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+        uses: danharrin/monorepo-split-github-action@v2.4.5
+        env:
+          GITHUB_TOKEN: ${{ secrets.SPLIT_TOKEN }}
+        with:
+          package_directory: src/go/core
+          repository_organization: dicebear
+          repository_name: dicebear-go
+          branch: ${{ github.ref_name }}
+          user_name: dicebear-bot
+          user_email: bot@dicebear.com
+
+      - if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        uses: danharrin/monorepo-split-github-action@v2.4.5
+        env:
+          GITHUB_TOKEN: ${{ secrets.SPLIT_TOKEN }}
+        with:
+          package_directory: src/go/core
+          repository_organization: dicebear
+          repository_name: dicebear-go
+          tag: ${{ github.ref_name }}
+          user_name: dicebear-bot
+          user_email: bot@dicebear.com

.github/workflows/split-php-core.yml

@@ -0,0 +1,41 @@
+name: Split PHP Core
+
+on:
+  push:
+    branches:
+      - '*.x'
+    tags:
+      - 'v*'
+
+jobs:
+  split:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+        uses: danharrin/monorepo-split-github-action@v2.4.5
+        env:
+          GITHUB_TOKEN: ${{ secrets.SPLIT_TOKEN }}
+        with:
+          package_directory: src/php/core
+          repository_organization: dicebear
+          repository_name: dicebear-php
+          branch: ${{ github.ref_name }}
+          user_name: dicebear-bot
+          user_email: bot@dicebear.com
+
+      - if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        uses: danharrin/monorepo-split-github-action@v2.4.5
+        env:
+          GITHUB_TOKEN: ${{ secrets.SPLIT_TOKEN }}
+        with:
+          package_directory: src/php/core
+          repository_organization: dicebear
+          repository_name: dicebear-php
+          tag: ${{ github.ref_name }}
+          user_name: dicebear-bot
+          user_email: bot@dicebear.com

.github/workflows/test.yml

@@ -0,0 +1,174 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - '*.x'
+  pull_request:
+    branches:
+      - '*.x'
+  workflow_call: {}
+
+jobs:
+  test-js:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [20, 22, 24, 25]
+        # See supported Node.js release schedule at https://nodejs.org/en/about/previous-releases
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm ci
+      - run: npx turbo run build --filter='!@dicebear/docs' --filter='!@dicebear/editor'
+      - run: npx turbo run test
+
+  test-php:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        php-version: ['8.2', '8.3', '8.4', '8.5']
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Use PHP ${{ matrix.php-version }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          extensions: mbstring
+      - name: Install dependencies
+        working-directory: src/php/core
+        run: composer install --no-interaction --prefer-dist
+      - name: Run PHPStan
+        working-directory: src/php/core
+        run: vendor/bin/phpstan analyse --no-progress
+      - name: Run tests
+        working-directory: src/php/core
+        run: vendor/bin/phpunit
+
+  test-python:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Use Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        working-directory: src/python/core
+        run: pip install -e ".[dev]"
+      - name: Run Ruff
+        working-directory: src/python/core
+        run: |
+          ruff check .
+          ruff format --check .
+      - name: Run mypy
+        working-directory: src/python/core
+        run: mypy src
+      - name: Run tests
+        working-directory: src/python/core
+        run: pytest
+
+  test-rust:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - name: Check formatting
+        working-directory: src/rust/core
+        run: cargo fmt --check
+      - name: Run Clippy
+        working-directory: src/rust/core
+        run: cargo clippy --all-targets --all-features -- -D warnings
+      - name: Run tests
+        working-directory: src/rust/core
+        run: cargo test
+
+  test-go:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        go-version: ['1.23', '1.24', '1.25']
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Use Go ${{ matrix.go-version }}
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ matrix.go-version }}
+      - name: Check formatting
+        working-directory: src/go/core
+        run: test -z "$(gofmt -l .)" || (gofmt -l . && exit 1)
+      - name: Run go vet
+        working-directory: src/go/core
+        run: go vet ./...
+      - name: Run tests
+        working-directory: src/go/core
+        run: go test ./...
+
+  test-dart:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        # Lower bound = the pubspec `environment.sdk` floor; keep in sync.
+        sdk: ['3.4', 'stable']
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Use Dart ${{ matrix.sdk }}
+        uses: dart-lang/setup-dart@v1
+        with:
+          sdk: ${{ matrix.sdk }}
+      - name: Install dependencies
+        working-directory: src/dart/core
+        run: dart pub get
+      - name: Check the embedded web fixtures are up to date
+        # The web parity suite embeds a copy of the fixtures (dart2js cannot
+        # read files); regenerate it and fail if it drifted from the canonical
+        # tests/fixtures/parity.
+        working-directory: src/dart/core
+        run: |
+          dart run tool/generate_web_fixtures.dart
+          dart format test/parity/embedded_fixtures.dart
+          git diff --exit-code test/parity/embedded_fixtures.dart
+      - name: Check formatting
+        working-directory: src/dart/core
+        run: dart format --output=none --set-exit-if-changed .
+      - name: Analyze
+        working-directory: src/dart/core
+        run: dart analyze --fatal-infos
+      - name: Run tests
+        working-directory: src/dart/core
+        run: dart test
+      - name: Run web-eligible tests on dart2js
+        # The fixture suites are VM-only (they read disk via dart:io), so the
+        # dart2js build's number formatting and 32-bit PRNG arithmetic is
+        # asserted by the embedded web_parity_test under Chrome.
+        # ubuntu-latest ships google-chrome-stable.
+        working-directory: src/dart/core
+        run: dart test -p chrome
+      - name: Copy the project changelog into the package
+        # CHANGELOG.md inside the package is a git-ignored build artifact:
+        # pub.dev expects it in the package directory, while the repository
+        # maintains a single changelog at the root.
+        run: cp CHANGELOG.md src/dart/core/CHANGELOG.md
+      - name: Validate the publishable archive
+        working-directory: src/dart/core
+        run: dart pub publish --dry-run