[ryanio]

Brings this repo's tooling in line with seaport after its modernization (#1427 to #1431). No .sol file changes: git diff origin/main -- src/ is empty.

The package stays on npm, since seaport-core and seaport-js depend on seaport-types@1.6.3. It still has no dependencies.

Lint tooling

• scripts/install-tools.sh is copied from seaport. It installs Biome, taplo, lefthook, shellcheck, shfmt, and actionlint into .tools/bin from each tool's GitHub release, checked against a pinned SHA-256. Nothing comes from a package registry.
• scripts/lint.sh check|fix|freeze runs what CI runs.
• src/ is compiled into the deployed Seaport 1.6 bytecode through seaport-core, so foundry.toml excludes it from forge fmt and forge lint. lefthook.yml repeats the exclude, because forge fmt with explicit file paths ignores globs in [fmt] ignore.
• scripts/frozen-contracts.sha256 pins every file in src/, and the lint job fails if one changes.
• lint_on_build = false drops the "AST source not found" warnings Foundry 1.9.0 printed on every build for the constants-only files.
• .editorconfig, .taplo.toml, biome.json, and an optional lefthook pre-commit hook.

CI

• test.yml now runs on pushes to main and on pull requests (it was manual only). It has a build job (forge build --sizes) and a lint job. The old forge test step is gone because the repo has no tests, and the ci profile it set never existed.
• Foundry is pinned to v1.9.0 through the same cached setup-foundry composite action seaport uses.
• Every action is pinned by commit SHA with a version comment. Each workflow has a permissions: block, and test.yml cancels superseded PR runs.
• publish.yml keeps the release: created trigger and the NPM_TOKEN secret. It now uses Node 26 and runs npm publish --provenance --access public with id-token: write. package.json gets the object form of repository, which npm checks against the workflow's repo for provenance.
• tag.yml keeps the same tag name and branches. It drops the deprecated ::set-output commands and pushes only the new tag instead of --tags.

Other

• AGENTS.md with the rule about src/, commands, and publishing. No CLAUDE.md.
• README rewritten: what the package is, npm and forge submodule install, and links to seaport, seaport-core, seaport-js, and seaport-sol.
• PR template adapted from seaport. I left out stale.yml: the repo has no open issues.
• Removed the empty yarn.lock and the .* line in .gitignore, which ignored every new dotfile.

Verification

• scripts/lint.sh check passes locally with Foundry 1.9.0.
• forge build compiles all 35 files.
• Appending a newline to a src/ file makes the frozen-source check fail.
• npm pack --dry-run lists the same 38 files as before: the 35 sources, LICENSE, README.md, and package.json.

publish.yml and tag.yml only run on a release or a push to main, so this PR doesn't exercise them.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The concurrency group does not guarantee FIFO ordering, so an older run can execute last and force the daily tag back to an older commit without a branch-tip check.

1 open issue

• Prevent stale runs from moving the daily tag backward · New

What changed in this PR

Modernizes seaport-types tooling and CI to align with seaport while preserving the Solidity sources and dependency-free npm package.

Changes:

• Adds pinned lint tools, formatting configuration, and checksum protection for frozen Solidity sources.
• Enables build and lint checks on pull requests and main, and updates publishing and tagging workflows.
• Refreshes installation instructions and contributor guidance.

File	Description
yarn.lock	Removes the empty lockfile.
scripts/​lint.sh	Adds local check, fix, and freeze commands.
scripts/​install-tools.sh	Installs pinned, checksum-verified lint tools.
scripts/​frozen-contracts.sha256	Records checksums for frozen Solidity sources.
README.md	Updates package, installation, and development documentation.
package.json	Uses repository metadata compatible with npm provenance.
lefthook.yml	Adds optional pre-commit formatting hooks.
foundry.toml	Excludes frozen sources from formatting and linting.
biome.json	Configures formatting and lint rules.
AGENTS.md	Documents source restrictions and contributor commands.
.taplo.toml	Configures TOML formatting.
.gitignore	Allows dotfiles while ignoring installed tools.
.github/​workflows/​test.yml	Enables automated build and lint checks.
.github/​workflows/​tag.yml	Updates daily tagging and concurrency configuration.
.github/​workflows/​publish.yml	Updates Node and enables npm provenance.
.github/​pull_request_template.md	Adds contribution prompts and source restrictions.
.github/​actions/​setup-foundry/​action.yml	Adds reusable, cached Foundry setup.
.editorconfig	Defines shared editor formatting settings.

_{Review effort: Balanced}