feat: add initial github workflow

Signed-off-by: Brian McGee <brian@bmcgee.ie>

.github/CONTRIBUTING.md

@@ -0,0 +1,5 @@
+By contributing to this project, you hereby acknowledge that you already read [Contributing](../docs/contributing.md)
+guideline, and you agree to the Developer Certificate of Origin (DCO). This document is a simple statement that you, as
+a contributor, have the legal right to submit the contribution.
+
+See the [Developer Certificate of Origin](https://developercertificate.org/) file for details.

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+    - package-ecosystem: "github-actions"
+      directory: "/"
+      schedule:
+          interval: "weekly"

.github/settings.yml

@@ -0,0 +1,137 @@
+repository:
+    # See https://developer.github.com/v3/repos/#edit for all available settings.
+
+    # The name of the repository. Changing this will rename the repository
+    name: treefmt.go
+
+    # A short description of the repository that will show up on GitHub
+    description: one CLI to format your repo
+
+    # A URL with more information about the repository
+    homepage: "https://numtide.github.io/treefmt.go/"
+
+    # A comma-separated list of topics to set on the repository
+    topics: "cli, formatter, unifies"
+
+    # Either `true` to make the repository private, or `false` to make it public.
+    private: false
+
+    # Either `true` to enable issues for this repository, `false` to disable them.
+    has_issues: true
+
+    # Either `true` to enable projects for this repository, or `false` to disable them.
+    # If projects are disabled for the organization, passing `true` will cause an API error.
+    has_projects: false
+
+    # Either `true` to enable the wiki for this repository, `false` to disable it.
+    has_wiki: true
+
+    # Either `true` to enable downloads for this repository, `false` to disable them.
+    has_downloads: false
+
+    # Updates the default branch for this repository.
+    default_branch: main
+
+    # Either `true` to allow squash-merging pull requests, or `false` to prevent
+    # squash-merging.
+    allow_squash_merge: true
+
+    # Either `true` to allow merging pull requests with a merge commit, or `false`
+    # to prevent merging pull requests with merge commits.
+    allow_merge_commit: true
+
+    # Either `true` to allow rebase-merging pull requests, or `false` to prevent
+    # rebase-merging.
+    allow_rebase_merge: true
+
+    # Either `true` to enable automatic deletion of branches on merge, or `false` to disable
+    delete_branch_on_merge: true
+
+    # Either `true` to enable automated security fixes, or `false` to disable
+    # automated security fixes.
+    enable_automated_security_fixes: true
+
+    # Either `true` to enable vulnerability alerts, or `false` to disable
+    # vulnerability alerts.
+    enable_vulnerability_alerts: true
+
+# Labels: define labels for Issues and Pull Requests
+#
+labels:
+# NOTE: leave that up to the https://github.com/numtide/.github repo
+#   - name: bug
+#     color: CC0000
+#     description: An issue with the system 🐛.
+
+#   - name: feature
+#     # If including a `#`, make sure to wrap it with quotes!
+#     color: '#336699'
+#     description: New functionality.
+
+#   - name: Help Wanted
+#     # Provide a new name to rename an existing label
+#     new_name: first-timers-only
+
+# Milestones: define milestones for Issues and Pull Requests
+milestones:
+#   - title: milestone-title
+#     description: milestone-description
+#     # The state of the milestone. Either `open` or `closed`
+#     state: open
+
+# Collaborators: give specific users access to this repository.
+# See https://docs.github.com/en/rest/reference/repos#add-a-repository-collaborator for available options
+collaborators:
+    - username: basile-henry
+      # Note: `permission` is only valid on organization-owned repositories.
+      # The permission to grant the collaborator. Can be one of:
+      # * `pull` - can pull, but not push to or administer this repository.
+      # * `push` - can pull and push, but not administer this repository.
+      # * `admin` - can pull, push and administer this repository.
+      # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
+      # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
+      permission: push
+
+# See https://docs.github.com/en/rest/reference/teams#add-or-update-team-repository-permissions for available options
+teams:
+    - name: network
+      # The permission to grant the team. Can be one of:
+      # * `pull` - can pull, but not push to or administer this repository.
+      # * `push` - can pull and push, but not administer this repository.
+      # * `admin` - can pull, push and administer this repository.
+      # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
+      # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
+      permission: maintain
+
+branches:
+    - name: main
+      # https://docs.github.com/en/rest/reference/repos#update-branch-protection
+      # Branch Protection settings. Set to null to disable
+      protection:
+          # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
+          required_pull_request_reviews:
+              # # The number of approvals required. (1-6)
+              # required_approving_review_count: 1
+              # # Dismiss approved reviews automatically when a new commit is pushed.
+              # dismiss_stale_reviews: true
+              # # Blocks merge until code owners have reviewed.
+              # require_code_owner_reviews: true
+              # # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
+              # dismissal_restrictions:
+              #   users: []
+              #   teams: []
+          # Required. Require status checks to pass before merging. Set to null to disable
+          required_status_checks:
+              # Required. Require branches to be up to date before merging.
+              strict: true
+              # Required. The list of status checks to require in order to merge into this branch
+              contexts: []
+          # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
+          enforce_admins: false
+          # Disabled for mergify to work
+          required_linear_history: false
+          # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
+          restrictions:
+              apps: ["mergify"]
+              users: []
+              teams: []

.github/workflows/gh-pages.yml

@@ -0,0 +1,37 @@
+# Build and deploy MkDocs to gh-pages for main branch
+name: gh-pages
+on:
+    push:
+        branches:
+            - main
+            - staging
+            - trying
+    pull_request:
+    workflow_dispatch:
+
+permissions:
+    contents: write
+
+jobs:
+    gh-pages:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+            - uses: cachix/install-nix-action@v25
+            - uses: cachix/cachix-action@v14
+              with:
+                  name: numtide
+                  authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+            - name: Build the docs
+              id: build
+              run: |
+                  nix build .#docs
+                  echo "result=$(readlink ./result)" >> $GITHUB_OUTPUT
+
+            - name: Deploy
+              uses: peaceiris/actions-gh-pages@v3
+              if: github.ref == 'refs/heads/main'
+              with:
+                  github_token: ${{ secrets.GITHUB_TOKEN }}
+                  publish_dir: "${{ steps.build.outputs.result }}/"