diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index f2ca348..2daa442 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1 +1,5 @@
+# ------------------------------------------------------------- #
+# Note: this file is automatically managed in template-template #
+# ------------------------------------------------------------- #
+
 github: [ahmadnassri]
diff --git a/.github/workflows/pull_request_target.yml b/.github/workflows/pull_request_target.yml
new file mode 100644
index 0000000..2c75454
--- /dev/null
+++ b/.github/workflows/pull_request_target.yml
@@ -0,0 +1,52 @@
+# ------------------------------------------------------------- #
+# Note: this file is automatically managed in template-template #
+# ------------------------------------------------------------- #
+
+on: pull_request_target
+
+name: pull_request_target
+
+jobs:
+  metadata:
+    runs-on: ubuntu-latest
+
+    outputs:
+      repository: ${{ steps.metadata.outputs.repository }}
+
+    steps:
+      - uses: actions/checkout@v2.3.4
+
+      - uses: ahmadnassri/action-metadata@v1
+        id: metadata
+
+  auto-merge:
+    timeout-minutes: 5
+
+    runs-on: ubuntu-latest
+
+    # only run for dependabot PRs
+    if: ${{ github.actor == 'dependabot[bot]' }}
+
+    steps:
+      - uses: ahmadnassri/action-dependabot-auto-merge@v2.4
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
+
+  template-sync:
+    needs: metadata
+
+    timeout-minutes: 20
+
+    runs-on: ubuntu-latest
+
+    # only run for templates
+    if: ${{ fromJSON(needs.metadata.outputs.repository).is_template }}
+
+    steps:
+      - uses: actions/checkout@v2.3.4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+      - uses: ahmadnassri/action-workflow-queue@v1.1
+      - uses: ahmadnassri/action-template-repository-sync@v1.6.0
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
new file mode 100644
index 0000000..d491e08
--- /dev/null
+++ b/.github/workflows/push.yml
@@ -0,0 +1,186 @@
+# ------------------------------------------------------------- #
+# Note: this file is automatically managed in template-node-lib #
+# ------------------------------------------------------------- #
+
+on:
+  - push
+  - workflow_dispatch
+
+name: push
+
+jobs:
+  metadata:
+    runs-on: ubuntu-latest
+
+    outputs:
+      repository: ${{ steps.metadata.outputs.repository }}
+
+    steps:
+      - uses: actions/checkout@v2.3.4
+
+      - uses: ahmadnassri/action-metadata@v1
+        id: metadata
+
+  commit-lint:
+    timeout-minutes: 5
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: ahmadnassri/action-commit-lint@v1
+        with:
+          config: .github/linters/.commit-lint.yml
+
+  super-linter:
+    timeout-minutes: 5
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: github/super-linter/slim@v4
+        env:
+          LOG_LEVEL: ERROR
+          VALIDATE_ALL_CODEBASE: false
+          FILTER_REGEX_EXCLUDE: '/github/workspace/README.md|test/fixtures/*'
+          GITHUB_TOKEN: ${{ github.token }}
+
+  npm-audit:
+    timeout-minutes: 5
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: actions/setup-node@v2.1.5
+
+      - run: npm audit --audit-level=critical
+
+  test-strategy:
+    needs:
+      - commit-lint
+      - super-linter
+      - npm-audit
+
+    timeout-minutes: 5
+
+    runs-on: ubuntu-latest
+
+    outputs:
+      matrix: ${{ steps.parse.outputs.matrix }}
+
+    steps:
+      - uses: actions/checkout@v2
+      - id: parse
+        run: echo "::set-output name=matrix::$(jq -c . < .github/matrix.json)"
+
+  test-run:
+    needs: test-strategy
+
+    timeout-minutes: 5
+
+    name: ${{ matrix.name || format('node v{0} @ {1}', matrix.node-version, matrix.os) || 'test-step' }}
+
+    strategy:
+      matrix: ${{ fromJSON(needs.test-strategy.outputs.matrix) }}
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/setup-node@v2.1.5
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+
+      - uses: actions/cache@v2.1.5
+        with:
+          path: ~/.npm
+          key: ${{ matrix.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
+
+      - run: npm ci
+      - run: npm run test:ci
+
+  release:
+    needs: test-run
+
+    # only runs on main branch
+    if: ${{ github.ref == 'refs/heads/master' }}
+
+    timeout-minutes: 20
+
+    runs-on: ubuntu-latest
+
+    outputs:
+      published: ${{ steps.release.outputs.published }}
+      version: ${{ steps.release.outputs.release-version }}
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+
+      - id: release
+        uses: ahmadnassri/action-semantic-release@v1
+        with:
+          config: ${{ github.workspace }}/.semantic.json
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+
+  mirror:
+    needs: release
+
+    timeout-minutes: 5
+
+    runs-on: ubuntu-latest
+
+    if: ${{ needs.release.outputs.published == 'true' }}
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+
+      - uses: ahmadnassri/action-github-registry-npm-proxy@v2
+        with:
+          token: ${{ secrets.GH_TOKEN }}
+          scope: ${{ github.repository_owner }}
+
+      - name: publish to github registry
+        run: |
+          jq '.name = "@'"${GITHUB_REPOSITORY/node-/}"'"' package.json > /tmp/package.json; mv /tmp/package.json .
+          npm version --no-git-tag-version v${{ needs.release.outputs.version }}
+          npm publish
+
+
+  template-sync:
+    timeout-minutes: 20
+
+    needs:
+      - metadata
+      - test-run
+      - commit-lint
+      - super-linter
+
+    # only runs on main branch and only for the template
+    if: ${{ github.ref == 'refs/heads/master' && fromJSON(needs.metadata.outputs.repository).is_template }}
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: ahmadnassri/action-workflow-queue@v1.1
+
+      - uses: actions/checkout@v2
+
+      - uses: ahmadnassri/action-template-repository-sync@v1.6.0
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
diff --git a/.pandoc.yml b/.pandoc.yml
new file mode 100644
index 0000000..6684462
--- /dev/null
+++ b/.pandoc.yml
@@ -0,0 +1,11 @@
+input-file: docs/README.md
+output-file: README.md
+metadata-file: colophon.yml
+template: docs/README.template
+
+from: gfm
+to: gfm
+
+wrap: preserve
+reference-links: true
+fail-if-warnings: false
diff --git a/docker-compose.yml b/docker-compose.yml
index eab72a1..29737e0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,30 +16,25 @@ x-node: &node
 services:
   # ---- super-linter ---- #
   lint:
-    image: github/super-linter:v3
+    image: github/super-linter:slim-v4
     volumes:
-      - ./:/tmp/lint
+      - ./:/github/workspace
     environment:
       RUN_LOCAL: 'true'
       LOG_LEVEL: 'ERROR'
       MULTI_STATUS: 'false'
+      IGNORE_GITIGNORED_FILES: 'true'
+      DEFAULT_WORKSPACE: /github/workspace
+      FILTER_REGEX_EXCLUDE: '/github/workspace/README.md|test/fixtures/*'
 
   # ---- readme generator ---- #
   readme:
-    image: pandoc/core:2.11.4
+    image: pandoc/core:2.13
     volumes:
       - ./:/data
-    command: >-
-      --metadata-file=colophon.yml
-      --template=docs/README.template
-      --output=README.md
-      --from=gfm
-      --to=gfm
-      --fail-if-warnings
-      --wrap=preserve
-      --reference-links
-      docs/README.md
+    command: --defaults=.pandoc.yml
 
+  # ---- test runner ---- #
   test:
     <<: *node
     image: node:alpine