Standardize verified dependency maintenance

.github/dependabot.yml

@@ -1,19 +1,71 @@
-# Keeps the pinned `uses:` refs in .github/workflows and .github/actions current.
-#
-# Every third-party action here is pinned to a commit SHA rather than a tag,
-# which is the point: a tag is a moving reference, and whoever can move it can
-# run code in these jobs. The cost of a SHA is that nothing tells you when it
-# has gone stale -- a tag at least reads as a version. This is the thing that
-# tells you.
-#
-# No groups: the shared gate (scripts/engineering/helpers/dependency-policy.py)
-# never passes a grouped update -- several dependencies cannot be judged as one
-# routine change -- so a group would only sit waiting for review. One pull
-# request per dependency keeps each merge attributable; major updates remain
-# their own reviewable pull requests either way.
 version: 2
 updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: 09:53
+    timezone: Etc/UTC
+  open-pull-requests-limit: 5
+  cooldown:
+    default-days: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'
+      - '@astrojs/check'
+      update-types:
+      - minor
+      - patch
+    managed-releases:
+      patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      update-types:
+      - minor
+      - patch
+    security-fixes:
+      applies-to: security-updates
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'

.github/dependency-policy.json

@@ -0,0 +1,31 @@
+{
+  "version": 1,
+  "mode": "auto",
+  "ci_workflow": "ci.yml",
+  "required_checks": ["Build", "Test"],
+  "integration_job": "build",
+  "dispatch_workflow": "ci.yml",
+  "max_group_size": 10,
+  "managed_dependencies": [
+    "nicodes/tools/*",
+    "nicodes/cicd/*",
+    "nicodes/komizo-actions/*",
+    "aviorstudio/gdam-actions/*"
+  ],
+  "sensitive_dependencies": [
+    "*clerk*",
+    "*pocketbase*",
+    "*crypto*",
+    "*jsonwebtoken*",
+    "*jose*",
+    "*oauth*",
+    "*openid*",
+    "*passport*",
+    "*bcrypt*",
+    "*argon2*",
+    "@noble/*",
+    "*prisma*",
+    "*drizzle*",
+    "*migrate*"
+  ]
+}

.github/workflows/ci.yml

@@ -19,8 +19,21 @@ jobs:
     steps:
       - name: "Check out source"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Record tested integration identity
+        if: github.event_name == 'pull_request'
+        uses: nicodes/tools/integration-identity@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1
+        env:
+          EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
+      - name: Upload artifacts
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: fleet-integration-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .artifacts/fleet-integration.json
+          if-no-files-found: error
+          retention-days: 7
       - name: "Set up tools"
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
       - name: Build
         uses: ./.github/actions/build
       - name: Test

.github/workflows/dependabot.yml

@@ -1,31 +1,25 @@
-name: "Dependency Policy"
-
-# Thin caller: the gate body is the shared reusable workflow in nicodes/tools,
-# pinned by full commit SHA. The policy scripts it runs come from this
-# shared workflow's independently pinned helper checkout -- never the
-# PR head. This site deploys via Vercel
-# and has no cd.yml, so merged-main coverage is dispatched onto ci.yml.
+name: Dependency Policy
 on:
   pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review]
-
-# The called workflow can only downgrade these, never elevate them; omitting
-# the block would fall back to the repository's read-only default.
+  workflow_run:
+    workflows: ["Build & Test"]
+    types: [completed]
+  workflow_dispatch:
+  schedule:
+    - cron: '53 6 * * *'
 permissions:
   contents: write
   pull-requests: write
   actions: write
   checks: read
   statuses: read
-
 concurrency:
-  group: dependabot-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
+  group: dependency-policy
+  cancel-in-progress: false
 jobs:
   auto-merge:
-    name: "Apply dependency policy"
-    uses: nicodes/tools/.github/workflows/dependabot.yml@77049b34c6a67ccbc256fe6bad033973d5ca513b # v0.11.1
+    name: Apply dependency policy
+    uses: nicodes/tools/.github/workflows/dependency-merge.yml@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1
     with:
       runner: blacksmith-2vcpu-ubuntu-2404
-      dispatch-target: ci.yml

.gitignore

@@ -22,3 +22,6 @@ pnpm-debug.log*
 
 # jetbrains setting folder
 .idea/
+
+# Generated CI evidence
+.artifacts/