Standardize verified dependency maintenance

.github/actions/test/action.yml

@@ -4,7 +4,7 @@ runs:
   using: composite
   steps:
     - name: Cache verified Godot archives
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: .artifacts/godot/archives
         key: gd-playwright-${{ runner.os }}-${{ runner.arch }}-godot-builds-4.7.2-sha512-9aa00f7a60520094-ca4d71c4d7b81dfc
@@ -15,7 +15,7 @@ runs:
       shell: bash
       run: make check
     - name: "Upload artifacts"
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: gd-web-evidence-${{ github.run_id }}-${{ github.job }}
         path: dist/web-export-evidence/

.github/dependabot.yml

@@ -1,24 +1,137 @@
-# Keeps the pinned `uses:` refs in .github/workflows and .github/actions current.
-#
-# Every third-party action here is pinned to a commit SHA rather than a tag,
-# which is the point: a tag is a moving reference, and whoever can move it can
-# run code in these jobs. The cost of a SHA is that nothing tells you when it
-# has gone stale -- a tag at least reads as a version. This is the thing that
-# tells you.
-#
-# Minor and patch updates are grouped: they share the same risk profile and CI
-# can merge them without ceremony. Major updates are deliberately excluded, so
-# Dependabot opens one reviewable pull request for each breaking-change boundary.
 version: 2
 updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      actions-minor-patch:
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: 09:20
+    timezone: Etc/UTC
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'
+      - '@playwright/cli'
+      update-types:
+      - minor
+      - patch
+    managed-releases:
+      patterns: &id001
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      update-types:
+      - minor
+      - patch
+    security-fixes:
+      applies-to: security-updates
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'
+  open-pull-requests-limit: 5
+  cooldown:
+    default-days: 3
+- package-ecosystem: gomod
+  directories:
+  - /cli
+  schedule:
+    interval: weekly
+    day: monday
+    time: 09:20
+    timezone: Etc/UTC
+  open-pull-requests-limit: 5
+  cooldown:
+    default-days: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'
+      - '@playwright/cli'
+      update-types:
+      - minor
+      - patch
+    managed-releases:
+      patterns: *id001
+      update-types:
+      - minor
+      - patch
+    security-fixes:
+      applies-to: security-updates
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'

.github/dependency-policy.json

@@ -0,0 +1,33 @@
+{
+  "version": 1,
+  "mode": "auto",
+  "ci_workflow": "ci.yml",
+  "required_checks": [
+    "Test"
+  ],
+  "integration_job": "ci",
+  "dispatch_workflow": "ci.yml",
+  "max_group_size": 10,
+  "managed_dependencies": [
+    "nicodes/tools/*",
+    "nicodes/cicd/*",
+    "nicodes/komizo-actions/*",
+    "aviorstudio/gdam-actions/*"
+  ],
+  "sensitive_dependencies": [
+    "*clerk*",
+    "*pocketbase*",
+    "*crypto*",
+    "*jsonwebtoken*",
+    "*jose*",
+    "*oauth*",
+    "*openid*",
+    "*passport*",
+    "*bcrypt*",
+    "*argon2*",
+    "@noble/*",
+    "*prisma*",
+    "*drizzle*",
+    "*migrate*"
+  ]
+}

.github/workflows/ci.yml

@@ -30,12 +30,25 @@ jobs:
       # comment so the version is still readable. A tag is a moving reference:
       # whoever can move it can run code in this job.
       - name: "Check out source"
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
+      - name: Record tested integration identity
+        if: github.event_name == 'pull_request'
+        uses: nicodes/tools/integration-identity@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1
+        env:
+          EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
+      - name: Upload artifacts
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: fleet-integration-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .artifacts/fleet-integration.json
+          if-no-files-found: error
+          retention-days: 7
       - name: "Set up tools"
-        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
         with:
           install_args: go bun node python actionlint shellcheck http:cicd-engineering
 

.github/workflows/dependabot.yml

@@ -1,33 +1,25 @@
-name: "Dependency Policy"
-
-# Dependabot's minor and patch action updates are grouped in dependabot.yml.
-# Once the required CI check passes, this marks only those low-risk updates for
-# squash merge. Major updates never satisfy the condition and remain manual.
+name: Dependency Policy
 on:
-  pull_request:
-
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_run:
+    workflows: ["Build & Test"]
+    types: [completed]
+  workflow_dispatch:
+  schedule:
+    - cron: '20 6 * * *'
 permissions:
   contents: write
   pull-requests: write
-
+  actions: write
+  checks: read
+  statuses: read
+concurrency:
+  group: dependency-policy
+  cancel-in-progress: false
 jobs:
   auto-merge:
-    name: "Apply dependency policy"
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    timeout-minutes: 10
-    steps:
-      - name: "Read dependency metadata"
-        id: metadata
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Enable auto-merge for minor and patch updates
-        if: >-
-          steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
-          steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        run: gh pr merge --auto --squash "$PR_URL"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
+    name: Apply dependency policy
+    uses: nicodes/tools/.github/workflows/dependency-merge.yml@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1
+    with:
+      runner: blacksmith-2vcpu-ubuntu-2404

.github/workflows/release.yml

@@ -28,13 +28,13 @@ jobs:
       version: ${{ steps.release.outputs.version }}
     steps:
       - name: "Check out source"
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: "Set up tools"
-        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
         with:
           install_args: go bun node python actionlint shellcheck http:cicd-engineering
 
@@ -118,7 +118,7 @@ jobs:
           fi
 
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-assets-${{ github.sha }}-${{ inputs.target }}
           path: release-assets/
@@ -134,7 +134,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: "Download artifacts"
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-assets-${{ github.sha }}-${{ inputs.target }}
           path: dist

.mise.toml

@@ -5,4 +5,4 @@ node = "24.18.1"
 python = "3.13.11"
 actionlint = "1.7.12"
 shellcheck = "0.11.0"
-"http:cicd-engineering" = { version = "0.14.1", url = "https://github.com/nicodes/tools/releases/download/v{{ version }}/cicd-engineering-v{{ version }}.tar.gz", checksum = "sha256:9337b7ff9c7ec47effe05560aa8cfb818a47b8f064364305cbb3fea69f797a28" }
+"http:cicd-engineering" = { version = "0.27.1", url = "https://github.com/nicodes/tools/releases/download/v{{ version }}/cicd-engineering-v{{ version }}.tar.gz", checksum = "sha256:b227f07d191675b2383fb8ef425536383a2394f2d2be0c3faef4a751c522b8e4" }

engineering-pin.json

@@ -1,5 +1,5 @@
 {
   "repository": "https://github.com/nicodes/tools",
-  "revision": "2c8aff0f2e7d8a850f68e60417bb4f7e5eda474e",
-  "source_sha256": "d759a529837b6835d3f67ae4b2b39200e6c870d5f43e5d6c4ddbeee080900d6f"
+  "revision": "ca747e13a51f301f51635c262d883d57d6084ae3",
+  "source_sha256": "4b432b4ac5ff4694f4f06b8f80767c5dc0a6de35e53839623c8c747b9b662230"
 }