Standardize verified dependency maintenance

.github/dependabot.yml

@@ -0,0 +1,135 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: 09:25
+    timezone: Etc/UTC
+  open-pull-requests-limit: 5
+  cooldown:
+    default-days: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'
+      update-types:
+      - minor
+      - patch
+    managed-releases:
+      patterns: &id001
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      update-types:
+      - minor
+      - patch
+    security-fixes:
+      applies-to: security-updates
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'
+- package-ecosystem: gomod
+  directories:
+  - /
+  schedule:
+    interval: weekly
+    day: monday
+    time: 09:25
+    timezone: Etc/UTC
+  open-pull-requests-limit: 5
+  cooldown:
+    default-days: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'
+      update-types:
+      - minor
+      - patch
+    managed-releases:
+      patterns: *id001
+      update-types:
+      - minor
+      - patch
+    security-fixes:
+      applies-to: security-updates
+      patterns:
+      - '*'
+      exclude-patterns:
+      - nicodes/tools/*
+      - nicodes/cicd/*
+      - nicodes/komizo-actions/*
+      - aviorstudio/gdam-actions/*
+      - '*clerk*'
+      - '*pocketbase*'
+      - '*crypto*'
+      - '*jsonwebtoken*'
+      - '*jose*'
+      - '*oauth*'
+      - '*openid*'
+      - '*passport*'
+      - '*bcrypt*'
+      - '*argon2*'
+      - '@noble/*'
+      - '*prisma*'
+      - '*drizzle*'
+      - '*migrate*'

.github/dependency-policy.json

@@ -0,0 +1,33 @@
+{
+  "version": 1,
+  "mode": "auto",
+  "ci_workflow": "ci.yml",
+  "required_checks": [
+    "Test"
+  ],
+  "integration_job": "check",
+  "dispatch_workflow": "ci.yml",
+  "max_group_size": 10,
+  "managed_dependencies": [
+    "nicodes/tools/*",
+    "nicodes/cicd/*",
+    "nicodes/komizo-actions/*",
+    "aviorstudio/gdam-actions/*"
+  ],
+  "sensitive_dependencies": [
+    "*clerk*",
+    "*pocketbase*",
+    "*crypto*",
+    "*jsonwebtoken*",
+    "*jose*",
+    "*oauth*",
+    "*openid*",
+    "*passport*",
+    "*bcrypt*",
+    "*argon2*",
+    "@noble/*",
+    "*prisma*",
+    "*drizzle*",
+    "*migrate*"
+  ]
+}

.github/workflows/ci.yml

@@ -18,8 +18,21 @@ jobs:
       - name: "Check out source"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         timeout-minutes: 3
+      - name: Record tested integration identity
+        if: github.event_name == 'pull_request'
+        uses: nicodes/tools/integration-identity@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1
+        env:
+          EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
+      - name: Upload artifacts
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: fleet-integration-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .artifacts/fleet-integration.json
+          if-no-files-found: error
+          retention-days: 7
       - name: "Set up tools"
-        uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
         with:
           version: 2026.9.12
         timeout-minutes: 15
@@ -30,7 +43,7 @@ jobs:
         run: make check
         timeout-minutes: 20
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         timeout-minutes: 5
         with:
           name: spritesmith-cli-${{ github.sha }}

.github/workflows/dependency-policy.yml

@@ -0,0 +1,25 @@
+name: Dependency Policy
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_run:
+    workflows: ["Build & Test"]
+    types: [completed]
+  workflow_dispatch:
+  schedule:
+    - cron: '25 6 * * *'
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+  checks: read
+  statuses: read
+concurrency:
+  group: dependency-policy
+  cancel-in-progress: false
+jobs:
+  auto-merge:
+    name: Apply dependency policy
+    uses: nicodes/tools/.github/workflows/dependency-merge.yml@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1
+    with:
+      runner: blacksmith-2vcpu-ubuntu-2404