From 78f10bc1ec8ece86b00f200f0a72b89fcc1482ec Mon Sep 17 00:00:00 2001
From: Jon Bogaty <jon@jonbogaty.com>
Date: Mon, 27 Jul 2026 00:20:27 -0500
Subject: [PATCH 1/2] ci: bump actions/checkout to v7.0.1

Latest patch release; supersedes the v7.0.0 pin merged with the
static-site rebuild.
---
 .github/workflows/cd.yml | 2 +-
 .github/workflows/ci.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index b718801f..5f400814 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -22,7 +22,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 069ec04e..8617b790 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Assert no Node build pipeline
         run: |

From ab4bf84743a8395e177db1333eff43fc35bb185e Mon Sep 17 00:00:00 2001
From: Jon Bogaty <jon@jonbogaty.com>
Date: Mon, 27 Jul 2026 00:20:36 -0500
Subject: [PATCH 2/2] feat(ci): add Dependabot + safe automerge for GitHub
 Actions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reintroduces automated dependency updates and automerge — the site's
prior React/Vite architecture had both (ci/scheduled-automerge-and-resume-workflow,
fix/automerge-author-login), but they were removed along with the
Node build pipeline when the site was rebuilt as static HTML. The
dependency surface today is just 4 SHA-pinned GitHub Actions, so this
is scoped to the github-actions ecosystem only — there is no npm/pnpm
surface to track.

Design changes vs. the old workflow (not a mechanical port):
- Uses dependabot/fetch-metadata instead of regex-matching
  `author.login` against "dependabot[bot]" — the old approach broke
  when GitHub changed the login format to "app/dependabot"
  (fix/automerge-author-login was a patch for that exact fragility).
- Uses native `gh pr merge --auto --squash`, which defers to
  GitHub's own required-status-check gating, instead of grepping
  `gh pr checks` output for job names like "Lint|Typecheck|Build|Test"
  that no longer exist in the single-job static-site CI.
- Runs on GITHUB_TOKEN, not a custom CI_GITHUB_TOKEN PAT.
- Major-version action bumps are excluded from automerge and require
  manual review.
---
 .github/dependabot.yml          | 12 ++++++++++++
 .github/workflows/automerge.yml | 29 +++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/automerge.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..ba21b450
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: ci
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
new file mode 100644
index 00000000..344e5c6d
--- /dev/null
+++ b/.github/workflows/automerge.yml
@@ -0,0 +1,29 @@
+name: Automerge
+
+on:
+  pull_request_target:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Approve and enable auto-merge (patch/minor only)
+        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          gh pr review "$PR_URL" --approve
+          gh pr merge "$PR_URL" --squash --auto