Merge pull request #19 from iwf-web/develop

Release

Author: D3strukt0r

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,29 @@
+{
+  "features": {
+    "ghcr.io/devcontainers-extra/features/act:1": {
+      "version": "1.0.15",
+      "resolved": "ghcr.io/devcontainers-extra/features/act@sha256:db4a2194930d1f7ec62822d4f600dd2fa4aff3c33b98cdb0b578b64ffb10924c",
+      "integrity": "sha256:db4a2194930d1f7ec62822d4f600dd2fa4aff3c33b98cdb0b578b64ffb10924c"
+    },
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "version": "2.5.9",
+      "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a",
+      "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a"
+    },
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
+      "version": "1.10.0",
+      "resolved": "ghcr.io/devcontainers/features/docker-outside-of-docker@sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e",
+      "integrity": "sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e"
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {
+      "version": "1.1.0",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671",
+      "integrity": "sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671"
+    },
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "2.1.0",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857",
+      "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -18,7 +18,7 @@
     "ghcr.io/devcontainers/features/common-utils:2": {
       "configureZshAsDefaultShell": true
     },
-    "ghcr.io/devcontainers/features/node:1": {
+    "ghcr.io/devcontainers/features/node:2": {
       "version": "24",
       "pnpmVersion": "latest"
     },

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+# Last matching pattern wins. Only ONE listed owner needs to approve, not all.
+
+# Default owner for everything.
+* @D3strukt0r
+
+# Files Dependabot manages — @iwf-web/CI (incl. the bot user) can also review,
+# so the bot's auto-approval satisfies the code-owner requirement on these paths.
+# npm
+/package.json @D3strukt0r @iwf-web/CI
+# github-actions
+/.github/workflows/ @D3strukt0r @iwf-web/CI
+# devcontainers
+/.devcontainer/ @D3strukt0r @iwf-web/CI

.github/dependabot.yml

@@ -13,9 +13,14 @@ updates:
     labels:
       - "dependabot :robot:"
     schedule:
-      interval: weekly # on monday
+      interval: weekly
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: devcontainers
     directory: /
@@ -24,8 +29,13 @@ updates:
       - "dependabot :robot:"
     schedule:
       interval: weekly
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
+    groups:
+      devcontainers:
+        patterns:
+          - "*"
 
   - package-ecosystem: npm # pnpm
     directory: /
@@ -34,5 +44,13 @@ updates:
       - "dependabot :robot:"
     schedule:
       interval: weekly
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
+    cooldown:
+      default-days: 1 # Match pnpm 11 default minimumReleaseAge (1440 min = 1 day)
+    groups:
+      npm-non-breaking:
+        update-types:
+          - minor
+          - patch

release-please-config.json .github/release-please-config.jsonrelease-please-config.json renamed to .github/release-please-config.json

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main, develop]
   pull_request:
-    branches: [main, develop]
 
 permissions:
   contents: read
@@ -14,15 +13,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: 24.x
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@v6
 
       - name: Get pnpm cache directory path
         id: pnpm-cache-dir-path

.release-please-manifest.json .github/release-please-manifest.json.release-please-manifest.json renamed to .github/release-please-manifest.json

@@ -17,10 +17,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Fetch Dependabot metadata 🔍
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         id: metadata
         with:
           github-token: ${{ github.token }}
@@ -29,7 +29,7 @@ jobs:
         if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
         run: |
           gh pr checkout "$PR_URL" # sets the upstream metadata for `gh pr status`
           if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ]; then

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ jobs:
   greeting:
     name: Greet First-Time Contributors
     runs-on: ubuntu-latest
+    if: github.actor != 'dependabot[bot]'
 
     steps:
       - name: Greet First-Time Contributors

.github/workflows/dependabot-automerge.yml

@@ -14,10 +14,60 @@ jobs:
       pull-requests: write
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
+      # Non-empty JSON when release-please created or updated a release PR
+      # this run. Used by `reattribute` below to decide whether to amend.
+      pr: ${{ steps.release.outputs.pr }}
     steps:
       - name: Create Release PR
-        uses: googleapis/release-please-action@v4
         id: release
+        uses: googleapis/release-please-action@v5
+        with:
+          config-file: .github/release-please-config.json
+          manifest-file: .github/release-please-manifest.json
+          # Bot PAT with access to Workflows
+          # The built-in GITHUB_TOKEN has cannot trigger other workflows
+          token: ${{ secrets.GH_PAT }}
+
+  # release-please-action commits the release PR's contents as the PAT
+  # owner (the action has no input to override the commit author). Re-attribute
+  # to github-actions[bot] so the PR shows the bot as author instead of the
+  # person the PAT belongs to.
+  reattribute:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.pr != '' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    # Cosmetic best-effort: rewrites the release-PR commit author to the bot. If
+    # the release PR is merged before this runs, its branch is deleted and the
+    # checkout below can't fetch it — don't fail the release workflow over that.
+    continue-on-error: true
+    env:
+      # release-please's branch name varies by config (`release-please--branches--<base>`
+      # for single-package, with extra `--components--<name>` segments for component mode).
+      # The action emits the PR object as JSON — pull `headBranchName` from it instead of
+      # guessing the pattern.
+      PR_BRANCH: ${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}
+    steps:
+      - name: Checkout release-please branch
+        uses: actions/checkout@v7
+        with:
+          token: ${{ secrets.GH_PAT }}
+          ref: ${{ env.PR_BRANCH }}
+          fetch-depth: 2
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Amend release commit as github-actions[bot]
+        run: |
+          set -euo pipefail
+          # --reset-author rewrites both author and committer to the configured
+          # identity; --no-edit keeps the existing commit message verbatim.
+          git commit --amend --reset-author --no-edit
+          git push origin "$PR_BRANCH" --force-with-lease
 
   publish:
     needs: release-please
@@ -28,7 +78,7 @@ jobs:
       id-token: write # for provenance
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # Setup .npmrc file to publish to npm
       - name: Setup Node.js
@@ -38,7 +88,7 @@ jobs:
           registry-url: https://registry.npmjs.org
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@v6
 
       #- name: Get pnpm cache directory path
       #  id: pnpm-cache-dir-path