From da6c2c00d08816a13c04af153900bae3feb6a55e Mon Sep 17 00:00:00 2001
From: "J.W. Jonkers" <info@jorisjonkers.dev>
Date: Mon, 9 Nov 2026 22:38:07 +0100
Subject: [PATCH] ci: enforce the package proxy guard

---
 .github/workflows/add-to-project.yml     |  2 +-
 .github/workflows/ci.yml                 |  3 ++-
 .github/workflows/repository-hygiene.yml | 26 ++++++++++++++++++++++++
 3 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/repository-hygiene.yml

diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index 75bd14d..a38e91f 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -33,7 +33,7 @@
 
 'jobs':
   'add-to-project':
-    'uses': 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@f8f0a5ae583913de18143bbbbe0db9ecab970435' # v0.45.0
+    'uses': 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@8b5462a796f022647dfc44123ddb3655cc3c2f28' # v0.45.3
     'with':
       'project-url': 'https://github.com/orgs/JorisJonkers-dev/projects/2'
     'secrets':
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a070ab8..49c4d5b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,8 +27,9 @@ jobs:
       # Python and npm packages come through the estate's package proxy, which never serves a
       # version published less than 7 days ago (JorisJonkers-dev/workspace#167). A pull request
       # from a fork gets no secret, and then this step does nothing.
-      - uses: JorisJonkers-dev/github-workflows/actions/setup-package-proxy@f8f0a5ae583913de18143bbbbe0db9ecab970435 # v0.45.0
+      - uses: JorisJonkers-dev/github-workflows/actions/setup-package-proxy@8b5462a796f022647dfc44123ddb3655cc3c2f28 # v0.45.3
         with:
+          require-package-proxy: true
           token: ${{ secrets.PACKAGES_PROXY_TOKEN }}
 
       - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6
diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
new file mode 100644
index 0000000..f485397
--- /dev/null
+++ b/.github/workflows/repository-hygiene.yml
@@ -0,0 +1,26 @@
+name: Repository Hygiene
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  repository-hygiene:
+    uses: JorisJonkers-dev/github-workflows/.github/workflows/repository-hygiene-guard.yml@8b5462a796f022647dfc44123ddb3655cc3c2f28 # v0.45.3
+    with:
+      package-proxy-guard: enforce
+    secrets:
+      PACKAGES_PROXY_TOKEN: ${{ secrets.PACKAGES_PROXY_TOKEN }}