Harden workflows and adopt Dependabot

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Europe/Copenhagen
+    groups:
+      npm-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    assignees:
+      - 2biazdk
+    labels:
+      - dependencies
+    open-pull-requests-limit: 5
+    versioning-strategy: increase
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:15"
+      timezone: Europe/Copenhagen
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    assignees:
+      - 2biazdk
+    labels:
+      - dependencies
+    open-pull-requests-limit: 3

.github/workflows/auto-merge.yml

@@ -18,10 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     if: >
       github.event.pull_request.draft == false &&
-      (
-        github.event.pull_request.user.login != 'renovate[bot]' ||
-        contains(github.event.pull_request.labels.*.name, 'automerge')
-      )
+      github.event.pull_request.user.login == '2biazdk' &&
+      github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
       - name: Enable auto-merge

.github/workflows/deploy-ftp.yml

@@ -14,22 +14,31 @@ permissions:
   contents: read
 
 concurrency:
-  group: deploy-ftp-${{ github.ref }}
+  group: deploy-ftp-production
   cancel-in-progress: true
 
 jobs:
   deploy:
     name: Upload FTP build
     runs-on: ubuntu-latest
+    environment:
+      name: production
+      url: https://colorcontrast.forlaens.com
     if: >
       github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
+        github.event.workflow_run.head_branch == 'main'
+      )
 
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || 'main' }}
 
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/pr-housekeeping.yml

@@ -6,6 +6,7 @@ on:
       - opened
       - reopened
       - ready_for_review
+      - closed
 
 permissions:
   contents: write

.github/workflows/tests.yml

@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Source check

.gitignore

@@ -4,5 +4,16 @@ test-results/
 .DS_Store
 npm-debug.log*
 
+# Local configuration and credentials
+.env
+.env.*
+!.env.example
+*.key
+*.pem
+*.p12
+*.pfx
+credentials.json
+service-account*.json
+
 # macOS/iCloud conflict copies
 * 2.*