From 04918412b7bd632a5c2d7cce405bb691a5fec132 Mon Sep 17 00:00:00 2001
From: Yury Bayda <yury@bayda.pro>
Date: Sat, 15 Aug 2026 00:36:57 -0700
Subject: [PATCH] ci: gate deploy on lint and scope workflow permissions

Drop the blanket workflow permissions in favour of per-job grants, so only
the deploy job holds `pages: write` and `id-token: write`.

Run `make check` as a job that build depends on, so a lint failure stops
the deployment on pushes to main and not only on pull requests. Serialize
the deploy job on a `pages` concurrency group to stop overlapping pushes
racing each other.

Add CODEOWNERS and a monthly Dependabot schedule for npm and actions.
---
 .github/CODEOWNERS         |  1 +
 .github/dependabot.yml     | 22 ++++++++++++++++++++
 .github/workflows/main.yml | 42 ++++++++++++++++++++++++++++++--------
 3 files changed, 56 insertions(+), 9 deletions(-)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/dependabot.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..abf1fbe
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @Coding-Cuddles/slides-maintainers
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..8e8d3e4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+    versioning-strategy: "increase"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 863ff2e..0111e34 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -6,19 +6,34 @@ on:
       - main
   pull_request:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+permissions: {}
 
 jobs:
-  build:
+  lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+
+      - run: npm ci --ignore-scripts
 
-      - uses: actions/configure-pages@v5
+      - run: make check
+
+  build:
+    needs: lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v7
 
       - name: Install Pandoc and LaTeX
         run: |
@@ -33,12 +48,21 @@ jobs:
         run: make -j
 
       - name: Upload artifacts
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
     if: ${{ github.ref == 'refs/heads/main' }}
+    permissions:
+      pages: write
+      id-token: write
+
+    # Job-level rather than workflow-level: only the deployment needs
+    # serializing, and a shared group would queue unrelated pull request runs.
+    concurrency:
+      group: pages
+      cancel-in-progress: false
 
     environment:
       name: github-pages
@@ -47,4 +71,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5