From 8b995d3feea7ba91ab6bdacaefed442b0898ec0c Mon Sep 17 00:00:00 2001
From: Parv Bansal <231238266+parvbansal11@users.noreply.github.com>
Date: Wed, 5 Aug 2026 01:11:36 +0530
Subject: [PATCH] ci: keep profile assets synchronized

---
 .github/dependabot.yml        | 16 ++++++++++++++++
 .github/workflows/quality.yml |  7 ++++++-
 scripts/check_profile.py      | 20 +++++++++++++++++++-
 3 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1695418
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: UTC
+    open-pull-requests-limit: 3
+    groups:
+      workflow-dependencies:
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore(actions)"
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 0369261..077f688 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -14,5 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Check out canonical core assets
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          repository: graphabi/graphabi
+          path: .graphabi-core
       - run: python3 scripts/check_text.py
-      - run: python3 scripts/check_profile.py
+      - run: python3 scripts/check_profile.py .graphabi-core
diff --git a/scripts/check_profile.py b/scripts/check_profile.py
index 132c32a..44584ca 100644
--- a/scripts/check_profile.py
+++ b/scripts/check_profile.py
@@ -2,13 +2,24 @@
 
 from __future__ import annotations
 
+import argparse
 from pathlib import Path
 from xml.etree import ElementTree
 
 ROOT = Path(__file__).parents[1]
+ASSETS = ("demo.gif", "logo-dark.svg", "logo-light.svg")
 
 
 def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "core",
+        nargs="?",
+        type=Path,
+        default=ROOT.parent / "graphabi",
+        help="path to a GraphABI core checkout",
+    )
+    core = parser.parse_args().core.resolve()
     readme = (ROOT / "profile/README.md").read_text(encoding="utf-8")
     required = (
         "Explicit contracts",
@@ -26,12 +37,19 @@ def main() -> int:
     gif = (ROOT / "profile/assets/demo.gif").read_bytes()
     if not gif.startswith((b"GIF87a", b"GIF89a")):
         missing.append("valid demo.gif")
+    for name in ASSETS:
+        profile_asset = ROOT / "profile/assets" / name
+        core_asset = core / "docs/assets/brand" / name
+        if not core_asset.is_file():
+            missing.append(f"canonical core asset {core_asset}")
+        elif profile_asset.read_bytes() != core_asset.read_bytes():
+            missing.append(f"profile/assets/{name} synchronized with the core asset")
     if missing:
         print("Organization profile verification failed:")
         for item in missing:
             print(f"- missing {item}")
         return 1
-    print("Organization profile links, principles, command, and assets are present.")
+    print("Organization profile links, principles, command, and canonical assets are present.")
     return 0