May: dev commits to staging

.github/dco.yml

@@ -0,0 +1,3 @@
+---
+require:
+  members: false

.github/dependabot.yml

@@ -0,0 +1,22 @@
+---
+version: 2
+updates:
+
+  # Maintain GitHub Actions dependencies
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "actions/*"
+    open-pull-requests-limit: 5
+    labels:
+      - "bot"
+      - "automation 🦾" # Required for enforce-change-type-label.yaml check
+    commit-message:
+      prefix: "[CHORE](deps)"
+      include: "scope"
+    cooldown:
+      default-days: 7

.github/workflows/check-python-code.yaml

@@ -1,7 +1,7 @@
 name: Check Python package code
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - 'packages/**'
       - 'pyproject.toml'
@@ -13,25 +13,59 @@ on:
       - 'pyproject.toml'
       - 'uv.lock'
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
+    name: Check (${{ matrix.resolution }}, py${{ matrix.python }})
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == github.repository
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Default resolution exercises the committed lock against every
+        # supported Python minor version. The lowest-direct cell pins each
+        # direct dependency to its declared floor (see UV_RESOLUTION below)
+        # and runs only on the Python floor.
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        resolution: [default]
+        include:
+          - python: "3.10"
+            resolution: lowest-direct
+
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           version: "latest"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: "3.10"
+          python-version: ${{ matrix.python }}
+
+      # UV_RESOLUTION=lowest-direct makes `uv sync` re-resolve every direct
+      # dependency to the lowest version permitted by pyproject.toml. This
+      # exercises the declared floor (e.g. pydantic==2.12.0) instead of
+      # whatever the committed lock happens to point at. Failures here mean
+      # a direct dep's minimum needs to be bumped. Set via GITHUB_ENV only
+      # in the relevant cell so default cells run with no UV_RESOLUTION at
+      # all -- otherwise an empty value is rejected by uv.
+      - name: Configure resolution
+        if: matrix.resolution == 'lowest-direct'
+        run: echo "UV_RESOLUTION=lowest-direct" >> "$GITHUB_ENV"
 
       - name: Run make check
         run: make check

.github/workflows/check-python-package-versions.yaml

@@ -1,19 +1,24 @@
 name: Check Python package version numbers
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - '**/pyproject.toml'
       - 'packages/**/__about__.py'
 
 permissions:
-  id-token: write
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
-    if: github.event.pull_request.head.repo.full_name == github.repository
     uses: ./.github/workflows/reusable-check-python-package-versions.yaml
+    permissions:
+      id-token: write # Required for AWS CodeArtifact OIDC authentication
+      contents: read
     with:
       before_commit: ${{ github.event.pull_request.base.sha }}
       after_commit: ${{ github.event.pull_request.head.sha }}

.github/workflows/enforce-change-type-label.yaml

@@ -4,12 +4,24 @@ on:
   pull_request:
     types: [opened, edited, labeled, unlabeled, synchronize]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   check-label:
+    name: Check label
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read # Required for reading PR labels
+
     steps:
       - name: Require exactly one change type label
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const allChangeTypeLabels = new Set([
@@ -18,12 +30,13 @@ jobs:
               'change type - documentation - member 📝',
               'change type - major 🚨',
               'change type - minor 🤏',
+              'automation 🦾',
             ]);
             const prLabels = context.payload.pull_request.labels.map(label => label.name);
             const appliedChangeTypeLabels = prLabels.filter(prLabel => allChangeTypeLabels.has(prLabel));
             if (appliedChangeTypeLabels.length !== 1) {
               const baseMessage = `The PR must have EXACTLY one of the following CHANGE TYPE labels: ${Array.from(allChangeTypeLabels).sort().join(', ')}. `
-              const n = appliedChangeTypeLabels.length; 
+              const n = appliedChangeTypeLabels.length;
               let contextualMessage;
               if (n === 0) {
                 contextualMessage = 'It currently has no change type label. Please ➕ add one label. 🙏'