From 3a00c997fbebc6fc56206e4146d25a9de3110b6c Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Thu, 24 Sep 2026 21:00:59 +0900
Subject: [PATCH 01/15] ci: add default status check and Dependabot config

---
 .github/dependabot.yml        | 22 ++++++++++++++++++++++
 .github/workflows/default.yml | 20 ++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/default.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2e734c8
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
new file mode 100644
index 0000000..51751d5
--- /dev/null
+++ b/.github/workflows/default.yml
@@ -0,0 +1,20 @@
+name: default
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  default:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Syntax check
+        run: python -m compileall -q .

From 2c412f34e1cd4084ac05b93d258500416c9d2aa8 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Thu, 24 Sep 2026 21:06:43 +0900
Subject: [PATCH 02/15] ci: pin actions in default workflow to commit SHAs

---
 .github/workflows/default.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 51751d5..a280c57 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -12,8 +12,8 @@ jobs:
   default:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
       - name: Syntax check

From a70069e53bae0d2b93c49358947ccf9ee0c41ac1 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Thu, 24 Sep 2026 21:57:21 +0900
Subject: [PATCH 03/15] ci: check that pinned dependencies resolve

---
 .github/workflows/default.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index a280c57..2907a3c 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -18,3 +18,7 @@ jobs:
           python-version: "3.12"
       - name: Syntax check
         run: python -m compileall -q .
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - name: Resolve pinned dependencies
+        run: |
+          uv pip compile pyproject.toml --python-version 3.12 --python-platform x86_64-manylinux_2_28 -q > /dev/null

From be8f7aa46f68926155cdeaa22b01a9976f0ad7a5 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Fri, 25 Sep 2026 11:03:32 +0900
Subject: [PATCH 04/15] ci: raise the Dependabot open pull request limit to 50

---
 .github/dependabot.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2e734c8..682cbaa 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,7 +9,7 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 50
   - package-ecosystem: github-actions
     directories:
       - "/"
@@ -19,4 +19,4 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 50

From a4e17e24fc048dc61b812d9e403400de2649d2d6 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Fri, 25 Sep 2026 11:08:38 +0900
Subject: [PATCH 05/15] ci: effectively remove the Dependabot open pull request
 limit

---
 .github/dependabot.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 682cbaa..fd9629c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,7 +9,7 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 50
+    open-pull-requests-limit: 1000
   - package-ecosystem: github-actions
     directories:
       - "/"
@@ -19,4 +19,4 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 50
+    open-pull-requests-limit: 1000

From ec4de14061f4f00adf26b95343bf896db4e679ba Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Fri, 25 Sep 2026 17:50:20 +0900
Subject: [PATCH 06/15] ci: find Python manifests instead of listing them

The default check now syntax-checks the whole repository and resolves every requirements file and pyproject.toml that git tracks, resolved from its own folder with the PyTorch CUDA index available. MANIFESTS and EXCLUDE narrow it where needed.
---
 .github/workflows/default.yml | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 2907a3c..61c6c68 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -10,15 +10,27 @@ permissions:
 
 jobs:
   default:
+    name: default
     runs-on: ubuntu-latest
+    env:
+      # git pathspecs for the Python manifests to resolve, and pathspecs to skip
+      MANIFESTS: "*requirements*.txt *pyproject.toml"
+      EXCLUDE: ""
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-      - name: Syntax check
-        run: python -m compileall -q .
       - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - name: Syntax check
+        run: uv run --no-project --python 3.12 python -m compileall -q -x '/(\.venv|node_modules)/' .
       - name: Resolve pinned dependencies
         run: |
-          uv pip compile pyproject.toml --python-version 3.12 --python-platform x86_64-manylinux_2_28 -q > /dev/null
+          set -f
+          read -ra include <<< "$MANIFESTS"
+          read -ra skip <<< "$EXCLUDE"
+          git ls-files -- "${include[@]}" "${skip[@]/#/:!}" | while read -r f; do
+            echo "::group::$f"
+            (cd "$(dirname "$f")" && uv pip compile "$(basename "$f")" \
+              --python-version 3.12 --python-platform x86_64-manylinux_2_28 \
+              --extra-index-url https://download.pytorch.org/whl/cu128 --index-strategy unsafe-best-match \
+              -q -o /dev/null) || { echo "::error file=$f::dependencies do not resolve"; exit 1; }
+            echo "::endgroup::"
+          done

From f2eade34c6373bdc98a320a96ced099e0aafaaf9 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Fri, 25 Sep 2026 17:57:25 +0900
Subject: [PATCH 07/15] ci: add a Semgrep job for findings a pull request adds

Runs p/default and p/trailofbits at ERROR severity with --baseline-commit set to the pull request base, so existing findings do not fail it. The image and checkout are pinned by digest and SHA.
---
 .github/workflows/default.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 61c6c68..781842f 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -34,3 +34,17 @@ jobs:
               -q -o /dev/null) || { echo "::error file=$f::dependencies do not resolve"; exit 1; }
             echo "::endgroup::"
           done
+
+  semgrep:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    container: semgrep/semgrep:1.178.0@sha256:32e459968daabe7ab86968184a29109b9564aa00392401156f9788452b42786b
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+      - name: Semgrep (only findings this pull request adds)
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          semgrep scan --config p/trailofbits --config p/default --severity ERROR --error --metrics off \
+            --baseline-commit "${{ github.event.pull_request.base.sha }}"

From 0d84f43a18acca74e44f16f88c59228e5f37dedf Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Fri, 25 Sep 2026 19:57:46 +0900
Subject: [PATCH 08/15] ci: write resolved requirements to the runner temp dir

uv writes a temp file next to the -o path, which fails under /dev.
---
 .github/workflows/default.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 781842f..d2c5ce9 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -31,7 +31,7 @@ jobs:
             (cd "$(dirname "$f")" && uv pip compile "$(basename "$f")" \
               --python-version 3.12 --python-platform x86_64-manylinux_2_28 \
               --extra-index-url https://download.pytorch.org/whl/cu128 --index-strategy unsafe-best-match \
-              -q -o /dev/null) || { echo "::error file=$f::dependencies do not resolve"; exit 1; }
+              -q -o "$RUNNER_TEMP/resolved.txt") || { echo "::error file=$f::dependencies do not resolve"; exit 1; }
             echo "::endgroup::"
           done
 

From 77f56f7da8a172f996d8d422b47c9cf4b500f9c0 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Mon, 28 Sep 2026 10:51:57 +0900
Subject: [PATCH 09/15] ci: drop the PyTorch CUDA index from the resolve step

pyproject.toml pins no CUDA torch builds, so the cu128 index and
unsafe-best-match only widen the resolver's sources.
---
 .github/workflows/default.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index d2c5ce9..4d0c4e7 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -30,7 +30,6 @@ jobs:
             echo "::group::$f"
             (cd "$(dirname "$f")" && uv pip compile "$(basename "$f")" \
               --python-version 3.12 --python-platform x86_64-manylinux_2_28 \
-              --extra-index-url https://download.pytorch.org/whl/cu128 --index-strategy unsafe-best-match \
               -q -o "$RUNNER_TEMP/resolved.txt") || { echo "::error file=$f::dependencies do not resolve"; exit 1; }
             echo "::endgroup::"
           done

From 70484598d420b36ddd49e0ea57f80b1977d3d913 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Mon, 28 Sep 2026 12:49:49 +0900
Subject: [PATCH 10/15] ci: add a 7-day Dependabot cooldown and track the
 Semgrep image

Every ecosystem waits 7 days before proposing a new release. The Semgrep
job uses the container image: form, and a docker entry for
/.github/workflows lets Dependabot bump its tag and digest.
---
 .github/dependabot.yml        | 11 +++++++++++
 .github/workflows/default.yml |  3 ++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fd9629c..1c6d6e3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,8 @@
 version: 2
 updates:
   - package-ecosystem: pip
+    cooldown:
+      default-days: 7
     directories:
       - "/"
     schedule:
@@ -11,6 +13,8 @@ updates:
         update-types: [minor, patch]
     open-pull-requests-limit: 1000
   - package-ecosystem: github-actions
+    cooldown:
+      default-days: 7
     directories:
       - "/"
     schedule:
@@ -20,3 +24,10 @@ updates:
         patterns: ["*"]
         update-types: [minor, patch]
     open-pull-requests-limit: 1000
+  - package-ecosystem: docker
+    directories:
+      - "/.github/workflows"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 4d0c4e7..7eeed74 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -37,7 +37,8 @@ jobs:
   semgrep:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
-    container: semgrep/semgrep:1.178.0@sha256:32e459968daabe7ab86968184a29109b9564aa00392401156f9788452b42786b
+    container:
+      image: semgrep/semgrep:1.178.0@sha256:32e459968daabe7ab86968184a29109b9564aa00392401156f9788452b42786b
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:

From 515774b1b8e43f34426c3bee5c0216e73481f743 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Mon, 28 Sep 2026 20:22:27 +0900
Subject: [PATCH 11/15] ci: move Semgrep to the org ruleset and name the CI job

---
 .github/workflows/{default.yml => ci.yml} | 19 ++-----------------
 1 file changed, 2 insertions(+), 17 deletions(-)
 rename .github/workflows/{default.yml => ci.yml} (63%)

diff --git a/.github/workflows/default.yml b/.github/workflows/ci.yml
similarity index 63%
rename from .github/workflows/default.yml
rename to .github/workflows/ci.yml
index 7eeed74..791d6bd 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: default
+name: ci
 
 on:
   pull_request:
@@ -9,7 +9,7 @@ permissions:
   contents: read
 
 jobs:
-  default:
+  lint:
     name: default
     runs-on: ubuntu-latest
     env:
@@ -33,18 +33,3 @@ jobs:
               -q -o "$RUNNER_TEMP/resolved.txt") || { echo "::error file=$f::dependencies do not resolve"; exit 1; }
             echo "::endgroup::"
           done
-
-  semgrep:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    container:
-      image: semgrep/semgrep:1.178.0@sha256:32e459968daabe7ab86968184a29109b9564aa00392401156f9788452b42786b
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          fetch-depth: 0
-      - name: Semgrep (only findings this pull request adds)
-        run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          semgrep scan --config p/trailofbits --config p/default --severity ERROR --error --metrics off \
-            --baseline-commit "${{ github.event.pull_request.base.sha }}"

From e2391408c3f509328c38f9d5462a64b4e5472555 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Mon, 28 Sep 2026 22:32:52 +0900
Subject: [PATCH 12/15] ci: drop the unused Dependabot docker entry for
 workflows

---
 .github/dependabot.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1c6d6e3..01f6513 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,10 +24,3 @@ updates:
         patterns: ["*"]
         update-types: [minor, patch]
     open-pull-requests-limit: 1000
-  - package-ecosystem: docker
-    directories:
-      - "/.github/workflows"
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7

From 0ca157c0969312f045a5b7fc10d8f0cbded18c27 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Mon, 28 Sep 2026 22:57:45 +0900
Subject: [PATCH 13/15] ci: cap Dependabot open pull requests at 50

---
 .github/dependabot.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 01f6513..a9362d2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,7 +11,7 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 1000
+    open-pull-requests-limit: 50
   - package-ecosystem: github-actions
     cooldown:
       default-days: 7
@@ -23,4 +23,4 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 1000
+    open-pull-requests-limit: 50

From f0e49a6f81f7e2239c27e34dadf20450b1e9e125 Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Tue, 29 Sep 2026 06:14:12 +0900
Subject: [PATCH 14/15] ci: report the lint check as lint, not default

---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 791d6bd..292f66d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,6 @@ permissions:
 
 jobs:
   lint:
-    name: default
     runs-on: ubuntu-latest
     env:
       # git pathspecs for the Python manifests to resolve, and pathspecs to skip

From b23cbe214c7060bf36caa565d156641e1694259e Mon Sep 17 00:00:00 2001
From: David Berenstein <david.m.berenstein@gmail.com>
Date: Wed, 30 Sep 2026 11:45:46 +0900
Subject: [PATCH 15/15] ci: use the default Dependabot open pull request limit

Drop open-pull-requests-limit: 50 so each entry falls back to the
default of 5. The weekly schedule and grouping stay the same, and
security updates are not subject to the limit.
---
 .github/dependabot.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a9362d2..2b8f247 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,7 +11,6 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 50
   - package-ecosystem: github-actions
     cooldown:
       default-days: 7
@@ -23,4 +22,3 @@ updates:
       minor-and-patch:
         patterns: ["*"]
         update-types: [minor, patch]
-    open-pull-requests-limit: 50