ci: GitHub Actions 更新 + deploy 戦略 + postcss 脆弱性対応

.github/dependabot.yml

@@ -5,6 +5,9 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "Asia/Tokyo"
     open-pull-requests-limit: 10
     groups:
       # Bundle non-major updates into a single PR to reduce noise
@@ -18,6 +21,9 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "Asia/Tokyo"
     groups:
       github-actions:
         update-types:

.github/workflows/ci.yml

@@ -11,11 +11,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 11.2.2
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm

.github/workflows/dependabot-auto-merge.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/deploy.yml

@@ -3,6 +3,11 @@ name: Deploy to GitHub Pages
 on:
   push:
     branches: [main]
+  schedule:
+    # 毎週月曜 00:00 UTC（= 月曜 09:00 JST）。
+    # GITHUB_TOKEN によるオートマージの push は deploy をトリガーしないため、
+    # Dependabot 週次実行（月曜 06:00 JST）+ オートマージ完了の数時間後にまとめてデプロイする。
+    - cron: "0 0 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -20,11 +25,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 11.2.2
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
@@ -40,9 +43,10 @@ jobs:
       - name: Add .nojekyll
         run: touch out/.nojekyll
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: ./out
+          include-hidden-files: true
 
   deploy:
     needs: build
@@ -53,4 +57,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

pnpm-workspace.yaml

@@ -1,2 +1,4 @@
 allowBuilds:
   sharp: true
+overrides:
+  postcss@<8.5.10: ^8.5.10