ci: add security dependency maintenance

.github/workflows/landing-bump.yml

@@ -0,0 +1,115 @@
+name: Landing security bump
+
+on:
+  schedule:
+    - cron: '23 2 * * 1'
+  workflow_dispatch:
+  # External signature-verifying relay required; no receiver is installed here.
+  repository_dispatch:
+    types: [dependabot_alert]
+  workflow_run:
+    workflows: [Main]
+    types: [completed]
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  actions: write
+  vulnerability-alerts: read
+
+jobs:
+  check-alerts:
+    if: >-
+      vars.LANDING_MODEL != '' &&
+      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      vulnerability-alerts: read
+    outputs:
+      count: ${{ steps.alerts.outputs.count }}
+    env:
+      GH_TOKEN: ${{ secrets.LANDING_GITHUB_TOKEN || github.token }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - name: Check open security alerts
+        id: alerts
+        run: |
+          count=$(gh api --method GET "repos/$GH_REPO/dependabot/alerts" -f state=open -f per_page=1 --jq 'length')
+          echo "count=$count" >> "$GITHUB_OUTPUT"
+          if [ "$count" -eq 0 ]; then
+            echo "No open Dependabot alerts."
+          fi
+
+  bump:
+    needs: [check-alerts]
+    if: >-
+      always() && !cancelled() && vars.LANDING_MODEL != '' &&
+      (((github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') &&
+        needs.check-alerts.result == 'success' && needs.check-alerts.outputs.count == '1') ||
+       github.event_name == 'repository_dispatch' ||
+       (github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'failure' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
+        (github.event.workflow_run.event == 'pull_request' ||
+         (github.event.workflow_run.event == 'workflow_dispatch' &&
+          github.event.workflow_run.head_branch != github.event.repository.default_branch)) &&
+        vars.LANDING_BUMP_ON_FAILURE != 'false'))
+    concurrency:
+      group: landing-security-bump-${{ github.repository_id }}
+      cancel-in-progress: false
+      queue: max
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      GH_ADMISSION_TOKEN: ${{ secrets.LANDING_ADMISSION_TOKEN || github.token }}
+      GH_TOKEN: ${{ secrets.LANDING_GITHUB_TOKEN || github.token }}
+      GIT_AUTHOR_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }}
+      GIT_AUTHOR_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }}
+      GIT_COMMITTER_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }}
+      GIT_COMMITTER_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }}
+    steps:
+      - name: Check out trusted default branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Python dependencies
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: '3.12'
+      - name: Prepare GitHub Git authentication
+        run: gh auth setup-git
+      - name: Identify Landing dependency PR publisher
+        if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-')
+        run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV"
+      - name: Remediate vulnerable dependencies
+        uses: bubbuild/landing@db2f3fb331d481d6020b8e61284e410bfb1cf21e
+        env:
+          LANDING_MODEL: ${{ vars.LANDING_MODEL }}
+          LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }}
+          LANDING_API_BASE: ${{ vars.LANDING_API_BASE }}
+          LANDING_COMPLETION_ARGS: ${{ vars.LANDING_COMPLETION_ARGS || '{}' }}
+        with:
+          command: bump
+          upstream-workflow: Main
+          bump-on-failure: ${{ vars.LANDING_BUMP_ON_FAILURE || 'true' }}
+          dependency-update-actors: |
+            dependabot[bot]
+            renovate[bot]
+            ${{ env.LANDING_PUBLISHING_ACTOR }}
+            ${{ vars.LANDING_DEPENDENCY_UPDATE_ACTORS }}
+          checked-revision: ''
+          checks: |
+            make check
+            make test
+          instruction: >-
+            Security remediation only: inspect open Dependabot alerts; skip routine upgrades and stop if alert access fails. Closed alerts only reconcile tracked remediation.
+            Before editing and again before publishing a new draft, inspect open dependency PRs by package, manifest path and patched version. Reuse a matching Dependabot, Renovate or Landing PR; never create a duplicate for the same remediation.
+            Leave existing candidates with passing or pending CI unchanged. Repair only completed failed CI on the current head, using the original branch and draft status; do not force-push or create a replacement when write access fails.
+            Follow AGENTS.md: use uv, preserve dependency constraints and pinning styles, and keep manifest/lock changes scoped to the security fix.
+            Publish new candidates as English drafts on deps/landing-* branches with Conventional Commit titles and advisory/version/check evidence.
+            After each candidate push, run gh workflow run main.yml --ref <candidate-branch> and verify the run's head_sha matches; report dispatch failures without weakening checks.
+            Maintainers decide merges, releases and alert dismissal; do not change the package version or generated protocol bindings. No general review or triage is authorized.

.github/workflows/main.yml

@@ -1,6 +1,7 @@
 name: Main
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - main